Laravel Gates and/or Policies - php

Question

Right now Im thinking about implementing policies into my Project.
So I want 3 types of roles: User, Admin and Office.
I have a Customer class which has the following CRUD functions:
class CustomerController extends Controller
{
public function getAllCustomer()
{
return Customer::get();
}
public function addNewCustomer(Request $request)
{
$validatedData = $request->validate([
'Title' => 'required',
'Name' => 'required|max:255',
'Surname' => 'required|max:255',
'Email' => 'required',
'Phone' => 'required',
'Password' => 'required',
'dateofBirth' => 'required'
]);
return \app\model\Customer::create($request->all());
}
public function update (Request $request , Customer $id)
{
$id->update($request->all());
}
public function destroy (Customer $id)
{
$id->delete();
}
What I want is that only the Admin should be able to use the CRUD functions for all the Customers. A User should only be able to use CRUD functions on his own data (so the Customer can only do it with his own data).
I read this article:
https://code.tutsplus.com/tutorials/gates-and-policies-in-laravel--cms-29780
But I still don't know exactly how to implement it in my Project, and whether I should use Gates or policies (it seems like policies are easier, or?).
I would be very thankful if somebody could write me an example on how to implement it on my work.

Answer 1

Create policies for each of your model. Bind policies to routes https://laravel.com/docs/5.6/authorization#via-middleware
Route::post('/post/{post}', function () {
// The current user may edit post...
})->middleware('can:edit,post');
Create a parent policy which all the other policies will extend and add to it before method which will basically check if your user is admin and if so no further checking is needed.
public function before(User $authenticatedUser, $ability)
{
// super admin can access everything
if ($authenticatedUser->role == 'super_admin') {
return true;
}
return null; //fall through to the policy method
}
Create a Post policy which will have edit permission check
class PostPolicy extends Policy
{
public function edit(User $authenticatedUser, Post $post)
{
return $authenticatedUser->id == $post->author_id;
}
}
The general idea, on how to work with policies is as simple as that.