Okay, guys, I'd like to go back to the topic that's called authorization.
I've been announcing this for a while now, so we've covered authentication previously so that you get
the difference that authentication is verifying if you are who you say you are.
On the other hand, authorization is after you are initially verified.
Authorization is checking if you have permissions to do a certain operation.
So in our case this might be are you allowed to go to the admin panel.
So now I can do that.
But we should verify that.
And in the first place should I even see this link.
If I am signed in I should not see this link unless I am an administrator.
Now if I sign out, I don't see this link, but Still, we need more fine grained control over who can
do what in the system.
And well, this is where we will introduce the set authorization, which is role based.
The shortcut for that is Rbac.
It is role based access control.
Let me create an authorization class inside the services and add all the typical stuff that we need
which is app services namespace.
And the class would be authorization.
Now we're going to handle all the all the authorization stuff inside this simple class.
So I'm going to add a function, not a function a method called check.
And the way I'd like to organize that is we're going to be checking if you can do a specific action
that is a string, and can you perform this action on a specific resource that's nullable.
And it just returns Boolean value.
So you can do that or you can't.
Let me reformat that real quick.
Now this method can get access to the user through the auth service, which we don't have the which
we don't have to import because it is on the same namespace as the authorization class.
So we are getting the user first now.
Well, we can assume that if we are checking for some permissions then if you are not authenticated
you just don't have the permissions.
This is I'm sure of.
And if we have a public page like this home page or posts page that everyone should be able to access,
then there is no point in verifying the permissions in the first place because, well, anyone can access
those sites.
So that's our first assumption.
You need to be authenticated.
Now obviously you can customize that if you have different requirements.
Next up, we might assume that if you are an admin you can do anything.
Essentially the role is a string.
So you can define any roles that you wish.
So inside the user we've got this role column.
So if you are an admin.
Well we can grant you everything.
Or maybe let's go with super admin.
We immediately go with true.
And now we can do more fine grained control depending on the action we're gonna have some specific logic
either granting or not granting the permissions.
So in frameworks like Laravel, you typically create additional classes that are called policies or
you create gates.
And this is similar to how gates are implemented in Laravel.
Let's go with the default option here.
So the default is you don't have access.
Um I think I need a semicolon here.
So by default you don't have an access.
Then we might have an action that is called comment.
So we just come up with those action names.
I just made it up.
And it's important to know what actions do we have because then we're going to be verifying them.
So if you'd like to comment then we return.
True.
Why?
Because if you already are authenticated, this means you can comment on posts.
Next up, um, can you edit a post?
Or also, can you delete a post so we can have multiple.
Now in those cases, um, first we need to check if the resource is an instance of post.
This means that a Post model needs to be passed in here, because if that's the case, then we need
additional condition, which is we're going to verify if the current user ID is the same as the resource
user ID, which we already know is a post.
So it will have this column.
Basically, this is making sure you are the owner of that post.
You created it.
Only then you can edit or delete it or alternatively if maybe you are an admin or super admin.
So user role or maybe let's do it differently.
We're going to do Inarray.
And that user role needs to be either admin or super admin.
If you are one of those well you can do anything.
And also let's make sure that.
We put that inside parentheses.
And this here needs to be an array like this.
Also I think I'm missing the post model import.
So that's a longer rule.
But you know we are really free to customize everything as we like.
Next up can you create a post.
Well um.
I think that we should just return.
True.
Would you agree?
Yeah, maybe.
So let's put that to this one so everyone can create posts as why not.
And then accessing the dashboard.
Maybe let me put it this way.
So if you'd like to access the dashboard you need to be an admin or super admin.
I'm missing the function call.
This is in array.
Okay so those are our rules.
We can maybe extract some of those into separate methods.
Maybe checking if someone is an admin or super super admin should be extracted to at least a arrow function
someplace.
Place.
Anyway, that's not important right now.
What's important is that we have this class.
Now.
We can check for the permissions of the people and then maybe deny the access if they don't have those.
Okay, guys.
So that was the first method.
It just told us if someone has or maybe doesn't have the permissions.
Now we need another one that can be called verify.
And this one is void.
And what this would do is it will not only check for the permissions.
That's why we need the same arguments.
This method will also redirect to a specific error page if we lack the permissions.
So this would be if static check where we pass the action and the resource.
So if that's the case we go.
Or maybe I'm gonna go with router.
And this should be not unauthorized, but forbidden.
Now let's go ahead and create this method inside the router.
So we've got unauthorized
and let's do forbidden.
This would be 403 code.
Let me jump to HTTP codes 403.
Okay.
So this should be thrown when you just don't have sufficient permissions to access the resource, which
is perfectly our case.
Now let me jump to 401 and create a 403 error quickly by copy pasting this one.
And let's say 403 forbidden.
And it is.
You don't.
You don't have permissions.
To access this resource.
Okay.
I think this looks sensible.
Now let's jump back to the authorization class.
And essentially we are actually done.
So we can use this check method for example in views and then decide if we want to display a link or
not like this one the admin link.
But this one would be actually used to limit the access.
If someone, let's say, wants to go to the dashboard and they don't have the necessary permissions.
And let's take a short break now, and we're going to be implementing all those authorization checks
in the next video.