Taking care of authorization

By default, only the user that has created a comment may update or delete it. This behaviour is implemented using a policy that is included in the package: Spatie\LivewireComments\Policies\CommentPolicy

This is the default implementation.

class CommentPolicy
{
    public function create(Model $user, Model $commentableModel): bool
    {
        return true;
    }

    public function update(Model $user, Comment $comment): bool
    {
        return $user->getKey() === $comment->user_id;
    }

    public function delete(Model $user, Comment $comment): bool
    {
        return $user->getKey() === $comment->user_id;
    }

    public function react(Model $user, Model $commentableModel): bool
    {
        return true;
    }
}

##Modifying the policy

To modify the behaviour of the policy, you should create a class the extends the default policy. Let's assume you want to allow admins of your app to be able to update and delete comments by any user.

namespace App\Policies;

use Spatie\LivewireComments\Models\Policies\CommentPolicy;

class CustomCommentPolicy extends CommentPolicy
{
    public function update(Model $user, Comment $comment): bool
    {
        if ($user->admin) {
            return true;
        }
    
        return parent::update($user, $comment);
    }
    
    public function delete(Model $user, Comment $comment): bool
    {
        if ($user->admin) {
            return true;
        }
    
        return parent::update($user, $comment);
    }
}

Next, you should add a policies key to the comments config file and set the comment key inside it to the class name of your policy

// copy the `policies` key to `config/comments.php`
return [
    'policies' => [
        /*
         * The class you want to use as the comment policy. It needs to be or
         * extend `Spatie\LivewireComments\Models\Policies\CommentPolicy`.
         */
        'comment' => App\Policies\CustomCommentPolicy::class,
    ],
]