I have a Laravel project where the controllers (all derived from one of two base controllers) use repository and persistor classes to interface with Eloquent models. Authorization logic is implemented in policy classes but the actual check needs to be made either in the base controllers or in the repository and persistors. This is what I mean by a check:

    $user = $this->controller->resloveCurrentUser();
    if ($user->can($this->undeletePolicyFunction, $resource)) {

        // Data retrieval or setting logic

Currently I feel that having the checks in the controller might be a better idea, but I initially implemented some of the checks inside my base persistor, so it wasn't my first instinct.

I am not quite sure why I did this way other than because my base persistor's functions are only one or two lines long without the checks and it seemed wasteful to instantiate a whole new class just to have it's methods pass it's parameters verbatim to Eloquent.

Could there be something I'm missing. Is there a good argument for having authorization inside repository/persistor classes instead of the controller?

  • Well, what should be the role of a controller class otherwise then? – πάντα ῥεῖ Dec 25 '19 at 14:30
  • The controller is mainly glue. It's constructor loads the appropriate validation, repository, persistor and view generator classes. Then it's methods call the appropriate methods on those loaded classes. The policy would be really just be another version of that, though the auth service provider handles loading in this case instead of the controllers constructor – Kaan Dec 26 '19 at 8:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.