From 275357024ffb5454f5369161c364eae4dc4c6ddc Mon Sep 17 00:00:00 2001
From: TR Tajim <com.tajim@gmail.com>
Date: Thu, 8 Oct 2026 17:04:43 +0600
Subject: [PATCH 1/5] feat(blogs): allow authors to edit their own blogs via
 BlogPolicy

---
 app/Http/Controllers/Admin/BlogController.php |  6 +++++
 app/Http/Requests/Blog/UpdateBlogRequest.php  |  5 +++-
 app/Policies/BlogPolicy.php                   | 25 +++++++++++++++++++
 resources/js/components/BlogRow.vue           | 22 ++++++++++++----
 routes/admin.php                              |  2 +-
 5 files changed, 53 insertions(+), 7 deletions(-)
 create mode 100644 app/Policies/BlogPolicy.php

diff --git a/app/Http/Controllers/Admin/BlogController.php b/app/Http/Controllers/Admin/BlogController.php
index 6760835e..78f37454 100644
--- a/app/Http/Controllers/Admin/BlogController.php
+++ b/app/Http/Controllers/Admin/BlogController.php
@@ -7,6 +7,7 @@
 use App\Http\Requests\Blog\UpdateBlogRequest;
 use App\Models\Blog;
 use Illuminate\Support\Facades\Auth;
+use Illuminate\Support\Facades\Gate;
 use Illuminate\Support\Facades\Storage;
 use Inertia\Inertia;
 
@@ -28,6 +29,7 @@ public function create()
 
     public function edit(Blog $blog)
     {
+        Gate::authorize('update', $blog);
 
         return Inertia::render('admin/BlogCreateOrEdit', [
             'blog' => $blog,
@@ -54,6 +56,8 @@ public function store(StoreBlogRequest $request)
 
     public function update(UpdateBlogRequest $request, Blog $blog)
     {
+        Gate::authorize('update', $blog);
+
         $data = $request->validated();
 
         if ($request->hasFile('featured_image')) {
@@ -80,6 +84,8 @@ public function update(UpdateBlogRequest $request, Blog $blog)
 
     public function destroy(Blog $blog)
     {
+        Gate::authorize('delete', $blog);
+
         if ($blog->featured_image_path) {
 
             Storage::delete($blog->featured_image_path);
diff --git a/app/Http/Requests/Blog/UpdateBlogRequest.php b/app/Http/Requests/Blog/UpdateBlogRequest.php
index e8e4d048..4961c652 100644
--- a/app/Http/Requests/Blog/UpdateBlogRequest.php
+++ b/app/Http/Requests/Blog/UpdateBlogRequest.php
@@ -2,6 +2,7 @@
 
 namespace App\Http\Requests\Blog;
 
+use App\Models\Blog;
 use Illuminate\Foundation\Http\FormRequest;
 use Illuminate\Support\Str;
 use Illuminate\Validation\Rule;
@@ -10,7 +11,9 @@ class UpdateBlogRequest extends FormRequest
 {
     public function authorize(): bool
     {
-        return true;
+        $blog = $this->route('blog');
+
+        return $blog instanceof Blog ? (bool) $this->user()?->can('update', $blog) : true;
     }
 
     protected function prepareForValidation(): void
diff --git a/app/Policies/BlogPolicy.php b/app/Policies/BlogPolicy.php
new file mode 100644
index 00000000..e128ea3d
--- /dev/null
+++ b/app/Policies/BlogPolicy.php
@@ -0,0 +1,25 @@
+<?php
+
+namespace App\Policies;
+
+use App\Models\Blog;
+use App\Models\User;
+
+class BlogPolicy
+{
+    /**
+     * Determine whether the user can update the blog.
+     */
+    public function update(User $user, Blog $blog): bool
+    {
+        return $user->id === $blog->user_id || $user->can('edit blogs');
+    }
+
+    /**
+     * Determine whether the user can delete the blog.
+     */
+    public function delete(User $user, Blog $blog): bool
+    {
+        return $user->can('delete blogs');
+    }
+}
diff --git a/resources/js/components/BlogRow.vue b/resources/js/components/BlogRow.vue
index 97d3e992..9c7cdc05 100644
--- a/resources/js/components/BlogRow.vue
+++ b/resources/js/components/BlogRow.vue
@@ -1,10 +1,11 @@
 <script setup lang="ts">
 import { Link, router } from '@inertiajs/vue3';
 import { Pencil, Trash2, Eye, BookOpen } from 'lucide-vue-next';
+import { computed } from 'vue';
 import StatusBadge from '@/components/StatusBadge.vue';
-import { usePermissions } from '@/lib/usePermissions';
+import { useAuth } from '@/lib/useAuth';
 
-const { can } = usePermissions();
+const { userId, can } = useAuth();
 
 const props = defineProps({
     blog: {
@@ -13,6 +14,17 @@ const props = defineProps({
     },
 });
 
+const canEdit = computed(() => {
+    return (
+        can('edit blogs') ||
+        (userId.value !== null && userId.value === props.blog.user_id)
+    );
+});
+
+const canDelete = computed(() => {
+    return can('delete blogs');
+});
+
 const deleteBlog = () => {
     if (confirm('Are you sure you want to delete this blog?')) {
         router.delete(`/admin/blogs/${props.blog.slug}`);
@@ -76,12 +88,12 @@ const deleteBlog = () => {
 
         <!-- Right: Actions -->
         <div
-            v-if="can('edit blogs') || can('delete blogs')"
+            v-if="canEdit || canDelete"
             class="flex shrink-0 items-center gap-1"
             @click.stop
         >
             <Link
-                v-if="can('edit blogs')"
+                v-if="canEdit"
                 :href="`/admin/blogs/edit/${blog.slug}`"
                 class="rounded-lg p-1.5 text-slate-400 transition-colors hover:bg-slate-100 hover:text-indigo-600 dark:text-gray-500 dark:hover:bg-gray-800 dark:hover:text-indigo-400"
                 title="Edit blog"
@@ -90,7 +102,7 @@ const deleteBlog = () => {
             </Link>
 
             <button
-                v-if="can('delete blogs')"
+                v-if="canDelete"
                 @click="deleteBlog"
                 type="button"
                 class="rounded-lg p-1.5 text-slate-400 transition-colors hover:bg-rose-50 hover:text-rose-600 dark:text-gray-500 dark:hover:bg-rose-500/10 dark:hover:text-rose-400"
diff --git a/routes/admin.php b/routes/admin.php
index d5de47bb..bcd6ab87 100644
--- a/routes/admin.php
+++ b/routes/admin.php
@@ -40,7 +40,7 @@
     Route::post('/blogs', [AdminBlogController::class, 'store'])->name('blogs.store');
 });
 
-Route::middleware('permission:edit blogs')->group(function () {
+Route::middleware('can:update,blog')->group(function () {
     Route::get('/blogs/edit/{blog}', [AdminBlogController::class, 'edit'])->name('blogs.edit');
     Route::post('/blogs/edit/{blog}/patch', [AdminBlogController::class, 'update'])->name('blogs.update');
 });

From 5542a79dc1fe6f3c09cc2ce6c0be32f80c2299b1 Mon Sep 17 00:00:00 2001
From: TR Tajim <com.tajim@gmail.com>
Date: Thu, 8 Oct 2026 17:12:59 +0600
Subject: [PATCH 2/5] refactor(blogs): rely on route middleware for blog policy
 authorization

---
 app/Http/Controllers/Admin/BlogController.php | 7 -------
 app/Http/Requests/Blog/UpdateBlogRequest.php  | 5 +----
 2 files changed, 1 insertion(+), 11 deletions(-)

diff --git a/app/Http/Controllers/Admin/BlogController.php b/app/Http/Controllers/Admin/BlogController.php
index 78f37454..133dc0a8 100644
--- a/app/Http/Controllers/Admin/BlogController.php
+++ b/app/Http/Controllers/Admin/BlogController.php
@@ -7,7 +7,6 @@
 use App\Http\Requests\Blog\UpdateBlogRequest;
 use App\Models\Blog;
 use Illuminate\Support\Facades\Auth;
-use Illuminate\Support\Facades\Gate;
 use Illuminate\Support\Facades\Storage;
 use Inertia\Inertia;
 
@@ -29,8 +28,6 @@ public function create()
 
     public function edit(Blog $blog)
     {
-        Gate::authorize('update', $blog);
-
         return Inertia::render('admin/BlogCreateOrEdit', [
             'blog' => $blog,
         ]);
@@ -56,8 +53,6 @@ public function store(StoreBlogRequest $request)
 
     public function update(UpdateBlogRequest $request, Blog $blog)
     {
-        Gate::authorize('update', $blog);
-
         $data = $request->validated();
 
         if ($request->hasFile('featured_image')) {
@@ -84,8 +79,6 @@ public function update(UpdateBlogRequest $request, Blog $blog)
 
     public function destroy(Blog $blog)
     {
-        Gate::authorize('delete', $blog);
-
         if ($blog->featured_image_path) {
 
             Storage::delete($blog->featured_image_path);
diff --git a/app/Http/Requests/Blog/UpdateBlogRequest.php b/app/Http/Requests/Blog/UpdateBlogRequest.php
index 4961c652..e8e4d048 100644
--- a/app/Http/Requests/Blog/UpdateBlogRequest.php
+++ b/app/Http/Requests/Blog/UpdateBlogRequest.php
@@ -2,7 +2,6 @@
 
 namespace App\Http\Requests\Blog;
 
-use App\Models\Blog;
 use Illuminate\Foundation\Http\FormRequest;
 use Illuminate\Support\Str;
 use Illuminate\Validation\Rule;
@@ -11,9 +10,7 @@ class UpdateBlogRequest extends FormRequest
 {
     public function authorize(): bool
     {
-        $blog = $this->route('blog');
-
-        return $blog instanceof Blog ? (bool) $this->user()?->can('update', $blog) : true;
+        return true;
     }
 
     protected function prepareForValidation(): void

From 21e6c7e91382b5270f34f83eeb1b2ebdb0288b75 Mon Sep 17 00:00:00 2001
From: TR Tajim <com.tajim@gmail.com>
Date: Thu, 8 Oct 2026 17:14:11 +0600
Subject: [PATCH 3/5] Update BlogController.php

---
 app/Http/Controllers/Admin/BlogController.php | 1 +
 1 file changed, 1 insertion(+)

diff --git a/app/Http/Controllers/Admin/BlogController.php b/app/Http/Controllers/Admin/BlogController.php
index 133dc0a8..2a238f4b 100644
--- a/app/Http/Controllers/Admin/BlogController.php
+++ b/app/Http/Controllers/Admin/BlogController.php
@@ -28,6 +28,7 @@ public function create()
 
     public function edit(Blog $blog)
     {
+        
         return Inertia::render('admin/BlogCreateOrEdit', [
             'blog' => $blog,
         ]);

From a9e68bba7d68c83d3e9e5629538208c82088279d Mon Sep 17 00:00:00 2001
From: TR Tajim <com.tajim@gmail.com>
Date: Thu, 8 Oct 2026 17:16:30 +0600
Subject: [PATCH 4/5] refactor(blogs): remove unused delete policy method and
 restore BlogController

---
 app/Http/Controllers/Admin/BlogController.php | 2 +-
 app/Policies/BlogPolicy.php                   | 8 --------
 2 files changed, 1 insertion(+), 9 deletions(-)

diff --git a/app/Http/Controllers/Admin/BlogController.php b/app/Http/Controllers/Admin/BlogController.php
index 2a238f4b..6760835e 100644
--- a/app/Http/Controllers/Admin/BlogController.php
+++ b/app/Http/Controllers/Admin/BlogController.php
@@ -28,7 +28,7 @@ public function create()
 
     public function edit(Blog $blog)
     {
-        
+
         return Inertia::render('admin/BlogCreateOrEdit', [
             'blog' => $blog,
         ]);
diff --git a/app/Policies/BlogPolicy.php b/app/Policies/BlogPolicy.php
index e128ea3d..b23300f4 100644
--- a/app/Policies/BlogPolicy.php
+++ b/app/Policies/BlogPolicy.php
@@ -14,12 +14,4 @@ public function update(User $user, Blog $blog): bool
     {
         return $user->id === $blog->user_id || $user->can('edit blogs');
     }
-
-    /**
-     * Determine whether the user can delete the blog.
-     */
-    public function delete(User $user, Blog $blog): bool
-    {
-        return $user->can('delete blogs');
-    }
 }

From fc9e51086813017a094d2dc03e2e5e456ecf0a20 Mon Sep 17 00:00:00 2001
From: TR Tajim <com.tajim@gmail.com>
Date: Thu, 8 Oct 2026 17:19:24 +0600
Subject: [PATCH 5/5] feat(resources): allow authors to edit their own
 resources via ResourcePolicy

---
 app/Policies/ResourcePolicy.php               | 21 ++++++++++++++++
 resources/js/components/admin/ResourceRow.vue | 25 +++++++++++++------
 routes/admin.php                              |  3 ++-
 3 files changed, 41 insertions(+), 8 deletions(-)
 create mode 100644 app/Policies/ResourcePolicy.php

diff --git a/app/Policies/ResourcePolicy.php b/app/Policies/ResourcePolicy.php
new file mode 100644
index 00000000..173019a5
--- /dev/null
+++ b/app/Policies/ResourcePolicy.php
@@ -0,0 +1,21 @@
+<?php
+
+namespace App\Policies;
+
+use App\Models\Resource;
+use App\Models\User;
+
+class ResourcePolicy
+{
+    /**
+     * Determine whether the user can update the resource.
+     */
+    public function update(User $user, Resource $resource): bool
+    {
+        if ($resource->node?->isEffectivelyFrozen()) {
+            return false;
+        }
+
+        return $user->id === $resource->user_id || $user->can('edit resources');
+    }
+}
diff --git a/resources/js/components/admin/ResourceRow.vue b/resources/js/components/admin/ResourceRow.vue
index dbb6e078..22de4382 100644
--- a/resources/js/components/admin/ResourceRow.vue
+++ b/resources/js/components/admin/ResourceRow.vue
@@ -9,9 +9,10 @@ import {
     Pencil,
     Trash2,
 } from 'lucide-vue-next';
-import { usePermissions } from '@/lib/usePermissions';
+import { computed } from 'vue';
+import { useAuth } from '@/lib/useAuth';
 
-const { can } = usePermissions();
+const { userId, can } = useAuth();
 
 const props = defineProps({
     resource: Object,
@@ -22,6 +23,18 @@ const emit = defineEmits<{
     (e: 'edit', resource: any): void;
 }>();
 
+const canEdit = computed(() => {
+    return (
+        !props.isFrozen &&
+        (can('edit resources') ||
+            (userId.value !== null && userId.value === props.resource?.user_id))
+    );
+});
+
+const canDelete = computed(() => {
+    return !props.isFrozen && can('delete resources');
+});
+
 const handleDelete = () => {
     if (confirm('Are you sure you want to delete this Resource?')) {
         router.delete(`/admin/resources/${props.resource?.id}`);
@@ -76,14 +89,12 @@ const handleDelete = () => {
 
         <!-- Right: Actions -->
         <div
-            v-if="
-                !isFrozen && (can('edit resources') || can('delete resources'))
-            "
+            v-if="canEdit || canDelete"
             class="flex shrink-0 items-center gap-1"
             @click.stop
         >
             <button
-                v-if="can('edit resources')"
+                v-if="canEdit"
                 type="button"
                 @click="emit('edit', resource)"
                 class="cursor-pointer rounded-lg p-1.5 text-slate-400 transition-colors hover:bg-slate-100 hover:text-amber-700 dark:text-gray-500 dark:hover:bg-gray-800 dark:hover:text-amber-400"
@@ -93,7 +104,7 @@ const handleDelete = () => {
             </button>
 
             <button
-                v-if="can('delete resources')"
+                v-if="canDelete"
                 type="button"
                 @click="handleDelete"
                 class="rounded-lg p-1.5 text-slate-400 transition-colors hover:bg-rose-50 hover:text-rose-600 dark:text-gray-500 dark:hover:bg-rose-500/10 dark:hover:text-rose-400"
diff --git a/routes/admin.php b/routes/admin.php
index bcd6ab87..e38476ad 100644
--- a/routes/admin.php
+++ b/routes/admin.php
@@ -70,8 +70,9 @@
     Route::post('/resources/bulk/videos', [AdminResourceController::class, 'storeBulkVideos']);
 });
 
+Route::post('/resources/{resource}/patch', [AdminResourceController::class, 'update'])->middleware('can:update,resource');
+
 Route::middleware('permission:edit resources')->group(function () {
-    Route::post('/resources/{resource}/patch', [AdminResourceController::class, 'update']);
     Route::post('/nodes/{node}/resources/bulk-rename', [AdminResourceController::class, 'bulkRename'])->name('resources.bulk-rename');
 });