I have a **resource controller** called `StreamController.php`, that utilizes a policy called `StreamPolicy.php`.

In my controller, I have this:

```
    //StreamController.php
    /**
     * Construct method.
     */
    public function __construct()
    {
        $this->middleware('auth');
        $this->authorizeResource(Stream::class, 'stream');
    }

```

With above, all the RESTful endpoints is successfully "protected" using the policy.

However, I have added a new method to my controller, called `documents()`, like so:

```
//web.php
Route::get('streams/{stream}/documents', 'StreamController@documents');

```

```
    //StreamController.php
    /**
     * Display the imported documents of the resource
     *
     * @return \Illuminate\Http\Response
     */
    public function documents(Stream $stream)
    {
        return view('streams.documents', compact('stream'));
    }

```

Now the problem is if I visit the URL: 

**example.com/streams/1** and I am not the owner of the stream, I get a 403 page - **but** if I go to:
**example.com/streams/1/documents** and I am not the owner of the stream, I can still access the page.

What am I doing wrong? How can I make so my policy also covers the `documents()` methods in my controller?

**Edit:**

This is my `StreamPolicy.php` file:

```
//StreamPolicy.php
namespace App\Policies;

use App\User;
use App\Stream;
use Illuminate\Auth\Access\HandlesAuthorization;

class StreamPolicy
{
    use HandlesAuthorization;

    /**
     * Determine whether the user can view the stream.
     *
     * @param  \App\User  $user
     * @param  \App\Stream  $stream
     * @return mixed
     */
    public function view(User $user, Stream $stream)
    {
        return $user->id == $stream->user_id;
    }

    /**
     * Determine whether the user can create streams.
     *
     * @param  \App\User  $user
     * @return mixed
     */
    public function create(User $user)
    {
        //
        return true;
    }

    /**
     * Determine whether the user can update the stream.
     *
     * @param  \App\User  $user
     * @param  \App\Stream  $stream
     * @return mixed
     */
    public function update(User $user, Stream $stream)
    {
        //

        return $user->id == $stream->user_id;
    }

    /**
     * Determine whether the user can delete the stream.
     *
     * @param  \App\User  $user
     * @param  \App\Stream  $stream
     * @return mixed
     */
    public function delete(User $user, Stream $stream)
    {
        //

        return $user->id == $stream->user_id;
    }

    /**
     * Determine whether the user can restore the stream.
     *
     * @param  \App\User  $user
     * @param  \App\Stream  $stream
     * @return mixed
     */
    public function restore(User $user, Stream $stream)
    {
        //
    }

    /**
     * Determine whether the user can permanently delete the stream.
     *
     * @param  \App\User  $user
     * @param  \App\Stream  $stream
     * @return mixed
     */
    public function forceDelete(User $user, Stream $stream)
    {
        //
    }
}

```