W
W
WebDev2020-09-07 13:31:47
Laravel
WebDev, 2020-09-07 13:31:47

Where is the correct way to check the ownership of an entity?

Models:

class Page extends Model
{
  public function articles()
  {
    return $this->hasMany(Article::class);
  }
}

class Article extends Model
{
  public function page()
  {
    return $this->belongsTo(Page::class);
  }
}


Routes:
Route::put('pages/{page}/articles/{article}', '[email protected]');
Route::delete('pages/{page}/articles/{article}', '[email protected]');


Controller:
class ArticleController extends Controller
{
  public function store(Page $page, Article $article) 
  {
    if (Auth::user->id !== $page->user_id || $article->page_id !== $page->id) {
      abort(403);
    }

    $article->update(request()->all());
  }

  public function delete(Page $page, Article $article) 
  {
    if (Auth::user->id !== $page->user_id || $article->page_id !== $page->id) {
      abort(403);
    }

    $article->delete();
  }
}


Would it be correct to issue a check Auth::user->id !== $page->user_id || $article->page_id !== $page->id in middleware? There are many entities, it will turn out quite a lot of middleware. Is it correct?

Answer the question

In order to leave comments, you need to log in

Didn't find what you were looking for?

Ask your question

Ask a Question

731 491 924 answers to any question