title: Implementation of the authorization system, in which each individual specific permission gives access to a specific column in Laravel
body: <p>I am creating API, in which I let users read some data from the database, but I want to deny access to some columns in my table.</p>
  
  <p>For example, there is permission <code>users.show.name_of_example_column</code>, which should access to the column <code>name_of_example_column</code> in <code>users</code> table.</p>
  
  <p>Spatie/Laravel-Permission is responsible for associating users with permissions and roles in my API. </p>
  
  <p>Users in my system have 2 permissions:</p>
  
  <ul>
  <li><p><code>users.show.id</code></p></li>
  <li><p><code>users.show.name</code></p></li>
  </ul>
  
  <p>Administrators have all permissions.</p>
  
  <p>I already made an example to show you what result I want (depending on which role I have).</p>
  
  <pre class="lang-php prettyprint-override"><code>public function index($perPage = 30)
  {
     $user = Auth::User();
     $fields = [];
     if($user-&gt;hasPermissionTo('users.show.id')) {
         $fields[] = 'id';
     }
     if($user-&gt;hasPermissionTo('users.show.name')) {
         $fields[] = 'name';
     }
     if($user-&gt;hasPermissionTo('users.show.email')) {
         $fields[] = 'email';
     }
     return User::Select($fields)-&gt;paginate($perPage);
  }
  </code></pre>
  
  <p>Of course, this example is bad practice. Should I do it in User model via accessors or maybe somewhere else? What is the correct way? Any ideas?</p>
  
  <p><strong>UPDATE</strong></p>
  
  <p>I tried to check permission in accessors</p>
  
  <p>Here is example</p>
  
  <pre class="lang-php prettyprint-override"><code>public function getEmailAttribute($value)
  {
     if(Auth::User()-&gt;hasPermissionTo('users.show.email')) {
       return $value;
     }
     return false;
  }
  
  </code></pre>
  
  <p>but when it returns <code>false</code> it doesn't unset (remove) the 'email' attribute from the collection. It just replaces original value with 'false'.</p>