In this episode, we make sure that our link ordering logic only applies to the links that belong to the currently logged-in user. It wouldn't make much sense (or be very secure) to update the order of all the links globally – each user should only be able to change the order of their own links, right?
We start by looking into the setNewOrder method we're using from our package. This method is already pretty flexible, and we explore how we can add further constraints to its query. You’ll see how we demo this by creating a new item ("item x") for another user and checking what happens in the database when we try to reorder stuff.
Next, we leverage the query builder callback within setNewOrder to add a where clause, making sure that only the current user's links are considered when updating orders. To do this, we quickly set up the relationship between Link and User using Eloquent. Once that's done and the callback is set, our reordering only affects the correct user's links.
To finish up, we discuss why this is so important, especially when user controllable data (like in a Livewire setup) is involved. Without proper scoping, someone could try to reorder or mess around with someone else's links just by tampering with the data sent from the front-end. With this fix, we're protected against that kind of misuse!