user()->isAdmin()) { return $next($request); } abort(403, 'Unauthorized action.'); } }