How to secure that a user can edit only their own ticket

Question

So if a user wants to edit their own ticket they can do it from a form. But if they change the ID in the form, they can also edit another user's ticket. How do I prevent this?

public function edit(Ticket $ticket)
{
    $user = request()->user()->ticket()->get();

    if ($ticket === $user){
        return view('users.tickets.edit',['ticket' => $ticket,]);
    }
    else{
        abort(403);
    }
}

It automatically pick abort 403

This is the user Model

public function ticket(){
    return $this->belongsToMany(Ticket::class, 'ticket_user');
}

This is the ticket model

public function users() {
    return $this->belongsToMany(User::class, 'ticket_user');
}

Answer 1

The logic itself could look like this:

$ticket->users->contains($request->user())

In your controller it could look like this:

use Illuminate\Http\Request;

public function edit(Request $request, Ticket $ticket)
{
    if (! $ticket->users->contains($request->user())) {
        return abort(403);
    }
  
    return view('users.tickets.edit', [
        'ticket' => $ticket
    ]);
}

Docs for Collection::contains.

I suggest looking into how you could exclude your authorisation logic into gates and policies.

Answer 2

The right implementation for me looks like this.

The models:

*User
 id
 ...

*Ticket
 id
 ...

 UserTicket
 *id
 *ticket_id
 *user_id
 

When you create a ticket you have to create a new UserTicket for any user is able to edit the ticket.

Then you check if there is a record in UserTicket that has the user_id.

For example:

The Ticket model

public function users()
{
    return $this->hasManyThrough(UserTicket::class, User::class);
}

And the edit controller

public function edit(Ticket $ticket)
{
    $currentUser = request()->user();
    $ticketUsers = $ticket->users;

    // loop each ticketUser and check their id == $currentUser->id

}