Las políticas definen los permisos para ejecutar acciones

InstitutionPolicy.php

<?php

namespace App\Policies;

use App\User;
use App\Institution;
use Illuminate\Auth\Access\HandlesAuthorization;

class InstitutionPolicy
{
    use HandlesAuthorization;

    public function browse(User $user) {
      return $user->isOnboarded() || $user->admin;
    }

    public function create(User $user) {
      return $user->institutions()->count() == 0 || $user->admin;
    }

    public function edit(User $user, Institution $institution) {
      return $this->manage($user, $institution) || $user->admin;
    }

    public function tag(User $user, Institution $institution) {
      return $user->admin;
    }

    public function manage(User $user, Institution $institution) {
      return $user->admin || $user->institutions()
        ->where('institutions.id', $institution->id)
        ->wherePivotIn('role', ['manager', 'owner'])
        ->exists();
    }

    public function viewFavorites(User $user, Institution $institution) {
      return $institution->users->contains($user) || $user->admin;
    }

    public function listInvites(User $user, Institution $institution) {
      return $this->manage($user, $institution) || $user->admin;
    }

    public function requestInvite(User $user, Institution $institution) {
      if ($institution->users->contains($user)) {
        return false;
      }

      if ($institution->blockingRequests()->pluck('user_id')->contains($user->id)) {
        return false;
      }

      return !$user->institutions()->count() || $user->admin;
    }

    public function viewInvites(User $user, Institution $institution) {
      return $this->manage($user, $institution) || $user->admin;
    }

    public function sendInvite(User $user, Institution $institution) {
      return $this->manage($user, $institution) || $user->admin;
    }

    public function favorite(User $user, Institution $institution) {
      // Not for institution's own users
      if ($institution->users->contains($user)) {
        return false;
      }

      // Not if already liked
      if ($institution->favorites()->pluck('user_id')->contains($user->id)) {
        return false;
      }

      return true;
    }

    public function unfavorite(User $user, Institution $institution) {
      // Only if already liked
      return $user->favorites()->pluck('institution_id')->contains($institution->id);
    }

    public function join(User $user, Institution $institution) {
      return !$user->institutions()->count() || $user->admin;
    }

    public function admin(User $user, Institution $institution) {
      return $user->admin;
    }
}