checkDeleteAllowed & checkUpdateAllowed

src/actions/DeleteAction.php

@@ -37,6 +37,11 @@ class DeleteAction extends JsonApiAction
      */
     public $scenario = Model::SCENARIO_DEFAULT;
 
+    /**
+     * @var callable|null a PHP callable that checks if deletion is allowed.
+     */
+    public $checkDeleteAllowed;
+
     /**
      * @var callable|Closure Callback after save model with all relations
      * @example
@@ -80,6 +85,10 @@ public function run($id):void
             call_user_func($this->checkAccess, $this->id, $model);
         }
 
+        if ($this->checkDeleteAllowed) {
+            call_user_func($this->checkDeleteAllowed, $this->id, $model);
+        }
+
         if ($model->delete() === false) {
             throw new ServerErrorHttpException('Failed to delete the object for unknown reason.');
         }

src/actions/UpdateAction.php

@@ -66,6 +66,12 @@ class UpdateAction extends JsonApiAction
      *  ```
      */
     public $scenario = Model::SCENARIO_DEFAULT;
+
+    /**
+     * @var callable|null a PHP callable that checks if updating is allowed.
+     */
+    public $checkUpdateAllowed;
+
     /**
      * @var callable|Closure Callback after save model with all relations
      * @example
@@ -74,6 +80,7 @@ class UpdateAction extends JsonApiAction
      * }
      */
     public $afterSave = null;
+
     /**
      * @throws \yii\base\InvalidConfigException
      */
@@ -113,6 +120,10 @@ public function run($id):Item
             call_user_func($this->checkAccess, $this->id, $model);
         }
 
+        if ($this->checkUpdateAllowed) {
+            call_user_func($this->checkUpdateAllowed, $this->id, $model);
+        }
+
         $originalModel = clone $model;
         RelationshipManager::validateRelationships($model, $this->getResourceRelationships(), $this->allowedRelations);
         if (empty($this->getResourceAttributes()) && $this->hasResourceRelationships()) {