Authorization & policies

The Media Library uses a flexible authorization model that lets you control which users can perform which operations on files and folders. If you are upgrading from V3, your existing policies are automatically detected and bridged – no migration is required.

The V4 authorization model is built around FileAbility – an enum that represents every operation a user can perform on a file or folder. The available abilities are:

Authorization is evaluated by one or more callbacks registered on the plugin via ->authorizeUsing(). Each callback receives the ability, the authenticated user, the subject (a FileData, a Collection of FileData, a FileType, or null for context-free checks) and an optional context FileData. A callback returns true/null to allow, or false to deny. The first callback that returns false stops evaluation and denies the request; if all callbacks return null, the operation is allowed.

To authorize file and folder operations, call ->authorizeUsing() on the plugin in your panel provider and pass a closure. The closure receives four arguments:

Return false to deny the operation, or null (or nothing) to pass through to the next callback.

use RalphJSmit\Filament\MediaLibrary\FilamentMediaLibrary;
use RalphJSmit\Filament\Explore\Authorization\FileAbility;
use RalphJSmit\Filament\Explore\Data\FileData;
use Illuminate\Contracts\Auth\Authenticatable;

$panel->plugin(
    FilamentMediaLibrary::make()
        ->authorizeUsing(function (FileAbility $ability, ?Authenticatable $user, mixed $subject): ?bool {
            if ($ability === FileAbility::Delete && ! $user?->isAdmin()) {
                return false;
            }

            return null;
        }),
);

You can register multiple ->authorizeUsing() callbacks on the same plugin instance – they are evaluated in the order they were registered. The first callback to return false denies the operation immediately; all others are skipped.

FilamentMediaLibrary::make()
    ->authorizeUsing($this->authorizeViewsForGuests(...))
    ->authorizeUsing($this->authorizeDeletesForAdmins(...))

The $subject is typed as FileType|FileData|Collection|null. A Collection is passed for bulk operations. Check the type with instanceof before casting.

That's everything you need to control access to the Media Library. Use ->authorizeUsing() on the plugin for fresh V4 setups, or rely on the automatic legacy-policy bridge if you are upgrading from V3 with existing policies.

For the full upgrade checklist, see the upgrade guide.