The problem:We want to restrict access to properties returned from our services.Details:We have route level permissions working with no issue.For a user that can view /product/{id} for example, that user may or may not have permission to view the purchasePrice property. (if they don't have permission it would either be empty or not exist in the JSON response) It seems by default laravel returns the entire record when you load the model.What we've tried:We are currently dynamically populating $visible[] based on permissions and we have a list of every field and what permission is required to read/write.My Question:Is there a better way to do this? Are we reinventing the wheel or does this seem like a reasonable approach?
Fine-grained data level permissions on a laravel RESTful API
php;rest;laravel;permissions