Laravel's authorization system yana sarrafa abin da authenticated user ya sani ya yi (daban daga authentication — who suke). Gates simple closures ne don permissions; Policies classes ne da suka organize authorization logic game da musamman model (e.g. who can update a Post).
::(, fn() => ->());
(::()) { ... }
::();
Gates masu kyau ne don simple, standalone permissions da ba su dangane da musamman model ba.
<?php
// php artisan make:policy PostPolicy --model=Post
class PostPolicy {
public function update(User $user, Post $post): bool {
return $user->id === $post->user_id; // only the author can update
}
public function delete(User $user, Post $post): bool {
return $user->id === $post->user_id || $user->isAdmin();
}
}
A Policy class yana tara authorization rules na model — kowane method yana amsa "can this user perform this action on this model?" Wannan yana kiyaye authorization logic organized per resource.
// in a controller
public function update(Request $request, Post $post) {
$this->authorize('update', $post); // checks PostPolicy::update — throws 403 if denied
// ... proceed (we know the user is authorized)
}
// the user model
if ($request->user()->can('update', $post)) { ... }
{{-- in Blade — show UI only if authorized --}}
@can('update', $post)
<a href="{{ route('posts.edit', $post) }}">Edit</a>
@endcan
The authorize()/can() methods (da @can a cikin Blade) suna duba policy automatically — throwing a 403 ko hiding UI lokacin da user ba a yarje ba.
Authorization shine mahimmanci da security-critical — sarrafa abin da authenticated users suka sani ya yi (ba kawai ko sun shiga ba) shine tushen security na application, da Laravel's policies da gates suna ba da sanin tsarki, da organized hanyar sarrafa shi.
Sanin bambanci tsakanin authentication (who you are — login) da authorization (what you can do — permissions) shine tushen kakaassu, da authorization failures suna haifar da babbar haɗari (users suna shiga ko sauya data da ba su kamata ba — broken access control shine babbar haɗarin security).
Laravel's system yana ba da kayan kaidai guda biyu: Gates don simple, standalone permissions (closure-based checks), da Policies — the common, recommended approach — wanda ke organize authorization rules na model a dedicated class (e.g. who can update or delete a Post), kiyaye authorization logic structured da maintainable per resource.
Sanin yadda za a bayyana policies/gates da enforcement (tare $this->authorize(), $user->can(), @can a cikin Blade — checking permissions a controllers, throwing 403s, da conditionally showing UI) shine mahimmanci don gina secure applications inda users za su iya aiwatar da wayoyi da aka yarje.
Saida kusan duk real application yana buƙaci fine-grained access control (tabbatarwa cewa users za su iya canja su ne nasu jerin albarkatun, kirgaya admin actions, jne.), da saida rashin lura da authorization yana kirkira haɗari masu bakin ciki, sanin Laravel's policies da gates — the proper, organized hanya don implement authorization — shine mahimmanci security-relevant senior knowledge da wajibe ne don gina applications da suka karfe enforce who can do what, repeated da critical requirement a cikin real systems.