Skip to content

Conversation

@imliam
Copy link
Contributor

@imliam imliam commented Oct 4, 2025

Per this thread, the reasons for preferring Gates here are:

  • abort_if() throws a plain HttpException, while Gate::denyIf throws a more precise AuthorizationException which can be used by the exception handler
  • Gates get their hooks picked up, so admins/etc. won't be tripped up by these guard clauses
- abort_if($user->id === $post->user_id);
- abort_if($post->user()->is($user));
+ Gate::denyIf($user->id === $post->user_id);
+ Gate::denyIf($post->user()->is($user));

This is a quite opinionated one so I wouldn't include it as part of any default sets, but still think it's an interesting and useful refactor.

@GeniJaho
Copy link
Collaborator

GeniJaho commented Oct 6, 2025

I feel like this rule could remove some checks that are supposed to prevent all types of users, and there's no way to handle all cases correctly.

For example, abort_if($user->posts()->count() < 100);. This is not a user access permission check, but the rule would change it.

@peterfox
Copy link
Collaborator

@imliam I like the rule in theory but as @GeniJaho pointed out, it's a bit problematic and I can't think of any way to reduce that. I think this could become one of those rules that just adds to maintenance work later on without providing a ton of value to end users. We appreciate the effort though.

@peterfox peterfox closed this Nov 24, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants