Menu
Authorization policies for resource access control. Use when creating or modifying policies, permissions, or ability checks.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Form request validation and comprehensive validation testing. Use when creating or modifying form requests, validation rules, or validation tests.
Feature module pattern organizing domain logic into queries, mutations, and actions. Use when implementing data fetching with filters, API mutations with loading states, business logic with UI feedback, or organizing domain-specific code.
File-based routing with page patterns for lists, details, and navigation. Use when creating pages, defining page meta (permissions, layouts), implementing list/detail patterns, or setting up breadcrumbs and headers.
Foundational architecture for Nuxt 4 + Vue 3 + Nuxt UI applications. Use when starting new projects, understanding project structure, or making architectural decisions about directory organization, technology choices, and pattern selection.
Vue component patterns with Composition API and script setup. Use when creating components, understanding script setup order convention, organizing component directories, or implementing component patterns like slideovers, modals, and tables.
Creating custom Vue composables with proper patterns. Use when building reusable stateful logic, shared state management, or encapsulating feature-specific behavior.
| name | laravel-policies |
| description | Authorization policies for resource access control. Use when creating or modifying policies, permissions, or ability checks. |
Policies encapsulate authorization logic and delegate to permission systems.
Related guides:
<?php
declare(strict_types=1);
namespace App\Policies;
use App\Enums\Permission;
use App\Models\Order;
use App\Models\User;
class OrderPolicy
{
public function viewAny(User $user): bool
{
return $user->can(Permission::ListOrders);
}
public function view(User $user, Order $order): bool
{
return $user->can(Permission::ViewOrders)
&& $order->customer_id === $user->customer_id;
}
public function create(User $user): bool
{
return $user->can(Permission::CreateOrders);
}
public function update(User $user, Order $order): bool
{
return $user->can(Permission::UpdateOrders)
&& $order->canBeModified()
&& $order->customer_id === $user->customer_id;
}
public function delete(User $user, Order $order): bool
{
return $user->can(Permission::DeleteOrders)
&& $order->isPending();
}
public function cancel(User $user, Order $order): bool
{
return $this->update($user, $order)
&& $order->canBeCancelled();
}
}
<?php
declare(strict_types=1);
namespace App\Enums;
use Henzeb\Enumhancer\Concerns\Comparison;
use Henzeb\Enumhancer\Concerns\Dropdown;
enum Permission: string
{
use Comparison, Dropdown;
case ListOrders = 'list orders';
case ViewOrders = 'view orders';
case CreateOrders = 'create orders';
case UpdateOrders = 'update orders';
case DeleteOrders = 'delete orders';
case CancelOrders = 'cancel orders';
}
Laravel conventions for policy methods:
viewAny() - List/indexview() - Show single resourcecreate() - Create new resourceupdate() - Update resourcedelete() - Delete resourcerestore() - Restore soft-deletedforceDelete() - Permanently deleteCustom methods for non-standard actions:
cancel()approve()ship()return $user->can(Permission::CreateOrders);
return $user->can(Permission::ViewOrders)
&& $order->customer_id === $user->customer_id;
return $user->can(Permission::DeleteOrders)
&& $order->isPending();
public function cancel(User $user, Order $order): bool
{
return $this->update($user, $order)
&& $order->canBeCancelled();
}
Route::get('/orders', [OrderController::class, 'index'])
->can('viewAny', Order::class);
Route::get('/orders/{order}', [OrderController::class, 'show'])
->can('view', 'order');
Route::post('/orders', [OrderController::class, 'store'])
->can('create', Order::class);
See routing-permissions.md for route authorization.
Policies should: