CODEWITHSUNDEEP
phplaravellaravel-5
Nicklas Kevin Frank
Nicklas Kevin Frank

Reputation: 6337

Laravel 5 requests: Authorizing and then parsing object to controller

I am not sure if I am using this correctly, but I am utilising the requests in Laravel 5, to check if the user is logged in and if he is the owner of an object. To do this I need to get the actual object in the request class, but then I need to get the same object in the controller?

So instead of fetching it twice, I thought, why not just set the object as a variable on the request class, making it accessible to the controller?

It works, but I feel dirty? Is there a more appropriate way to handle this?

Ex. Request Class

class DeleteCommentRequest extends Request {

    var $comment = null;

    public function authorize() {
        $this->comment = comment::find(Input::get('comment_id'));
        $user = Auth::user();

        if($this->comment->user == $user)
            return true;

        return false;
    }

    public function rules() {
        return [
            'comment_id'   => 'required|exists:recipes_comments,id'
        ];
    }
}

Ex. Controller:

public function postDeleteComment(DeleteCommentRequest $request) {
        $comment = $request->comment;
        $comment->delete();
        return $comment;
}

So what is my question? How do I best handle having to use the object twice when using the new Laravel 5 requests? Am I possibly overextending the functionality of the application? Is it ok to store the object in the application class so I can reach it later in my controller?

Upvotes: 3

Views: 1507

Answers (2)

jfadich
jfadich

Reputation: 6348

Since you're wanting to use the Model in two different places, but only query it once I would recommenced you use route-model binding.

In your RouteServiceProvider class (or any relevant provider) you'll want to bind the comment query from inside the boot method. The first parameter of bind() will be value that matches the wildcard in your route.

public function boot()
{
    app()->router->bind( 'comment_id', function ($comment_id) {
        return comment::where('id',$comment_id)->where('user_id',Auth::id())->first();
    } );
}

Once that's set up you can access the Model from your DeleteCommentRequest like so

$this->comment_id

Note: The variable is Comment_id because that's what matches your route, but it will contain the actual model.

From your controller you just inject it like so

public function postDeleteComment(Comment $comment, DeleteCommentRequest $request) {
        $comment->delete();
        return $comment;
}

Upvotes: 1

Azeame
Azeame

Reputation: 2401

I would require ownership on the query itself and then check if the collection is empty.

 class DeleteCommentRequest extends Request {

        var $comment = null;

        public function authorize() {
            $this->comment = comment::where('id',Input::get('comment_id'))->where('user_id',Auth::id())->first();

            if($this->comment->is_empty())
                return false;

            return true;
        }

        public function rules() {
            return [
                'comment_id'   => 'required|exists:recipes_comments,id'
            ];
        }
    }

Upvotes: 1

Related Questions