First up on the agenda is automatic policy discovery. So take a look. I have a relationship between a Comment and a User. Pretty simple stuff. But now I want to authorize whether or not you can update a Comment. Okay, we'll use a policy for that. So I'm going to make a policy called CommentPolicy, and the model in question is Comment. Okay, so as you may know, this will create a policies directory and give us our policy here. Now as always, this php artisan make:policy CommentPolicy command will give us a bunch of boilerplate for various methods you

here. Now as always, this command will give us a bunch of boilerplate for various methods you might want to implement. In our case, though, I'm going to stick with a simple update method so I can get rid of everything else. Now we might say that the authenticated User can update a Comment if the userId equals the comment's user_id column or field. Or another way is to use the is method. The return user is the comment and then get the user relationship. That would be fine as well.

The return User is the comments relationship and then get the user relationship. That would be fine as well. Okay. But anyways, in Laravel 5.7 and below, it wasn't enough just to create the policy. You also had to register it in your AuthServiceProvider. So you would each time have to register that the app User model has the corresponding policy. Not a big deal, but when you're getting in the flow of things, it does get a little tedious. So I'm going to backtrack and show you the new way in Laravel 5.8. And the new way is, it just works as long as you follow the proper convention as we've done here.

And the new way is, it just works as long as you follow the proper convention as we've done here. All right. So let's give this a shot. From my routes file, we'll say, listen for a PATCH request to a particular Comment. And that will hit our CommentsController and an update method. Okay. This controller doesn't exist yet. So very quickly, I will make it. So in my CommentsController, for our update method, we need to first authorize.

So very quickly, I will make it. So in my CommentsController, for our update method, we need to first authorize. So before we update the comment, we have to authorize, well, do you have permission to do it? We can't allow anyone to update a comment. It has to be the person with permission. Okay. So we're going to say this, authorize an update of the comment. And whoops, real quick, I need to make sure I import that. Okay.

And whoops, real quick, I need to make sure I import that. Okay. So listen for this request, hit the update method on the CommentsController. The CommentsController will authorize the request, which will hit this method. So I'll say, die, hello there, just to prove that it's working. All right. Let's give it a shot. So I'm going to use a tool called HTTParty to quickly make a patch request to that endpoint. Now I already have a comment with an ID of 1, so we'll give that a shot. But I do get a 419.

Now I already have a Comment with an ID of one, so we'll give that a shot. But I do get a 419. And in this case, it's because I'm not providing the CSRF token. Okay. We don't need it in this case. So if you don't mind, real quick, I'm just going to turn it off temporarily and give it another run. All right. So we do get a 403 forbidden, and that's what we would expect. So how come?

So we do get a 403 forbidden, and that's what we would expect. So how come? Well, think about it. When we hit this comment policy, we're not signed in, but it's expecting an authenticated User. So you have two choices. One, of course, sign in a User. Or two, if you want to allow guest users to hit this method, then you can provide the optional type hint. Okay.

optional type hint. Okay. So now anyone can hit this method, even guest users. So if we run it again, now we'll get hello there, which is what we expect. But yeah, in real life, you might want to lock this behind authorization. The key addition to understand here is the wiring, so to speak, between a Comment and a CommentPolicy now happens automatically if you follow the basic convention. So where your policy is, it's going to run up one directory and look for your model. So let's finish up by handling the edge case. What if you're not calling it CommentPolicy?

So let's finish up by handling the edge case. What if you're not calling it comment policy? Maybe your team has another convention like authorizer or something like that. Okay. Let's rename this. And now it's not going to work. So if I give this another run, yeah, we're going to get a 403 Forbidden no matter what because it can't find the policy, so it denies the authorization. So for example, right here, even if we were to make this optional and return true, if I give it another run, it's still going to fail because it can't track down the policy.

So for example, right here, even if we were to make this optional and return true, if I give it another run, it's still going to fail because it can't track down the policy. Okay. We can fix this by going to your AuthServiceProvider in the providers directory, and we'll tell Laravel how to guess the policy name. Get the Gate facade, and we'll guess the policy names using this logic here. Okay. So it's going to call this anonymous function. modelClass will be the class path to the model in question. So in our case, it would be something like that.

Model class will be the class path to the model in question. So in our case, it would be something like that. Okay. So if we want to convert Comment to CommentAuthorizer, we might say something like classBaseName. This basically gives us the short name for a class. So if our class path is app/Comment, classBaseName will give us that. Okay. Let's save that. And then we want to tack on Authorizer.

Let's save that. And then we want to tack on authorizer. So let's just return the class path app\Policies\Name, but do be careful because we have the backslash here. It thinks we're escaping the brace, so let's double it just to be safe. All right. So let's give it another run and we don't see anything here. Let's quickly die and say it works. Run it again, and there we go. So this time we're using custom logic to determine how to track down the policy, but yeah, that's

Run it again, and there we go. So this time we're using custom logic to determine how to track down the policy, but yeah, that's kind of an edge case. In the huge majority of scenarios, you should stick with the defaults and everything will just work out of the box. A nice new addition to Laravel 5.8.