landing-api/app/Policies/ResourcePolicy.php

<?php

declare(strict_types=1);

namespace App\Policies;

use App\Models\User;
use Illuminate\Auth\Access\HandlesAuthorization;
use Illuminate\Database\Eloquent\Model;

/**
 * Maps the standard resource abilities onto permission names of the form
 * "<resource>.<ability>", so policies only have to declare their resource key
 * and whatever extra rules they genuinely need.
 *
 * Both the Filament panel and the REST API authorise through these policies,
 * which is what keeps the two surfaces from drifting apart.
 */
abstract class ResourcePolicy
{
    use HandlesAuthorization;

    /**
     * Permission prefix, e.g. "pages".
     */
    abstract protected function resource(): string;

    public function viewAny(User $user): bool
    {
        return $user->can($this->ability('view_any'));
    }

    public function view(User $user, Model $model): bool
    {
        return $user->can($this->ability('view'));
    }

    public function create(User $user): bool
    {
        return $user->can($this->ability('create'));
    }

    public function update(User $user, Model $model): bool
    {
        return $user->can($this->ability('update'));
    }

    public function delete(User $user, Model $model): bool
    {
        return $user->can($this->ability('delete'));
    }

    public function deleteAny(User $user): bool
    {
        return $user->can($this->ability('delete'));
    }

    public function restore(User $user, Model $model): bool
    {
        return $user->can($this->ability('restore'));
    }

    public function forceDelete(User $user, Model $model): bool
    {
        return $user->can($this->ability('force_delete'));
    }

    protected function ability(string $ability): string
    {
        return "{$this->resource()}.{$ability}";
    }
}