Laravel JSON:API - 允许用户创建只与他们自己相关的对象

Question

我设置了一个 JSON API，我想允许用户只为自己创建地址。

In the docs it shows that there is no request to check against in the Policy when creating a resource.

关系验证也只适用于更新，而不适用于创建，所以我不太明白我怎么能以类似于更新方法的方式说“如果关系是他们自己的用户 ID，则只授权用户创建地址” .

政策示例：

class AddressPolicy
{
    use HandlesAuthorization;
    
    public function update(User $requestingUser, Address $address): bool
    {
        // User may update their own address if they do not have permission to edit all addresses
        return  $requestingUser->is($address->user) || $requestingUser->can('edit addresses');
    }

    public function create(User $requestingUser): bool
    {
        // Check if requestingUser is creating an address for themselves?
        return $requestingUser->can('create addresses');
    }
}

我能看到的唯一选择是为此创建一个custom controller action，但感觉应该可以通过策略验证或类似方式来做到这一点。

Answer 1

将您的创建方法更新为以下内容：

public function create(User $requestingUser, $userId): bool
{
    // Check if requesting user is creating an address for themselves
    return $requestingUser->id === $userId || 
        $requestingUser->can('create addresses');
}