Now that we are using our ArticlePolicy, I want to go ahead and just implement all of the other methods, or all of the other abilities that we might need, just because it keeps things consistent, because after all, that is the purpose of a policy, to define all of the access controls for a model in a single place. So I want to start with the delete ability here, which I think is basically going to be the same thing as updating, because a User needs to be an admin or an editor, or it needs to be the author that created the Article to begin with. So I think that's going to be the same thing. And you could make the argument to say that, hey, we should just use the update policy. Yes and no, because at some point in time, we would probably want a separate delete policy. And this way, I mean, what will be lost? I mean, it took more time for me to talk about it than it did to actually implement it. So yeah, so let's just go ahead and let's use that delete policy down here inside of the destroy method. And that is going to be just fine. So there we go.

And that is going to be just fine. So there we go. Our destroy method is protected now. And let's look at what else we have here. restore, determine whether the user forced to leave. I don't want to implement those, because remember that these are just suggestions. We don't have to implement these things. These policies are for our purpose. So we can define whatever we want, and we can implement whatever we want. I don't want to implement those, so we'll just keep on going.

So we can define whatever we want, and we can implement whatever we want. I don't want to implement those, so we'll just keep on going. So that leaves view any, which that'll be useful. We'll get to that here in a moment. view, I don't think we need, because remember that these policies are just for, well, the admin stuff. And there's nothing as far as viewing an article. So we'll get rid of that. But creating, well, absolutely, we want a policy there, which is going to be a little bit different. So a User can create a new article if they are an admin or an author. But let's follow the pattern that we've been using to where we will return responses.

So a User can create a new Article if they are an Admin or an Author. But let's follow the pattern that we've been using to where we will return responses. So if they are an Admin or an Author, we will return the allow response. Otherwise, what do we do here? Do we just deny, or do we deny as not found? I think we should deny as not found. Not because it is following the convention that we have already started with the update policy. But, you know, if we go back to our controller, we need to use this policy in two places. The first is going to be the create view. And that's just a web page that is displaying the create form.

The first is going to be the create view. And that's just a web page that is displaying the create form. In which case, if a User does not have the authority to create something, then, yeah, it shouldn't exist for them. So I think, yes, we will deny as not found. We want to check if the User can create, but notice that we don't have an Article to pass here. And even if we look at this method, all that is being passed is a User. So what we need to do is tell Laravel that we want to check the create ability for the ArticlePolicy. Now notice I am using the model class here, not the policy class. That is important because Laravel is going to resolve the policy based upon the type of model. So we have the ArticlePolicy for the Article model.

That is important because Laravel is going to resolve the policy based upon the type of model. So we have the ArticlePolicy for the Article model. So that is what we use there. And then we could essentially do the same thing inside of the store method. But, you know, we do have this ArticleCreateRequest. And here we could essentially do the same thing that we did inside of the ArticleUpdateRequest. So that we could call inspect and we could check the response here. And we want to check if we can create. And then we will obviously check that response. If we are allowed to do that, then we will return true.

And then we will obviously check that response. If we are allowed to do that, then we will return true. Otherwise, let's return. I don't necessarily like to return a ModelNotFoundException. Because we don't have an actual article here that's not found. But ultimately this is going to give us the same result. We will get a 404. So we'll go with this. And we don't want to return that, do we? We want to throw a new ModelNotFoundException.

And we don't want to return that, do we? We want to throw a new ModelNotFoundException. All right. So that should work there. We have the delete, the store, and the create methods. Now I want to focus on our index. Because whenever we view all of the articles, we are, well, we are returning all of the articles. Which means that an Author can view all of the articles. And we don't want them to. Like the Author here can see the Author editor's stuff.

And we don't want them to. Like the author here can see the author's editor's stuff. And even though he can't access them, I don't want them to be visible at all. So that means we need to filter the articles here. And it would be great if we could include some kind of policy check. What if we did something like this? To where we would have a method called visibleTo. Then we could specify the author that is signed in. And then we would get those articles. And I think that that would work very well.

And then we would get those articles. And I think that that would work very well. So let's go to the Article model. And let's start to implement that. So that would be scopeVisibleTo. And we would need the queryBuilder. So we will get that. Plus the User that we want to check. And we would do something like this. To where we would check if the viewAny ability is allowed for the Article class.

And we would do something like this. To where we would check if the viewAny ability is allowed for the Article class. Because remember, we don't have a specific Article that we need to check for. This is just a generic. Can a User view any Article? So we pass in the class name of our model. In which case, we would simply return the query. Because there's really nothing else to do there. However, if the User does not have that ability, then we want to filter this.

However, if the user does not have that ability, then we want to filter this. To where we would take the query where the author ID is the provided user's ID. So yeah, that ought to be fine. Let's import everything. Except we need to implement our viewAny ability. So we can say that a User can view any Article if they have any role of admin and editor. The author cannot view any. So that's going to work. I think that's going to work just fine.

So that's going to work. I think that's going to work just fine. Let me make sure I have all of the pieces in place. So our controller is going to call visible to the given author. Which is going to check if the user can view any article. Then we simply return the query. Otherwise, we filter it down based upon the user's ID. Our viewAny ability checks for if the user is an admin or an editor. So yeah, I think everything's in place. Let's refresh.

So yeah, I think everything's in place. Let's refresh. And of course, something had to go wrong. Call to protected method gate allow. Yes, because it is not allow, it is allows. One little keystroke can break your code. So now let's refresh. There we can see our article list. And notice now we have just the articles that the author can view. And now that I'm looking at this, I see the create button.

And notice now we have just the articles that the author can view. And now that I'm looking at this, I see the create button. I think we are still showing that based upon the role the User is in. So let's go to the index view. Let's find that. There it is right there. We want to use the can directive here. Can the User create. And we will once again need to pass in our model class name. So that's app/models/Article.

And we will once again need to pass in our model class name. So that's app, models, Article, Blast. Then of course we need to change the closing directive to endcan. That way we aren't relying upon roles specifically for our articles. Now everything is based upon our policy. But of course, let's check in the browser. And yes, we can still see create. But let's log out. Let's sign in as the Editor. Because this should do a couple of things.

Let's sign in as the editor. Because this should do a couple of things. First, we should see all of the articles, which, yes indeed, we do. We would be able to edit or delete them. But notice we can't create. And that is perfect. So whenever you start to implement policies, I'm not going to say that it's a good idea to just go ahead and just implement it. But, you know, it makes sense. If you start to use a policy for a given model,

But, you know, it makes sense. If you start to use a Policy for a given model, it makes sense to go ahead and just implement all of the abilities that you need. Because that way it just keeps all of those access rules inside of a single place. And it makes it very easy to check for those abilities. If you have an ability that needs a specific model instance, then of course we pass that model instance. We've been doing that for a couple of lessons now. But if you need to check for an ability that's just generic, there is no specific model instance,

But if you need to check for an ability that's just generic, there is no specific model instance, well, Laravel still needs to know what policy to check. So we have to pass the model class so that Laravel will resolve the correct policy. It's very easy to use. And when you start using policies, you can use them throughout your application. Your controllers, your views, your models, even inside of your services. Any place that you need to check a user's authorization.