How to authorize depending on the request? - laravel

Question

I am currently adding permissions/roles/authorization to a Laravel application.
In the application's database are users, companies and products. Companies have many users and a product belongs to a company.
Now I want to authorize company users, to create a product for their company.
In my ProductController.php I have something like this:
public function create(Request $request)
{
$company = Company::findOrFail($request->get('company_id'));
return view('product.create', compact('company');
}
One option would be to use Gate::authorize() after getting the company and pass the $company to the authorize-method.
Question: But how can I solve this, if I don't want to use Gate::authorize(). So in case I want to use policies?
Another Question: I see several ways to authorize: Gate::authorize(), policies, StoreProduct's authorize(), ...
Which one should I use? Should I always implement StoreProduct's authorize() event if I use policies for example?

Answer 1

You can have the create ability on the ProductPolicy take a Company instance as an argument and you can then check that the User belongs to that Company in the policy:
use App\Company;
use App\User;
class ProductPolicy
{
public function create(User $user, Company $company)
{
return $user->company_id === $company->id;
}
...
}
You can call authorize in your Controller to use the ProductPolicy to authorize the User. These authorization methods can take an array as the second argument which allows you to send additional data [the first argument will be the model for the policy, in this case it doesn't take an instance, but we still need it to know which model's policy we want so it takes the class name]. This will check the create ability on the policy for Product and pass it an additional value of $company:
use App\Company;
use App\Product;
...
public function create(Request $request)
{
$company = Company::findOrFail($request->input('company_id'));
$this->authorize('create', [Product::class, $company]);
return view('product.create', compact('company');
}
Remember to register the Policy for the Product model.
You have options for how you want to do authorization, that is why there are different methods to achieve it. Depends what you prefer or what fits your current need.