add isAdmin user helper, protect users unless isAdmin

Author: Gareth Redfern

app/Http/Controllers/UserController.php

@@ -5,6 +5,7 @@
 use App\Models\User;
 use Illuminate\Http\Request;
 use App\Http\Resources\UserResource;
+use Illuminate\Support\Facades\Auth;
 
 class UserController extends Controller
 {
@@ -15,7 +16,10 @@ class UserController extends Controller
      */
     public function index()
     {
-        return UserResource::collection(User::paginate());
+        if (Auth::user()->isAdmin()) {
+            return UserResource::collection(User::paginate());
+        }
+        return  response()->json(["message" => "Forbidden"], 403);
     }
 
     /**
@@ -37,7 +41,10 @@ public function store(Request $request)
      */
     public function show(User $user)
     {
-        return new UserResource($user);
+        if (Auth::user()->isAdmin()) {
+          return new UserResource($user);
+        }
+        return  response()->json(["message" => "Forbidden"], 403);
     }
 
     /**

app/Models/User.php

@@ -40,6 +40,12 @@ class User extends Authenticatable implements MustVerifyEmail
      * @var array
      */
     protected $casts = [
+        'is_admin' => 'boolean',
         'email_verified_at' => 'datetime',
     ];
+
+    public function isAdmin(): bool
+    {
+      return $this->is_admin;
+    }
 }