hey guys it's dan here from pixelfix and welcome back to my channel today we're going to talk about
a lot of our policies and i'll be showing you four ways how we can implement a policy now you may
ask what is a policy a policy is a way for us to restrict certain actions that happen on our model
for example we can restrict who can create who can update who can delete whatever action you want to
perform on your model you can restrict that action through a policy so today we are going to create a
policy to restrict the actions on our customers model now guys if you're not sure how we got to
this point in our application i'll leave a link in the description below to the previous episodes
that lead up to this part in our application all right so let's start off by creating our policy
and we can do this by calling php artisan make policy and now this is where the important part
comes in because laravel is so awesome we can follow naming conventions that will help us to map
our policy with our model we can call it customer and then we need to suffix the name with the word
policy and then we can pass in the model flag and we can specify our model
as being customer all right so if we didn't follow naming conventions and we've named it
something totally different we can still make it work by linking the model with the policy
and we do this in our auth service provider in the policies property now in order for us to do this
we need to link the model with the policy now there's two ways you can
specify it in the policies property you can either use the string convention
or you can use the the name space class name convention i'm pretty sure there's more
sophisticated names for it but i just call it the string convention and the namespace
class convention but seeing that we've followed naming conventions we do not need to map these
to work we can basically ignore it okay so now if we look at our policy methods you'll see
that we've got methods called view any view create update delete restore and force delete now these
are not the only methods you you can use you can also specify your own methods but we'll cover that
a little bit later now for instance your view any if you go to the lot of our documentation
so for example your policy method would be view any and that would automatically be mapped to
the controller method index same with view will be mapped to show create create and so on now
that we've created our policy let's create some authorization so for our first example
we're going to restrict who would be able to call the index method to show the list
of customers so currently in our application we've got an administrator role and we've got
a user role so in this example we're going to place a limit on the index route so that only
the administrators would be able to see a whole list of customers and we can do this by returning
the user now the user that's being passed in here that will always be the authenticated user
so the user that's that has provided the username and password we've done the authentication so in
this case we would check to see if the user has a role called administrator
okay so this method has role is a custom method we've implemented on our user model
so if we go to our user model you'll see this method takes in the role that we send it
it lowercase it then it compares it to the name of the current role assigned and then it
it will return a boolean true or false so back in our policy this would then return if the
user has a role called administrator then it would return true meaning that we allow
currently logged in user to access the view any policy method now as we know that view any policy
it would be mapped to the index method all right so let's go ahead and implement our index method
first of all let's go to our routes file and create our route we call it the get route to the
customers and then we'll call our customer
customer controller and we'll call the index route we'll then give it a name
of customers.index
and then if we go to our controller we can say we need a public function
and we call it index so what we would return here would be a new customer collection okay
it seems like we don't have a collection yet so let's quickly set up a customer collection
my php artisan make resource i will call it customer collection and will pass in the
collection flag okay so now that we have our customer collection we can say we want
to pass in the customer collection and for now what we can do is just call the customer model
and we'll return all the fields okay so now that we've set up the index method there's two things
that we still need to do firstly let's go back to the api routes file now in order for our policies
to work you need to pass authentication now in order to pass an authentication
you need to apply the sanctum middleware to the route so let's set up the sanctum middleware and
we do that by calling auth sanctum so we'll just do it on the route specifically and we'll say
middleware or center and the second thing we need to do is to use the actual policy
and we can do this in the method itself by calling this dot authorize and then you'll you'll see we
need to authorize the ability so the ability would be in this case view any because the index route
is not associated to a specific model all we need to pass in as the second parameter is basically
the customer class this will tell the authorized method to use the policy assigned to this class
okay so let's save our file head over to postman to see this in action
so currently we're not logged in so if we visit our route
right let's just quickly add the the headers i forgot to add those that'll be uh
all right so now if we send it again then we get the message we're not authenticated
because we are not currently logged in all right so let's first log in with a user
called user
okay so we've successfully logged in because we've received our
jwd token and if we look at our cookies we've received our jwd cookie
now if we go back to that same route so we should expect to see a 403 forbidden error
and there we go we've got the 403 and it says this action is unauthorized meaning that we're
not authorized to view that resource all right so quickly let's delete our cookie
and let's go back to our login let's change this to admin
and log in again okay now if we go back to the same route
and there we go it is empty but it means that we did receive
some kind of information back we've received the 200 status so let's quickly create a customer
we'll just call
pixel it
and we've got contact number um address type is a building address that's one two three four
point street and let's say we live in sydney and i'll post it goes one two three four five
okay so now we've created our customer now if we go back to that route we'll see we get the
customer as a result okay so that was method one directly using the authorized method inside
the controller method but using it this way is not really an effective way to do it because
you'll need to call the authorized method for every method inside your controller you wish to
secure using a policy that means a lot of code duplication so a better way to do this is to call
the authorized method inside your constructor and we can do this by
um set up our constructor look construct
okay and then inside the constructor we would then call this dot authorize
resource and then we would pass in the model which would be customer
class now this is what i said earlier where all your policy methods would automatically be
mapped to your controller methods this way you do not need to manually authorize
each method inside your controller it's done automatically through the use of this authorized
resource okay so let's head over to postman to see this in action so we should we are still logged in
as our administrator so we should expect to see the same result if we send our information again
and there we go we still get a 200 response with the same
data that's being returned alright so let's delete our cookie and log in as a normal user
all right successfully logged in and now we should expect to see a 403 error
and there we go this action is unauthorized and we receive the 403 forbidden error
okay so that was the second way to do it is through the use of the authorized resource
method inside of your constructor now the third way to do it would be in the api routes file
by using a middleware on the route so in this section where we defined the sanctum middleware
what we're going to do is we're going to add another middleware
called can with a colon then the first parameter that you need to pass is the policy action
which would be view any and the second one would be the model that you want to
authorize but because we're not having a specific model in this case or an instance of a model
we just need to provide the model class name in that in this case it will be app models
customer
okay so let's head over to postman to check this in action again so again we're logged in
as the user so if we refresh our data we should expect to get the same 403 error and there we go
still get the 403 and this action is unauthorized okay so if we go again delete our cookie
and go to login change our user account to admin login successfully
go back to our route and we should get at 200 response and our customer that's been created
okay so that was the third way of doing it by specifying the can middleware inside your route
now the fourth way of doing it is let's just make a copy of this we'll comment one out
let's comment this one out just for reference and we'll remove this middleware and now
we can chain can method and again your first parameter would be the ability
which would be view any and then your second parameter would it would be your model instance
depending on the route you use or if your route does not include a specific model
instance you would then use the class name again which would be customer
class
and that should be it let's head over to postman to check this out so again we're still logged in
as the administrator and we should expect to see another 200. and there we go we still had get 200
with our data returned so let's just double check we delete our cookie we log in as a normal user
okay successful login go back to the customers and we should expect to see the 403 error
and there we go 403 forbidden this action is unauthorized okay so that was the
four ways we can implement a policy into our application to secure the actions on our model
so to recap the first way you can do it is through the authorized method inside your
controller method itself but like i said that's not a very efficient way to do it because you're
going to have to do it for every single controller method the second way to do it is through the
construct method in your controller and that will automatically map your policy methods
to your controller methods and the third way to do it is in the routes file itself by using the
can middleware and then the fourth way you can do it is using the can method with the same action
thank you so much for watching guys i really appreciate it and
i really hope you found this informative and this will help you to understand a lot of our policies
a little bit better and yeah if you like this video please give it a thumbs up please consider
subscribing it would really help me out and yeah until the next episode guys see you later