pass collection of records to policy - laravel

Question

this is my tables structure :
i want to get all Request State Records where Request_status.Department_id equals with User.Department_id . and user only can see own request_state records i defined a policy to handle this job but this policy only can handle 1 request_state record . this policy can't handle array of request_state Model ! how can i use get() instead of first()
Policy :
public function view(User $user, RequestState $requestState)
{
return$user->department_id===$requestState->department_id&&$user->hasRole('department');
}
Controller :
public function show_request()
{
$RequestState=RequestState::where('department_id',auth()->user()->department_id)->first();
nullable($RequestState)->getOrSend(function (){
return Responder::requestDoesNotFound();
});
if(auth()->user()->can('view',$RequestState)){
return 'ok';
}
}

Answer 1

The policy is fine as-is. The changes should be in the controller.
Your controller method is called show_request(). The name implies it is showing a single request. But the controller logic shows it is showing all the requests for the user. You need to either validate each request individually, or assume that all the requests have the same department_id, since that is what your query pulls. Assuming you want to check all the RequestStates in the collection, you can them to a single TRUE/FALSE;
public function show_request()
{
$requestStates = RequestState::where('department_id', auth()->user()->department_id)->fget();
nullable($RequestState)->getOrSend(function (){
return Responder::requestDoesNotFound();
});
return $requestStates->reduce(function ($accumulator, $requestState) {
return $accumulator and auth()->user()->can('view', $requestState);
}, TRUE);
}

Answer 2

As I can see, you want lo allow the users to see the list of request they have access. You can create a new method in your controller method to validate all the requests.
It should be something like this:
public function show_requests()
{
$requestStates = RequestState::where('department_id',auth()->user()->department_id)->get();
if(sizeof($requestStates) > 0 ){
for($i = 0; $i < size($requestStates); $i++ ) {
if (!(auth()->user()->can('view', $requestStates[$i]))) {
//Unset the record the user can't see
unset($requestStates[$i]);
}
}
//Return all records the user can see
return $requestStates;
}
else {
return Responder::requestDoesNotFound();
}
}