title: Laravel - How to ensure that logged in user can only access his company data
body: <p>I am developing a client portal application using Angular-7 as frontend and Laravel-5.8. I am using Larave Spatie for User Management. I have these three tables:</p>
  
  <pre><code>CREATE TABLE `company` (
    `id` bigint(20) UNSIGNED NOT NULL AUTO_INCREMENT PRIMARY KEY,
    `company_id` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL,
    `company_name` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL
  ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
  
  CREATE TABLE `trips` (
    `id` bigint(20) UNSIGNED NOT NULL AUTO_INCREMENT PRIMARY KEY,
    `dispatch_datetime` datetime DEFAULT NULL,
    `loading_date` date DEFAULT NULL,
    `loaded_from` varchar(255) COLLATE utf8mb4_unicode_ci DEFAULT NULL,
    `destination` varchar(255) COLLATE utf8mb4_unicode_ci DEFAULT NULL,
    `company_id` varchar(255) COLLATE utf8mb4_unicode_ci DEFAULT NULL,
  ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
  
  CREATE TABLE `users` (
    `id` bigint(20) UNSIGNED NOT NULL AUTO_INCREMENT PRIMARY KEY,
    `name` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL,
    `email` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL,
    `password` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL,
    `company_id` varchar(255) COLLATE utf8mb4_unicode_ci DEFAULT NULL,
  ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
  </code></pre>
  
  <p>From the tables above, I have three classes: User, Company and Trip. </p>
  
  <ol>
  <li><p>Each user belong to a company, but not more that one. </p></li>
  <li><p>Each company embark on several trips.</p></li>
  <li><p>company_id in company is also a Primary Key.</p></li>
  </ol>
  
  <p>From the ApiController, I have used Laravel Spatie to enable users to only have access to data they are given permission. This is working perfectly:</p>
  
  <p>ApiController.php</p>
  
  <pre><code>&lt;?php
  
  namespace App\Http\Controllers;
  
  use Illuminate\Http\Request;
  use App\Trip;
  use App\User;
  use App\Company;
  
  use Illuminate\Support\Facades\Auth;
  
  class TripController extends Controller
  {
      public function index(Request $request){
          if(!Auth::user()-&gt;hasPermissionTo('View Trip')){
              return response()-&gt;json([ "message" =&gt; 'User do not have permission'], 401);
          }
          if(($request-&gt;get('sort')!='null' &amp;&amp; $request-&gt;get('sort')!='') &amp;&amp; $request-&gt;get('search')){
              $trip = Trip::where("trip_number", "LIKE", "%{$request-&gt;get('search')}%")-&gt;orderby($request-&gt;get('sort'), $request-&gt;get('order'))-&gt;paginate(10);
          } else if(($request-&gt;get('sort')!='null' &amp;&amp; $request-&gt;get('sort')!='')){
              $trip = Trip::orderby($request-&gt;get('sort'), $request-&gt;get('order'))-&gt;paginate(10);
          }
          else if($request-&gt;get('search'))
              $trip = Trip::where("trip_number", "LIKE", "%{$request-&gt;get('search')}%")-&gt;paginate(10);
          else
              $trip = Trip::paginate(10);
          return response()-&gt;json($trip, 200);
      }
  }
  
  </code></pre>
  
  <p>Now, I want to achieve the following from the code above:</p>
  
  <ol>
  <li><p>The Logged-in user should be able to view only the trips that his company embark on.</p></li>
  <li><p>If the Logged-In user belongs to the Company that has company_id as <strong>MBB</strong>, he should be able to view all the trips for all the companies in the database, except he doesn't have permission to view trips.</p></li>
  </ol>
  
  <p>How can I modify my code to achieve this?</p>