laravel - Best way of protecting the show() method against users accessing other users messages -

ok, have basic messaging system, have relationship set can call $user->messages retrieve array of users inbox messages. have simple show method grabs message id passed show() function.

the question best way protect messages/2 url user couldn't type number in url , access users messages.

should use route filter , run query ensure message id accessible user or there can relationship, perhaps check id against messages array , if exists user must have access?

public function up()     {         schema::create('messages', function(blueprint $table) {             $table->increments('id');             $table->mediumtext('subject');             $table->text('message');             $table->boolean('draft');             $table->integer('sender_id')->unsigned();             $table->softdeletes();             $table->timestamps();              $table->foreign('sender_id')->references('id')->on('users')->onupdate('cascade');         });          schema::create('message_assets', function(blueprint $table) {             $table->increments('id');             $table->integer('message_id')->unsigned();             $table->string('filename', 255);             $table->softdeletes();              $table->foreign('message_id')->references('id')->on('messages')->onupdate('cascade');         });          schema::create('message_users', function(blueprint $table) {             $table->increments('id');             $table->integer('message_id')->unsigned();             $table->integer('user_id')->unsigned();             $table->integer('read')->default(0);             $table->string('folder', 255)->nullable();             $table->softdeletes();              $table->foreign('message_id')->references('id')->on('messages')->onupdate('cascade');             $table->foreign('user_id')->references('id')->on('users')->onupdate('cascade');         });     } 

in simplest form, in messagescontroller in show method, can add additional parameter query , record message_id = paramater url , user_id on message authenticated user's id.... like

$message = app\message::where('id', '=', $id)                       ->where('user_id', '=', auth::user()->id)                       ->first(); 

if doing more advanced design , have messagerepository, logic extracted there in controller like

$this->repository->getbyid($id); 

and in messages repository getbyid() method similar above code example using eloquent model. method allows controller clean , logic re-used elsewhere in app if needed

added work pivot table specified above. work user has message in inbox:

db::table('messages')     ->join('message_users', 'messages.id', '=', 'message_users.message_id')     ->where('message_users.message_id', $id)     ->where('message_users.user_id', $userid)     ->where('message_users.deleted_at', null)     ->select('messages.*')     ->first();