app/Http/Middleware/AuthorizeIfOwner.php
/**
     * Handle an incoming request.
     * $resourceName is the name of the resource passed to the middleware in the route,
     * eg middleware=>owner:goods
     *
     * $resourceId gets the parameter passed to this route
     * by getting the singular form of $resourceName. eg goods = good
     *
     * hence this method is assuming your routes are like example.com/resources/{resource}
     *
     * @param  \Illuminate\Http\Request  $request
     * @param  \Closure  $next
     * @param  string    $resourceName
     * @return mixed
     */
Handle an incoming request.
$resourceName is the name of the resource passed to the middleware in the route,
eg middleware=>owner:goods

$resourceId gets the parameter passed to this route
by getting the singular form of $resourceName. eg goods = good

hence this method is assuming your routes are like example.com/resources/{resource}

@param  \Illuminate\Http\Request  $request
@param  \Closure  $next
@param  string    $resourceName
@return mixed
Handle an incoming request . $resourceName is the name of the resource passed to the middleware in the route eg middleware = > owner : goods $resourceId gets the parameter passed to this route by getting the singular form of $resourceName . eg goods = good hence this method is assuming your routes are like example . com / resources / { resource } @param \ Illuminate \ Http \ Request $request @param \ Closure $next @param string $resourceName @return mixed
public function handle($request, Closure $next, $resourceName)
    {
        $resourceName = strtolower($resourceName);
        $resourceNameSingle = str_singular($resourceName);
        $method = $request->route()->getAction()['as'];
        $method = $this->routeMethodByActionAs($method); 
        $ability = $this->getAbility($method, $resourceName);
        $resourceId = $request->route()->parameter($resourceNameSingle);
        $user = $request->user();
        try {
            if ($user->hasRole('vendor') || (!$user->hasRole('super_admin') && $user->hasAnyPermission([$ability]))) {
                if (!$resource = \DB::table($resourceName)->find($resourceId)) {
                    throw new NotFoundHttpException($resourceNameSingle . ' record not found');
                }
                $owner_id = $resource->created_by;
                if (($user->id != $owner_id) && !$user->hasAnyPermission([$ability])) {
                    throw new NotFoundHttpException($resourceNameSingle . ' record not found in your collection.');
                }     
            }
        } catch(Exception $e) {
            throw new NotFoundHttpException($resourceNameSingle . ' not found');                
        }
        return $next($request);
    }
public function handle ( $ request , Closure $ next , $ resourceName ) { $ resourceName = strtolower ( $ resourceName ) ; $ resourceNameSingle = str_singular ( $ resourceName ) ; $ method = $ request -> route ( ) -> getAction ( ) [ 'as' ] ; $ method = $ this -> routeMethodByActionAs ( $ method ) ; $ ability = $ this -> getAbility ( $ method , $ resourceName ) ; $ resourceId = $ request -> route ( ) -> parameter ( $ resourceNameSingle ) ; $ user = $ request -> user ( ) ; try { if ( $ user -> hasRole ( 'vendor' ) || ( ! $ user -> hasRole ( 'super_admin' ) && $ user -> hasAnyPermission ( [ $ ability ] ) ) ) { if ( ! $ resource = \ DB :: table ( $ resourceName ) -> find ( $ resourceId ) ) { throw new NotFoundHttpException ( $ resourceNameSingle . ' record not found' ) ; } $ owner_id = $ resource -> created_by ; if ( ( $ user -> id != $ owner_id ) && ! $ user -> hasAnyPermission ( [ $ ability ] ) ) { throw new NotFoundHttpException ( $ resourceNameSingle . ' record not found in your collection.' ) ; } } } catch ( Exception $ e ) { throw new NotFoundHttpException ( $ resourceNameSingle . ' not found' ) ; } return $ next ( $ request ) ; }
Handle an incoming request.
Handle an incoming request .
//$method = strtolower($request->getMethod()); //try to get the row from the table in db //abort(403, 'Unauthorized action.');