Commentify uses Laravel policies for create, update, and delete. Pro does not invent a parallel ACL. Wire the same CommentPolicy you already use for Livewire.
Policy
Core ships a CommentPolicy. create() accepts a nullable user so guests can post when allow_guests is on. Guests still cannot update or delete.
If you copied the policy into your app, keep this signature:
The API authorizes through Gate::forUser($user) using ApiAuth::user(), so the acting user is the Pro guard — not whatever Auth::user() would be on a mis-paired api group.
Each comment in the JSON resource includes:
Those flags mirror the policy (and pin permission). Hide controls the API would reject.
Temporarily block a user from posting:
- Add a
comment_banned_until column on users (core ships a migration you can publish).
- Add the trait:
- Set
comment_banned_until to a future date.
GET ui reports auth.banned and auth.can_comment. API writes return comment_banned. Filament Pro’s Ban author action sets a 30-day ban through the same column.
Moderators
Used for pins, media rate limits, and staff badges. A user is a moderator if either:
isCommentifyModerator() on the user model returns true, or- their id is in
commentify-pro.badges.moderator_ids
ModeratorGate::role() is guest, user, or moderator and selects media.limits.*.
Unapproved comments are hidden from list endpoints, except the authenticated author’s own pending rows (VisibilityScope::applyApprovedOrOwn). The SDK sets pending: true when is_approved is false so you can show “Awaiting moderation” to that author.
Read-only mode
All write routes go through EnsureCommentifyWritable and fail with 423 / read_only. Useful for archived posts, frozen tickets, or legal holds. Last modified on September 12, 2026
