And do make sure that you import that at the top. And I can get rid of this one. Next, in your TaskList.vue component, here, we're going to open a private channel. So we say Echo.private. OK, but now, if you switch back, we've compiled everything down. Let's expand this. If I give it a refresh, you're going to see this new authorization error. So we give it a run, and yep, 403 forbidden. So what's the issue here? Well think about it.

So what's the issue here? Well think about it. We've now said we're going to broadcast to a private channel. And then, in our view component, we tried to turn the dial, and we said we wanted to listen to that private channel. But are we authorized? Is there any place that we've declared who is authorized to access that channel? And the answer is no. So that's our next step. If we visit our channels file, yeah, you've probably seen this a number of times before.

So that's our next step. If we visit our channels file, yeah, you've probably seen this a number of times before. And if you didn't quite understand what it referred to, well now, you're going to get a crash course. Here is where you declare your authorization for a channel. So for example, we have, let's go back, what is the channel we submitted on, or we broadcast on? Tasks.theprojectid. All right, let's listen for that. But now, let's take it in steps.

All right, let's listen for that. But now, let's take it in steps. So I'm just going to return true. Let's just imagine, no matter what, for this particular channel, anyone has access. You might try it, but if you switch back, and we'll give this a refresh, it still fails. And that's because you are not authenticated at this point. So Laravel is expecting a User, a signed in User, but you're not, you're a guest. So sorry, a guest does not have permission to listen on a private channel. Let's fix that. Behind the scenes, I've run php artisan make:auth, and that gives us some very quick scaffolding.

Let's fix that. Behind the scenes, I've run php artisan make:auth, and that gives us some very quick scaffolding abilities. So here, we'll do myself, I'll paste in my email, and provide a password. Okay, we are now signed in. So if I switch back and open up the console, we should no longer see that. Okay, so at this point, everything should work. Add a task here, and that should be broadcast to anyone else who has access to this list. But yeah, of course, you don't want to hard code true. So for your project, you need to decide, given this data, how do we determine if the current

But yeah, of course, you don't want to hard code true. So for your project, you need to decide, given this data, how do we determine if the current User is authorized to view the Project? So let's update this. Let's see, this is going to be the projectId. And yeah, you know what, it just depends. So we don't have anything set up right now. We could just say, well, the User with this email address has access to these projects. The User with that email address has access to those projects. And then we'll just check.

at this point this kind of leans more into general php territory. So you can be done with this episode if you want and move on. Or yeah, if you'd like, come along and we'll create a pivot table maybe for this. What if we add a new table here? So make a migration, and to be honest, there's many, many ways to do this. If you want to keep it very simple, you can add a basic text column where you add some JSON for all of the user IDs who have access. You know, it's just a very simple way to do it. Or like we'll do here, you could even set up a pivot table. So why don't we say project_participants will be our pivot table.

Or like we'll do here, you could even set up a pivot table. So why don't we say project_participants will be our pivot table. And we'll call it create_project_participants_table. So let's switch over there. Here, what would we need? Well, I need an integer for the user_id, so this User has access to that project. Okay, so let's go ahead and migrate our database. And next, it sounds like from our project, we need a way to reference all of the participants. So we could say something like this. Now, how would I say from the Project, give me all of the Users who are participants in

So we could say something like this. Now, how would I say from the project, give me all of the Users who are participants in this project? Well, that's a basic belongsToMany relationship. So I could say return belongsToMany User, and let's see how this turns out. So we'll expand this, php artisan tinker, I think we have a Project. So we'll say app\Project::first(). And let's grab the participants. It fails, no such table project_users. So the issue here is with Laravel, it's going to assume a basic convention for the pivot

It fails, no such table project_users. So the issue here is with Laravel, it's going to assume a basic convention for the pivot table name. If you don't want to do that, and we didn't in this particular case, then you need to override that. So here, we'll update this to project_participants. Okay, let's exit out and do it one more time. Grab the project, give me the participants, and we get an empty array. Let's add myself. So app\User first, I think that's me.

Let's add myself. So app\User first, I think that's me. Yep. And we'll say projectParticipants, save me. And that should do it. So now, if we refresh and grab the participants, now I can see for this project, I have access to it. But that JohnMiller guy did not have access. Let's do him. So let's say projectTwo, so that will be the most recent one we created, right?

Let's do him. So let's say projectTwo, so that will be the most recent one we created, right? And then John would be the most recent User we had. And we just want to say John should be a participant in this projectTwo. projectTwo, participants, and we could do save, but we could also do attach John. Okay, so now let's get a fresh copy, view the participants, and there we go. John is in that project, and I am in the first project. So now think about it. If we have a project, and we can access the participants, then all we have to do now is to say, is the currently authenticated User included in that collection of participants?

If we have a Project, and we can access the participants, then all we have to do now is to say, is the currently authenticated user included in that collection of participants? Easy. So let's head back to our channels authorization file, and yeah, we can get rid of all of this now. We have our projectId, but just like your routes file, you can use implicit model binding. And we'll say return if the project participants contains the given user. All right, so let's give it a shot. Looks like we're signed in as John Miller, we'll go to the console. We have a 500 error, we must have a little issue here.

Looks like we're signed in as John Miller, we'll go to the console. We have a 500 error, we must have a little issue here. Argument two must be an instance of Project, a string given. Our model binding didn't work, Project, whoops, sorry. These two names need to match up. All right, let's give it a refresh. And now that worked. John Miller does have access to this channel. However, what if he didn't? Let's come back and we'll load up tinker again.

However, what if he didn't? Let's come back and we'll load up tinker again. We'll find his project. And we'll say project to participants, detach, and John's user ID is 2, right? So let's just say App\User::find(2). Okay, so now there should be no participants here, which means if John signs in and reloads, he's not authorized to listen on that channel. And don't forget, there's two separate things here. So you have the one layer of authorization that of course says, Miller can't even see this project if he doesn't have access to it.