Challenge 1: Write a Policy — Possible Solution
====================================================================

# php artisan make:policy AuthorPolicy --model=Author

// app/Policies/AuthorPolicy.php

namespace App\Policies;

use App\Models\Author;
use App\Models\User;

class AuthorPolicy
{
    public function update(User $user, Author $author): bool
    {
        return $user->id === $author->owner_id;
    }
}

// app/Http/Controllers/AuthorController.php

use App\Models\Author;

public function update(UpdateAuthorRequest $request, Author $author)
{
    $this->authorize('update', $author);

    $author->update($request->validated());

    return redirect()->route('authors.show', $author);
}

WHY THIS WORKS
--------------
- AuthorPolicy::update(User $user, Author $author) receives BOTH the
  currently authenticated user AND the specific Author instance being
  edited — the comparison $user->id === $author->owner_id is a genuine
  per-object check: it answers "can THIS user edit THIS specific author
  record," not just "can users in general edit authors."
- AuthorPolicy is auto-discovered because its name (AuthorPolicy) matches
  the model it authorizes (Author) by Laravel's naming convention — no
  manual registration needed in AppServiceProvider for this pairing to
  work.
- $this->authorize('update', $author) inside the controller calls
  AuthorPolicy::update() automatically, passing the currently
  authenticated user as the first argument and $author as the second —
  if it returns false, Laravel throws an AuthorizationException
  (converted to an HTTP 403) BEFORE any of the code after that line
  (like $author->update(...)) ever runs.