How to hide api fields based on user permission?

Question

Laravel

Suggest best practices.
There is a rest api by which you can get products with fields ['name' =>'test', 'price'=>22], depending on the user's permissions, you need to hide the fields, let's say the user who requests the list of products does not have the permission 'products.price' .view' and then you need to hide the 'price' field in the response.

I know that you can hide fields in Resource and check each field for user permissions, but I can’t figure out how to store the mapping of fields with permissions.
Please tell me how best to do it, maybe I’m looking in the wrong direction at all and can I make it easier and more versatile?

Answer 1

Use API-Resources
You will have a request in the resource - from which you can get the desired user.
Then, in the toArray() method, through the when function, set the required fields, for example:

'secret' => $this->when($request->user()->isAdmin(), function () {
    return 'secret-value';
}),

To check permissions, you can use $request->user()->can(...)