mcpField
L
laravel:policies-and-authorization

laravel:policies-and-authorization

github.com/jpcaparasSecurity157154 installsUpdated 17w ago
Repository

About laravel:policies-and-authorization

A Laravel skill guide for developers structuring model-level and cross-cutting authorization. It covers policies, Gates, middleware, controller attributes, and tests for denied access.

Key features

  1. 01Use policies for model actions
  2. 02Use Gates for cross-cutting checks
  3. 03Protect routes with can middleware
  4. 04Authorize actions with attributes
  5. 05Test forbidden responses

Use cases

  1. 01Set authorization for resource controllers
  2. 02Restrict specific route actions
  3. 03Add authorization attributes to Laravel 13+ controllers

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/jpcaparas/superpowers-laravel --skill laravel:policies-and-authorization

After installing, type/laravel:policies-and-authorizationin Claude Code to confirm it loaded.

Details

From the project README

Policies and Authorization

Use Policies for per-model actions; use Gates for cross-cutting checks.

Commands

# Generate a policy
sail artisan make:policy PostPolicy --model=Post   # or: php artisan make:policy PostPolicy --model=Post

# Apply in routes (resource controllers)
Route::resource('posts', PostController::class);
// In controller constructor
$this->authorizeResource(Post::class, 'post');

# One-off checks
$this->authorize('update', $post);           // in controller
Gate::allows('manage-billing', $user);       // ad-hoc gate

Patterns

  • Use resource policy methods: viewAny, view, create, update, delete, restore, forceDelete
  • Prefer policy methods over inline checks; keeps controllers clean
  • Register policies in AuthServiceProvider
  • Use can middleware for quick route protection: ->middleware('can:update,post')
  • In tests, assert actingAs($user)->get(...)->assertForbidden() for denied cases

Laravel 13+: Authorization Attributes

use Illuminate\Routing\Attributes\Controllers\Authorize;
use Illuminate\Routing\Attributes\Controllers\Middleware;

#[Middleware('auth')]
class CommentController
{
    #[Authorize('create', [Comment::class, 'post'])]
    public function store(Post $post) { /* ... */ }

    #[Authorize('delete', 'comment')]
    public function destroy(Comment $comment) { /* ... */ }
}
  • Attributes keep the policy check visible at the action; equivalent to $this->authorize(...) — pick one style per codebase (see laravel:php-attributes)

Comments

Markdown supported