Okay, guys.
So last time we've created this authorization class with two methods the verify and check.
The check is basically making sure we can do something.
It's based on an action and the resource it gets the current user and the verify.
Well this is more let's call it catastrophic if anything goes wrong.
So if you can't do something well it will just direct you to a forbidden page.
So this should be used to block access, while the check should be used to check if you can see something
to display a link, etc..
Speaking about links, we should add a helper to the view that can decide if I should see maybe this
admin link in the first place.
So let's go our typical route of checking if The function exists.
If it doesn't, we're going to use.
This.
Well we're going to create this function which returns boolean.
And let me jump back to copy paste the arguments.
So we get the resource the action and the resource.
And this is simply calling the authorization.
Check passing both the action and the resource.
A quick reminder why we are doing that.
We are doing this to add a global function that can be used inside a view where we would not like to
have a separate section that would add the use statements for classes.
Okay, let's use it then.
Let me go to the main layout where we have this admin link, so we should display both when someone
is authenticated, but this should only be displayed if the user is an admin.
So we can check if the check for the specific resource which is dashboard I guess.
Is allowed to the current user.
If it is, we display a link, otherwise we don't.
Okay, so maybe let's do things the same in all places.
Let's add this PHP here as well.
Okay.
Um, so let me log out and let me grab something from the database.
So now we're going to sign in as a user that is not an admin.
So in my case that's John, for example, which has this John example.com email.
And if I jump to the fixtures I can see his password.
So this would be John example.com.
And the password is password 123.
Let me sign in.
We don't see the admin link which confirms that our check function works fine.
We can now specify who can see a specific link.
All right.
But can this John also visit the URL by just typing it in the browser.
So this is slash admin dashboard.
Well we can see that he can.
So that's another protection that we need to add to the dashboard controller.
Before anything even happens we should do authorization verify.
And here just name the action that's dashboard.
And at this point, well we see this page 403 forbidden as we just don't allow people who don't have
permissions into this page.
Okay.
So I think this was really useful.
It's time that we also add a real admin panel, not only the dashboard with some stats, but actually
give users the way to add, edit or delete posts.
And then we're gonna check the different actions inside the authorization class that we've defined,
like editing, deleting posts, etc..
Now also, since we were about to comment, um, you know what?
One more thing.
Let's jump to the show view where we have the form to comment And in this case, we actually should
also check not only if the user is there, but also if someone can comment.
And I think everyone can comment.
But in case we change our mind then we can disable it.
Maybe only the verified users would be able to comment things of this nature.
I think we should have those checks everywhere.
Another thing is this comment.
Sorry not comment model but comment controller.
And the first thing here should be the authorization verify comment action.
Okay, now I think we've added the authorization into every place, which would require that.
Now let's have a short break.
And after that we're going to build the full admin panel with all the possibilities.