.", so policies only have to declare their resource key * and whatever extra rules they genuinely need. * * Both the Filament panel and the REST API authorise through these policies, * which is what keeps the two surfaces from drifting apart. */ abstract class ResourcePolicy { use HandlesAuthorization; /** * Permission prefix, e.g. "pages". */ abstract protected function resource(): string; public function viewAny(User $user): bool { return $user->can($this->ability('view_any')); } public function view(User $user, Model $model): bool { return $user->can($this->ability('view')); } public function create(User $user): bool { return $user->can($this->ability('create')); } public function update(User $user, Model $model): bool { return $user->can($this->ability('update')); } public function delete(User $user, Model $model): bool { return $user->can($this->ability('delete')); } public function deleteAny(User $user): bool { return $user->can($this->ability('delete')); } public function restore(User $user, Model $model): bool { return $user->can($this->ability('restore')); } public function forceDelete(User $user, Model $model): bool { return $user->can($this->ability('force_delete')); } protected function ability(string $ability): string { return "{$this->resource()}.{$ability}"; } }