Skip to content

Conversation

@imliam
Copy link
Contributor

@imliam imliam commented Oct 4, 2025

Per this thread, the reasons for preferring Gates here are:

  • abort_if() throws a plain HttpException, while Gate::denyIf throws a more precise AuthorizationException which can be used by the exception handler
  • Gates get their hooks picked up, so admins/etc. won't be tripped up by these guard clauses
- abort_if($user->id === $post->user_id);
- abort_if($post->user()->is($user));
+ Gate::denyIf($user->id === $post->user_id);
+ Gate::denyIf($post->user()->is($user));

This is a quite opinionated one so I wouldn't include it as part of any default sets, but still think it's an interesting and useful refactor.

@GeniJaho
Copy link
Collaborator

GeniJaho commented Oct 6, 2025

I feel like this rule could remove some checks that are supposed to prevent all types of users, and there's no way to handle all cases correctly.

For example, abort_if($user->posts()->count() < 100);. This is not a user access permission check, but the rule would change it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants