---
title: "Authorization — Comments for Laravel | Roundly"
description: "Opt in to gate every mutation — writes, edits, deletes, restores, moderation, locks and transfers — through a Comment policy built on the bundled one."
url: https://roundly-consulting.com/open-source/docs/comments-for-laravel/authorization
language: en
---

[All packages](https://roundly-consulting.com/open-source.md)

[Comments for Laravel](https://roundly-consulting.com/open-source/docs/comments-for-laravel.md)

# Authorization

Authorization is off by default, so existing callers are unaffected. Opt in with comments.authorization (COMMENTS\_AUTHORIZATION=true) and register a policy for the Comment model. The package ships a permissive starting point — every ability returns true — that you extend:

```php
use Illuminate\Support\Facades\Gate;
use RoundlyConsulting\Comments\Models\Comment;
use RoundlyConsulting\Comments\Policies\CommentPolicy;

Gate::policy(Comment::class, CommentPolicy::class);
```

## Abilities

| Ability | Checked by | Argument |
| --- | --- | --- |
| `create` | Every write — builder, write(), writeComment() — and Comments::transfer() | The subject — for a reply, the root subject it joins; for a transfer, the target |
| `update` | Comments::update() | The Comment |
| `delete` | Comments::delete(), deleteAll() | The Comment |
| `restore` | Comments::restore() | The Comment |
| `moderate` | Comments::approve() / hide(), approveAll() / hideAll() | The Comment |
| `lock / unlock` | Comments::lock() / unlock(), lockThread() / unlockThread(), lockReplies() / unlockReplies() | The subject, or the Comment for a thread lock |

Checks run against the currently authenticated user ($user is null for a guest), and a denial throws UnauthorizedCommentActionException. A policy registered for Comment also covers a subclass configured in comments.model; with nothing registered, Laravel’s auto-discovery resolves the shipped, permissive CommentPolicy.

## Your own policy

create receives the subject being commented on — for a reply, the root subject it joins — so you can decide per subject; lock and unlock receive what is being locked. A custom policy that lacks one of these methods denies that action, so extend the shipped CommentPolicy:

```php
use Illuminate\Database\Eloquent\Model;
use RoundlyConsulting\Comments\Policies\CommentPolicy;

class ProjectCommentPolicy extends CommentPolicy
{
    public function create(?Model $user, ?Model $commentable = null): bool
    {
        return $user !== null && $commentable instanceof Project && $commentable->hasMember($user);
    }

    public function lock(?Model $user, Model $lockable): bool
    {
        return $user?->isModerator() ?? false;
    }
}
```

```php
namespace App\Policies;

use Illuminate\Database\Eloquent\Model;
use RoundlyConsulting\Comments\Models\Comment;
use RoundlyConsulting\Comments\Policies\CommentPolicy as BaseCommentPolicy;

class CommentPolicy extends BaseCommentPolicy
{
    public function update(?Model $user, Comment $comment): bool
    {
        return $user !== null && $comment->actor?->is($user) === true;
    }

    public function delete(?Model $user, Comment $comment): bool
    {
        return $this->update($user, $comment);
    }
}

// AppServiceProvider::boot()
Gate::policy(\RoundlyConsulting\Comments\Models\Comment::class, \App\Policies\CommentPolicy::class);
```

## Answering 403

The package ships no routes, so the exception is not an HTTP exception. Map it onto Laravel’s AuthorizationException to answer 403 from your own controllers:

```php
use Illuminate\Auth\Access\AuthorizationException;
use RoundlyConsulting\Comments\Exceptions\UnauthorizedCommentActionException;

// bootstrap/app.php
->withExceptions(function (Exceptions $exceptions): void {
    $exceptions->map(fn (UnauthorizedCommentActionException $e) => new AuthorizationException($e->getMessage()));
})
```

## Show your open-source love

This package is free and MIT-licensed. If it saves you time, a one-off donation or a Patreon membership keeps it maintained, tested and documented.

[More ways to support, including crypto](https://roundly-consulting.com/support-us.md)

By donating, you agree to our [donation terms](https://roundly-consulting.com/donation-terms.md).

[Support our open source work (opens in a new tab)](https://donate.stripe.com/dRmeVe8FX5PF1Qd9pXcEw00) [Join us on Patreon (opens in a new tab)](https://www.patreon.com/cw/roundly)

## Want this built into your product?

We integrate our packages into custom Laravel and AI builds. Tell us what you're working on and we'll reply within 48 hours.

[Get a quote in 48 hours](https://roundly-consulting.com/contact.md) [Browse all packages](https://roundly-consulting.com/open-source/docs/comments-for-laravel.md)