Laravel权限配置求助：如何实现已认证用户仅查看自身创建的数据

Hey there! No worries at all—this is a super common (and crucial) feature to set up in Laravel, and I’ll walk you through it step by step with simple, adaptable examples since you’re new to the framework. Let’s dive in!

First, you need to create a relationship between your data model (let’s say it’s Post for this example—swap this with your actual model name like Task, Comment, etc.) and Laravel’s built-in User model.

Update Your Data Model #

Open app/Models/Post.php and add this method to define a "belongs to" relationship (each post belongs to one user):

use App\Models\User;

public function user()
{
    return $this->belongsTo(User::class);
}

Update the User Model #

Open app/Models/User.php and add this to define a "has many" relationship (each user can have many posts):

use App\Models\Post;

public function posts()
{
    return $this->hasMany(Post::class);
}

Add a user_id Column to Your Data Table #

You’ll need a user_id field in your data’s database table to link it to the user. If you don’t have this yet, generate a migration:

php artisan make:migration add_user_id_to_posts_table --table=posts

Open the new migration file (in database/migrations/) and update it like this:

public function up()
{
    Schema::table('posts', function (Blueprint $table) {
        $table->unsignedBigInteger('user_id')->nullable();
        // This ensures if a user is deleted, their data is too (adjust if needed)
        $table->foreign('user_id')->references('id')->on('users')->onDelete('cascade');
    });
}

public function down()
{
    Schema::table('posts', function (Blueprint $table) {
        $table->dropForeign(['user_id']);
        $table->dropColumn('user_id');
    });
}

Run the migration to apply the change:

php artisan migrate

When a user creates new data, you need to automatically attach their ID to the record. In your controller’s store method (e.g., PostController), add the user’s ID to the validated data:

public function store(Request $request)
{
    // Validate your input fields first
    $validated = $request->validate([
        'title' => 'required|string|max:255',
        'content' => 'required|string',
        // Add your other fields here
    ]);

    // Attach the current logged-in user's ID
    $validated['user_id'] = auth()->id();

    // Create and save the record
    Post::create($validated);

    return redirect()->route('posts.index')->with('success', 'Data created successfully!');
}

auth()->id() grabs the ID of the currently authenticated user—perfect for linking the new data to them.

Instead of pulling all records from your database (like Post::all()), fetch only the data belonging to the current user. Update your controller’s index method:

public function index()
{
    // Get all posts created by the logged-in user, sorted newest first
    $posts = auth()->user()->posts()->latest()->get();

    return view('posts.index', compact('posts'));
}

This uses the relationship we set up earlier to filter results automatically—no messy where clauses needed!

You don’t want users modifying or deleting data they didn’t create. There are two simple ways to handle this:

Option 1: Quick Check in the Controller #

Add a check at the start of your edit, update, and destroy methods to verify the user owns the data:

public function edit(Post $post)
{
    // If the current user isn't the owner, block access
    if ($post->user_id !== auth()->id()) {
        abort(403, 'You aren’t authorized to edit this data.');
    }

    return view('posts.edit', compact('post'));
}

Repeat this check in the update and destroy methods too.

Option 2: Use Laravel Policies (Cleaner for Long-Term) #

For a more scalable approach, use Laravel’s authorization policies. First, generate a policy for your model:

php artisan make:policy PostPolicy --model=Post

Open app/Policies/PostPolicy.php and define the update and delete rules:

public function update(User $user, Post $post)
{
    // Only allow access if the user owns the post
    return $user->id === $post->user_id;
}

public function delete(User $user, Post $post)
{
    // Reuse the update rule, or define a separate one if needed
    return $this->update($user, $post);
}

Next, register the policy in app/Providers/AuthServiceProvider.php:

protected $policies = [
    App\Models\Post::class => App\Policies\PostPolicy::class,
];

Now you can replace the controller check with Laravel’s authorize method:

public function edit(Post $post)
{
    $this->authorize('update', $post);

    return view('posts.edit', compact('post'));
}

This is the recommended approach because it keeps your authorization logic organized and easy to extend later.

• Swap all instances of Post with your actual data model name (e.g., Task, Invoice).
• If you’re using resource controllers, you can apply these checks to the appropriate methods (index, store, edit, update, destroy).

That’s it! Once you set these up, users will only see and interact with their own data. If you run into issues with specific parts of your code, feel free to share snippets and I’ll help you tweak them.

内容的提问来源于stack exchange，提问作者L. Fox