Skip to content

Commit cbbf936

Browse files
committed
Add content about blade directives for views.
1 parent 00a5617 commit cbbf936

File tree

5 files changed

+330
-0
lines changed

5 files changed

+330
-0
lines changed

docs/.vuepress/config.js

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,25 @@ module.exports = {
4343
children : [
4444
'/php/laravel/authorization/gates.md',
4545
'/php/laravel/authorization/policies.md',
46+
47+
{
48+
title: 'Blade Directives',
49+
path: '/php/laravel/authorization/blade-directives/',
50+
children: [
51+
{
52+
title: '@can',
53+
path: '/php/laravel/authorization/blade-directives/can.md',
54+
},
55+
{
56+
title: '@cannot',
57+
path: '/php/laravel/authorization/blade-directives/cannot.md',
58+
},
59+
{
60+
title: '@canany',
61+
path: '/php/laravel/authorization/blade-directives/canany.md',
62+
},
63+
],
64+
},
4665
],
4766
},
4867
{
Lines changed: 130 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,130 @@
1+
# Blade Authorization Directives for View Security
2+
3+
Laravel's Blade authorization directives integrate seamlessly with your application's
4+
permission system, enabling clean conditional rendering based on user capabilities.
5+
These directives maintain consistency between backend authorization and frontend display logic.
6+
7+
Blade provides three primary authorization directives for permission checking:
8+
9+
```php
10+
@can('edit', $article)
11+
<button class="edit-btn">Edit Article</button>
12+
@endcan
13+
14+
@cannot('delete', $article)
15+
<span class="text-muted">Deletion not permitted</span>
16+
@endcannot
17+
```
18+
19+
The `@canany` directive checks multiple permissions simultaneously, useful for complex authorization scenarios.
20+
21+
```php
22+
@canany(['publish', 'schedule'], $article)
23+
<div class="publishing-controls">
24+
Publishing options available
25+
</div>
26+
@endcanany
27+
```
28+
29+
Here's a comprehensive dashboard implementation showcasing various authorization patterns:
30+
31+
```php
32+
<div class="dashboard-layout">
33+
<header class="dashboard-header">
34+
<h1>Content Management</h1>
35+
36+
@canany(['create-posts', 'create-pages'])
37+
<div class="create-actions">
38+
@can('create-posts')
39+
<a href="{{ route('posts.create') }}" class="btn btn-primary">New Post</a>
40+
@endcan
41+
42+
@can('create-pages')
43+
<a href="{{ route('pages.create') }}" class="btn btn-secondary">New Page</a>
44+
@endcan
45+
</div>
46+
@endcanany
47+
</header>
48+
49+
<main class="content-area">
50+
@foreach($articles as $article)
51+
<article class="content-card">
52+
<h2>{{ $article->title }}</h2>
53+
<p>{{ $article->excerpt }}</p>
54+
55+
<div class="article-meta">
56+
<span>By {{ $article->author->name }}</span>
57+
<span>{{ $article->published_at->diffForHumans() }}</span>
58+
</div>
59+
60+
<div class="article-actions">
61+
@can('update', $article)
62+
<a href="{{ route('articles.edit', $article) }}" class="action-link">
63+
Edit
64+
</a>
65+
@endcan
66+
67+
@can('publish', $article)
68+
@if($article->is_draft)
69+
<form method="POST" action="{{ route('articles.publish', $article) }}" class="inline-form">
70+
@csrf
71+
<button type="submit" class="publish-btn">Publish</button>
72+
</form>
73+
@endif
74+
@endcan
75+
76+
@cannot('delete', $article)
77+
<span class="disabled-action">Delete (Protected)</span>
78+
@else
79+
<form method="POST" action="{{ route('articles.destroy', $article) }}" class="inline-form">
80+
@csrf
81+
@method('DELETE')
82+
<button type="submit" class="delete-btn" onclick="return confirm('Delete this article?')">
83+
Delete
84+
</button>
85+
</form>
86+
@endcannot
87+
</div>
88+
</article>
89+
@endforeach
90+
</main>
91+
92+
<aside class="sidebar">
93+
@canany(['view-analytics', 'manage-users', 'system-settings'])
94+
<div class="admin-panel">
95+
<h3>Administration</h3>
96+
<ul class="admin-links">
97+
@can('view-analytics')
98+
<li><a href="{{ route('analytics.dashboard') }}">Analytics</a></li>
99+
@endcan
100+
101+
@can('manage-users')
102+
<li><a href="{{ route('users.index') }}">User Management</a></li>
103+
@endcan
104+
105+
@can('system-settings')
106+
<li><a href="{{ route('settings.index') }}">System Settings</a></li>
107+
@endcan
108+
</ul>
109+
</div>
110+
@endcanany
111+
112+
@guest
113+
<div class="login-prompt">
114+
<p>Please <a href="{{ route('login') }}">login</a> to access all features.</p>
115+
</div>
116+
@else
117+
@cannot('create-posts')
118+
<div class="upgrade-notice">
119+
<p>Upgrade your account to create posts.</p>
120+
<a href="{{ route('plans.index') }}" class="upgrade-link">View Plans</a>
121+
</div>
122+
@endcannot
123+
@endguest
124+
</aside>
125+
</div>
126+
```
127+
128+
Authorization directives ensure that UI elements align with user permissions, creating secure and intuitive interfaces while reducing the risk of exposing unauthorized functionality.
129+
130+
[source](https://laravel-news.com/blade-authorization-can-cannot)
Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
# @can
2+
3+
Το `@can` είναι Blade directive που χρησιμοποιείται για **conditional rendering στο view layer** βάσει του Laravel authorization system (policies ή gates).
4+
Εμφανίζει το περιεχόμενο **μόνο αν ο authenticated user έχει το συγκεκριμένο ability**.
5+
6+
---
7+
8+
[[TOC]]
9+
10+
---
11+
12+
## Usage examples
13+
14+
### Model-based policy
15+
16+
```php
17+
@can('update', $post)
18+
<button>Edit</button>
19+
@endcan
20+
```
21+
22+
### Class-level ability
23+
24+
```php
25+
@can('create', \App\Models\Post::class)
26+
<a href="{{ route('posts.create') }}">New Post</a>
27+
@endcan
28+
```
29+
30+
### With else
31+
32+
```php
33+
@can('delete', $post)
34+
<button>Delete</button>
35+
@else
36+
<span>Not allowed</span>
37+
@endcan
38+
```
39+
40+
### Gate-based ability
41+
42+
```php
43+
@can('access-admin')
44+
<x-admin-panel />
45+
@endcan
46+
```
47+
48+
### Wrapping components
49+
50+
```php
51+
@can('viewAny', \App\Models\Post::class)
52+
<livewire:posts-table />
53+
@endcan
54+
```
55+
56+
💡 Το `@can` καλεί εσωτερικά το Gate::check() και δεν αντικαθιστά authorization σε controllers ή actions — είναι καθαρά για UI logic.
Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
# @canany
2+
3+
4+
Το @canany είναι Blade directive που χρησιμοποιείται για conditional rendering όταν ο χρήστης έχει **ΤΟΥΛΑΧΙΣΤΟΝ ΕΝΑ** από πολλά abilities.
5+
6+
Χρησιμοποιείται όταν ένα UI element πρέπει να εμφανίζεται αν ο χρήστης έχει **οποιοδήποτε** από τα επιτρεπόμενα permissions.
7+
8+
---
9+
10+
[[TOC]]
11+
12+
---
13+
14+
## Usage examples
15+
16+
### Model-based policy (multiple abilities)
17+
18+
```php
19+
@canany(['update', 'publish'], $post)
20+
<button>Edit or Publish</button>
21+
@endcanany
22+
```
23+
24+
### Class-level abilities
25+
26+
```php
27+
@canany(['create', 'import'], \App\Models\Post::class)
28+
<a href="{{ route('posts.create') }}">New Post</a>
29+
@endcanany
30+
```
31+
32+
### Gate-based abilities
33+
34+
```php
35+
@canany(['access-admin', 'access-moderator'])
36+
<x-admin-panel />
37+
@endcanany
38+
```
39+
40+
### Wrapping components
41+
42+
```php
43+
@canany(['viewAny', 'export'], \App\Models\Post::class)
44+
<livewire:posts-table />
45+
@endcanany
46+
```
47+
48+
### Combined UI logic
49+
50+
```php
51+
@can('delete', $post)
52+
<button>Delete</button>
53+
@endcan
54+
```
55+
56+
```php
57+
@canany(['restore', 'forceDelete'], $post)
58+
<button>Advanced actions</button>
59+
@endcanany
60+
```
61+
62+
💡 Το @canany επιστρέφει true αν **οποιοδήποτε** από τα abilities επιτρέπεται από το authorization system (policies / gates).
63+
Χρησιμοποιείται αποκλειστικά στο view layer.
Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
# @cannot
2+
3+
Το @cannot είναι Blade directive που χρησιμοποιείται για conditional rendering όταν ο χρήστης ΔΕΝ έχει ένα συγκεκριμένο ability.
4+
Αποτελεί το λογικό αντίθετο του @can και είναι χρήσιμο για fallback UI, μηνύματα περιορισμών ή alternative actions.
5+
6+
---
7+
8+
[[TOC]]
9+
10+
---
11+
12+
## Usage examples
13+
14+
### Model-based policy
15+
16+
```php
17+
@cannot('update', $post)
18+
<span>You cannot edit this post.</span>
19+
@endcannot
20+
```
21+
22+
### Class-level ability
23+
24+
```php
25+
@cannot('create', \App\Models\Post::class)
26+
<p>You are not allowed to create posts.</p>
27+
@endcannot
28+
```
29+
30+
### Gate-based ability
31+
32+
```php
33+
@cannot('access-admin')
34+
<x-alert type="warning">
35+
Admin access required
36+
</x-alert>
37+
@endcannot
38+
```
39+
40+
### Wrapping fallback components
41+
42+
```php
43+
@cannot('viewAny', \App\Models\Post::class)
44+
<empty-state message="No access to posts" />
45+
@endcannot
46+
```
47+
48+
### Inverse UI logic
49+
50+
```php
51+
@can('delete', $post)
52+
<button>Delete</button>
53+
@endcan
54+
```
55+
56+
```php
57+
@cannot('delete', $post)
58+
<span>Deletion disabled</span>
59+
@endcannot
60+
```
61+
62+
💡 Το @cannot είναι απλώς το inverse του @can και βασίζεται στο ίδιο authorization system (policies / gates). Χρησιμοποιείται αποκλειστικά στο view layer.

0 commit comments

Comments
 (0)