Laravel 5 User Permissions - laravel

Question

I am new to laravel (5.2) and followed this great series https://www.youtube.com/watch?v=Zxmf0n2sC1I&index=34&list=PLwAKR305CRO-Q90J---jXVzbOd4CDRbVx
Can somebody point me into the right direction how to setup the authentication that registered users can only edit / delete their OWN posts.
e.g: Logged in User "A" is not allowed to edit Posts from User B.
Thanks for helping me out.

Answer 1

You can use the ApiGuard. See more: https://github.com/chrisbjr/api-guard

Answer 2

Great. This works perfectly for edit. However something goes wrong with my index view (where all posts are listed). My Code looks like:
public function index($id)
{
//create a var and store all blog posts from DB
$posts = Post::findOrFail($id);
if($posts->id !== Auth::user()->id){
abort(403, 'Access denied');
}
//return a view and pass in the above var
return view('posts.index')->withPosts($posts);
}
The error message in my view is: ErrorException in PostController.php line 23:
Missing argument 1 for App\Http\Controllers\PostController::index()
I am not sure what to do with the index($id), where ca I grab the id from?
Thanks again

Answer 3

If your posts table has an user_id then you can check if that user is the same as the logged user. For example:
routes.php
Route:get('post/{id}/edit', PostsController#edit);
PostsController.php
class PostsController extends Controller{
public function edit($id){
$post = Post::findOrFail($id);
if($post->user_id !== Auth::user()->id){
abort(403);
}
return view('posts.edit', $post);
}
}
EDIT: Updated including an index method as requested in the comments.
routes.php
Route:get('posts', PostsController#index);
Route:get('post/{id}/edit', PostsController#edit);
PostsController.php
class PostsController extends Controller{
public function index(){
$posts = Post::all();
return view('posts.index', $posts);
}
public function edit($id){
$post = Post::findOrFail($id);
if($post->user_id !== Auth::user()->id){
abort(403);
}
return view('posts.edit', $post);
}
}

Answer 4

I your Post has an user_id then you can check if that user is the same as the loggin user. The code will be
PostController.php
class PostController extends Controller
{
public function getUpdatePost($post_id) {
$post = Post::find($post_id);
if($post->user_id !== Auth::user()->id){
abort(403);
}
return view('posts.edit',['post' => $post]);
}
}
and your routes file will be
Route::get('/post/{post_id}/edit', [
'uses' => 'PostController#getUpdatePost',
'as' => 'post.edit'
]);