Authorization

Commentify uses Laravel policies for create, update, and delete. Pro does not invent a parallel ACL. Wire the same CommentPolicy you already use for Livewire.

Policy

Core ships a CommentPolicy. create() accepts a nullable user so guests can post when allow_guests is on. Guests still cannot update or delete. If you copied the policy into your app, keep this signature:

public function create(?Authenticatable $user = null): bool

The API authorizes through Gate::forUser($user) using ApiAuth::user(), so the acting user is the Pro guard. Not whatever Auth::user() would be on a mis-paired api group. Each comment in the JSON resource includes:

"can": {
  "update": true,
  "delete": true,
  "pin": false
}

Those flags mirror the policy (and pin permission). Hide controls the API would reject.

Comment bans

Temporarily block a user from posting:

Add a comment_banned_until column on users (core ships a migration you can publish).
Add the trait:

use Usamamuneerchaudhary\Commentify\Traits\HasCommentBan;

class User extends Authenticatable
{
    use HasCommentBan;
}

Set comment_banned_until to a future date.

GET ui reports auth.banned and auth.can_comment. API writes return comment_banned. Filament Pro’s Ban author action sets a 30-day ban through the same column.

Moderators

Pins, media limits, and staff badges are Commentify Pro. The ban column and HasCommentBan trait above are part of the free package.

A moderator can pin, upload under the moderator media limits, and receive the staff badge. A user is a moderator if either:

isCommentifyModerator() on the user model returns true, or
their id is in commentify-pro.badges.moderator_ids

public function isCommentifyModerator(): bool
{
    return $this->is_admin;
}

'badges' => [
    'moderator_ids' => [1, 7],
],

ModeratorGate::role() is guest, user, or moderator and selects media.limits.*.

Visibility of pending comments

Unapproved comments are hidden from list endpoints, except the authenticated author’s own pending rows (VisibilityScope::applyApprovedOrOwn). The SDK sets pending: true when is_approved is false so you can show “Awaiting moderation” to that author.

Read-only mode

'core' => [
    'read_only' => true,
],

All write routes go through EnsureCommentifyWritable and fail with 423 / read_only. Useful for archived posts, frozen tickets, or legal holds.

Commentify

Commentify Pro

Frontends

API

Moderation

Features

Help

Policy

Comment bans

Moderators

Visibility of pending comments

Read-only mode

​Policy

​Comment bans

​Moderators

​Visibility of pending comments

​Read-only mode

Policy

Comment bans

Moderators

Visibility of pending comments

Read-only mode