laravel-authorization-patterns
Learn to implement authorization in Laravel using Gates for general ability checks and Policies for model-specific access rules. This skill covers middleware integration, Blade directives for conditional rendering, and Response objects for detailed permission messages. Includes testing strategies and best practices for securing controllers and form requests.
Laravel Authorization Patterns teaches Gates for general abilities and Policies for model-based access control.
AI-generated summary based on this skill's SKILL.md
Install
iSerter/laravel-claude-agents/laravel-authorization-patterns · repository language: PHP
git clone https://github.com/iSerter/laravel-claude-agents
cp -r laravel-claude-agents/skills/laravel-authorization-patterns ~/.claude/skills/laravel-authorization-patternsnpx skillfed install iSerter/laravel-claude-agents/laravel-authorization-patternsFrequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
What are Laravel authorization patterns and how do Gates and Policies differ?
Laravel-authorization-patterns teaches two complementary authorization mechanisms. Gates are simple, closure-based checks for general abilities (e.g., "can edit posts"), while Policies are classes that organize authorization logic for specific models. Gates work well for simple, application-wide permissions; Policies excel at model-specific rules like "can user edit this post?" Both integrate seamlessly with middleware, Blade directives, and the authorize() method.
How do you implement model-based authorization with Laravel Policies?
Laravel-authorization-patterns covers creating Policy classes that define methods matching your authorization needs (create, view, update, delete). You register Policies in your AuthServiceProvider, then use them via the authorize() method in controllers or form requests. Policies receive the authenticated user and the model instance, enabling fine-grained checks like verifying a user owns a post before allowing edits. The before() method can short-circuit checks for admins.
What are the best practices for applying authorization checks in routes, controllers, and views?
Laravel-authorization-patterns emphasizes checking authorization early: use middleware for route-level protection, call authorize() in controller methods or form requests for action-level checks, and employ Blade directives (@can, @cannot) in views for conditional rendering. This layered approach prevents unauthorized access at every level. Always validate in controllers and form requests, not just views, since views can be bypassed.
How do you test authorization logic and access control in Laravel?
Laravel-authorization-patterns includes testing strategies using Laravel's testing utilities. Write tests that verify authorized users can perform actions and unauthorized users receive denials. Test both Gates and Policies with different user roles and model states. Use actingAs() to simulate authenticated users, then assert that authorize() throws AuthorizationException or that responses reflect proper access denial.
What does laravel authorization middleware do and how is it configured?
Laravel-authorization-patterns covers middleware that checks authorization before reaching controllers. Middleware can verify Gates or Policies, rejecting unauthorized requests early. Configure it in your route definitions or middleware groups to enforce consistent access control across related routes. This prevents unauthorized users from ever reaching your business logic, improving security and reducing redundant checks.
How do Blade directives and authorization response objects secure forms and requests?
Laravel-authorization-patterns teaches using @can/@cannot directives to conditionally render form fields and buttons, preventing unauthorized users from seeing restricted actions. Authorization Response objects provide detailed denial messages beyond simple true/false, enabling custom error feedback. Combine these with form request authorization to validate permissions server-side, ensuring no unauthorized data reaches your database.
SKILL.md
rendered from the published skill — quoted content, verbatim
Laravel Authorization Patterns
Gates for General Ability Checks
// In AuthServiceProvider or AppServiceProvider boot()
use Illuminate\Support\Facades\Gate;
Gate::define('access-admin', function (User $user) {
return $user->is_admin;
});
Gate::define('manage-settings', function (User $user) {
return $user->hasRole('admin');
});
// Usage
if (Gate::allows('access-admin')) {
// ...
}
// ✅ Abort if unauthorized
Gate::authorize('access-admin'); // Throws AuthorizationException
// ✅ Check for specific user
Gate::forUser($otherUser)->allows('access-admin');
Policies for Model-Based Authorization
```php <?php
namespace App\Policies;
use App\Models\Post; use App\Models\User; use Illuminate\Auth\Access\Response;
class PostPolicy { // Runs before all other checks - return null to fall through public function before(User $user, string $ability): ?bool { if ($user->is_super_admin) { return true; }
return null; // Fall
(truncated - see the full file via the links below)
Read as markdown · JSON record · Browse the source repository
File tree — 1 file
skills/laravel-authorization-patterns/SKILL.md