Authorizing Resource Controllers

[Jehong-Ahn]

The standard way is to use the authorizeResource() method inside the controller.

Route::resource('posts', PostController::class);

class PostController extends Controller
{
    public function __construct()
    {
        $this->authorizeResource(Post::class, 'post');
    }
}

However, if you want to make it simpler when registering routes, you can use a macro.

Route::resource('posts', PostController::class)->authorize(Post::class);

class AppServiceProvider extends ServiceProvider
{
    public function register()
    {
        /**
         * Authorize the resource routes based on the model class and route parameter name.
         * 
         * @param  class-string<\Illuminate\Database\Eloquent\Model>  $class
         * @param  string|null  $paramName
         * @return $this
         */
        PendingResourceRegistration::macro('authorize', function ($class, $paramName = null) {
            /** @var \Illuminate\Routing\PendingResourceRegistration $this */

            if (! $paramName) {
                $paramName = Str::snake(class_basename($class));
            }

            $this->options['middleware_for'] = [
                ...($this->options['middleware_for'] ?? []),
                'index' => 'can:viewAny,' . $class,
                'show' => 'can:view,' . $class,
                'create' => 'can:create,' . $class,
                'store' => 'can:create,' . $class,
                'edit' => 'can:update,' . $paramName,
                'update' => 'can:update,' . $paramName,
                'destroy' => 'can:delete,' . $paramName,
            ];

            return $this;
        });
    }
};