title: Laravel only retrieve Model Records if they belong to authenticated user
body: <p>I'm using Laravel 5.4 and have a Model called <code>Order</code>.
  To test things I've created two users and two Orders, each user having one Order.</p>
  
  <p>I've just seen that I'm able to retrieve the order of someone who is not my current user. I'm retrieving a list of user's own orders using <code>Auth::user()-&gt;orders</code>. But in order to show the details of a specific order I do this:</p>
  
  <pre><code>/**
   * Display the specified resource.
   *
   * @param  int  $id
   * @return \Illuminate\Http\Response
   */
  public function show($id)
  {
      $order = CustomerOrder::findOrFail($id)-&gt;with('products')-&gt;get();
      return view('order.show')
          -&gt;with('order', $order);
  }
  </code></pre>
  
  <p>What am I missing out here? Is there a middleware or something to tell the application to only allow access to orders associated with the authenticated user?</p>
  
  <p>Edit: So I've tried to do it using a Policy <code>OrderPolicy</code> (CRUD).</p>
  
  <p>The <code>view()</code> fucntion of the Policy:</p>
  
  <pre><code>/**
   * Determine whether the user can view the customerOrder.
   *
   * @param  \App\User  $user
   * @param  \App\CustomerOrder  $customerOrder
   * @return mixed
   */
  public function view(User $user, CustomerOrder $customerOrder)
  {
      return $user-&gt;id === $customerOrder-&gt;user_id;
  }
  </code></pre>
  
  <p>And I've registered it in the <code>AuthServiceProvider.php</code>:</p>
  
  <pre><code>protected $policies = [
      'App\Model' =&gt; 'App\Policies\ModelPolicy',
      Adress::class =&gt; AdressPolicy::class, //Doesn't work either
      Order::class =&gt; OrderPolicy::class
  ];
  </code></pre>
  
  <p>I can still check the Order for another user.</p>