Return default for certain includes

[vincent-lu]

Hi I'm trying to implement an access control feature for my app with spatie/laravel-query-builder.

Currently the app works fine when we request /products?include=stocks (Product HasOne Stocks), the relationship is defined in Product Model like this:

public function stocks(): HasOne
{
    return $this->hasOne(ProductStock::class)->withDefault(['store1' => 0, 'store2' => 0, 'store3' => 0]);
}

Now what I want is if for certain users, I do not want to return the actual stocks data (but still return the base product data in products table), instead just return the default value defined above. Although if getting the data from withDefault is too difficult I don't mind define the default somewhere else.

I have a few ideas to do this but they all have some drawbacks:

1. Implement a http middleware and remove include values from request (for restricted users), so they never get passed to spatie/laravel-query-builder. But I'm not sure the best way to inject the default values for the include model (e.g. the default for stocks).

2. Remove stocks from allowedIncludes for the restricted users, obviously this leads to Spatie\QueryBuilder\Exceptions\InvalidIncludeQuery Exception when the request url is /products?include=stocks, and then catch this Exception in controller action, and again, somehow inject the default value for stocks and return the response.

3. Since most of my controller actions return Eloquent API Resources, I could check permission in the resources and remove data as I see fit. This happens quite late and is quite wasteful.

Has anyone implemented something similar, and how do you return the default for restricted includes?

Many thanks.