TipPolicy.php

<?php
namespace App\Policies;

use App\Models\Tip;
use App\Models\User;
use Illuminate\Auth\Access\HandlesAuthorization;

class TipPolicy
{
    use HandlesAuthorization;

    // Admins and Moderators can fully manage Tips
    public function before(User $user, $ability)
    {
        if ($user->isAdmin() || $user->isTipModerator()) {
            return true;
        }
    }

    // Users can see a list of Tips
    public function viewAny(User $user)
    {
        return true;
    }

    // Users can only view their own Tips (Admins/Mods can view all)
    public function view(User $user, Tip $tip)
    {
        return $user->id === $tip->user_id;
    }

    // Users cannot create Tips (only Admins/Mods can)
    public function create(User $user)
    {
        return false;
    }

    // Users can update Tips
    public function update(User $user, Tip $tip)
    {
        return $this->view($user, $tip);
    }

    // Users can soft delete Tips
    public function delete(User $user, Tip $tip)
    {
        return true;
    }

    // Users can restore Tips
    public function restore(User $user, Tip $tip)
    {
        return $this->delete($user, $tip);
    }

    // Users cannot force delete Tips (only Admins/Mods can)
    public function forceDelete(User $user, Tip $tip)
    {
        return false;
    }
}