> ## Documentation Index
> Fetch the complete documentation index at: https://docs.commentify.pro/llms.txt
> Use this file to discover all available pages before exploring further.

# Authorization

> Laravel policies, comment bans, and how Pro decides who may pin or upload as a moderator.

Commentify uses Laravel policies for create, update, and delete. Pro does not invent a parallel ACL. Wire the same `CommentPolicy` you already use for Livewire.

## Policy

Core ships a `CommentPolicy`. `create()` accepts a nullable user so guests can post when `allow_guests` is on. Guests still cannot update or delete.

If you copied the policy into your app, keep this signature:

```php theme={null}
public function create(?Authenticatable $user = null): bool
```

The API authorizes through `Gate::forUser($user)` using `ApiAuth::user()`, so the acting user is the Pro guard — not whatever `Auth::user()` would be on a mis-paired `api` group.

Each comment in the JSON resource includes:

```json theme={null}
"can": {
  "update": true,
  "delete": true,
  "pin": false
}
```

Those flags mirror the policy (and pin permission). Hide controls the API would reject.

## Comment bans

Temporarily block a user from posting:

1. Add a `comment_banned_until` column on `users` (core ships a migration you can publish).
2. Add the trait:

```php theme={null}
use Usamamuneerchaudhary\Commentify\Traits\HasCommentBan;

class User extends Authenticatable
{
    use HasCommentBan;
}
```

3. Set `comment_banned_until` to a future date.

`GET ui` reports `auth.banned` and `auth.can_comment`. API writes return `comment_banned`. Filament Pro's **Ban author** action sets a 30-day ban through the same column.

## Moderators

Used for pins, media rate limits, and staff badges. A user is a moderator if either:

* `isCommentifyModerator()` on the user model returns true, or
* their id is in `commentify-pro.badges.moderator_ids`

```php theme={null}
public function isCommentifyModerator(): bool
{
    return $this->is_admin;
}
```

```php theme={null}
'badges' => [
    'moderator_ids' => [1, 7],
],
```

`ModeratorGate::role()` is `guest`, `user`, or `moderator` and selects `media.limits.*`.

## Visibility of pending comments

Unapproved comments are hidden from list endpoints, except the authenticated author's own pending rows (`VisibilityScope::applyApprovedOrOwn`). The SDK sets `pending: true` when `is_approved` is false so you can show "Awaiting moderation" to that author.

## Read-only mode

```php theme={null}
'core' => [
    'read_only' => true,
],
```

All write routes go through `EnsureCommentifyWritable` and fail with `423` / `read_only`. Useful for archived posts, frozen tickets, or legal holds.