Laravel only allow owner user to access route - php

Question

I have an application that has users and products. Only the product owners should be able to view the product.
If a user guesses a product id they might be able to view the product. For example
http://booker.app/admin/products/32
Following that link would allow any logged in user to view the product with id 32.
This is the route in question:
Route::middleware(['middleware' => 'auth'])->prefix('admin')->group(function(){
Route::resource('products', 'ProductController');
});
My products controller show method:
public function show(Product $product)
{
if($product->user_id !== Auth::user()->id){
return $this->forbidden('admin/products');
}
return $this->makeResponse('admin.products.product', compact('product'));
}
The forbidden and makeResponse functions simply check if the request was an ajax request and if so returns json.
As you can see I'm using route model binding and I'm checking if the authorised user is the same as product user_id. Basically is there a better way of checking if the user is the owner of the product.

Answer 1

In Laravel you can define Policies in order to specify ACL and access logic to your data layer.
For example create the class ProductPolicy:
class ProductPolicy
{
public function show(User $user, Product $product)
{
return $user->id === $product->user_id;
}
}
Then bind the policy to the Product model inserting the following line into $policies array in AuthServiceProvider:
protected $policies = [
Product::class => ProductPolicy::class,
];
Now in your controller method you can use the following syntax to authorize the user to do a certain action
public function show(Product $product)
{
$this->authorizeForUser(Auth::user(), 'show', [$product]);
return $this->makeResponse('admin.products.product', compact('product'));
}
The method authorizeForUser will call the show method of your Policy, which will return true only if the product belongs to the authenticated user.
Hope it helps.