Filament•14mo ago

Permissions for specific group of records

Hi, what would be the best way to give a user permission only to select records that are in a given group. For example: You have a states group that have cities and a user has only access to one state and therefore can only select the cities inside that state. I know it's not a general question for filament but I'm very new here and don't know all the possibilities and plugins that would be appropriate for this. Thank you! ❤️

9 Replies

Dan Harrin•14mo ago

have you used Laravel policies before?

Prodex•14mo ago

no not really

toeknee•14mo ago

Time to read up about them 😉

Prodex•14mo ago

would this be correct?

class RegionCityPolicy
{
    use HandlesAuthorization;

    /**
     * Determine whether the user can view the city.
     *
     * @param  \App\Models\User  $user
     * @param  \App\Models\City  $city
     * @return mixed
     */
    public function view(User $user, City $city)
    {
       
        $allowedRegions = $user->regions;

       
        foreach ($allowedRegions as $region) {
            if ($region->cities->contains($city)) {
                return true;
            }
        }

        return false;
    }
}

class RegionCityPolicy
{
    use HandlesAuthorization;

    /**
     * Determine whether the user can view the city.
     *
     * @param  \App\Models\User  $user
     * @param  \App\Models\City  $city
     * @return mixed
     */
    public function view(User $user, City $city)
    {
       
        $allowedRegions = $user->regions;

       
        foreach ($allowedRegions as $region) {
            if ($region->cities->contains($city)) {
                return true;
            }
        }

        return false;
    }
}

toeknee•14mo ago

That appears to be correct at a glance, make sure to map the policy to the model

Prodex•14mo ago

you mean in AuthServiceProvider?

toeknee•14mo ago

yeah]

Prodex•14mo ago

Nice. And how would I use this policy for a select multiple in filament forms?

toeknee•14mo ago

IT will be automatically applied once you setup the policy

Gaming

Programming

Permissions for specific group of records