Class LaravelUi5\OData\Http\ReadGate

The read-authorization gate: authorize a plan, then execute it.

Shared by the direct read path ({@see \LaravelUi5\OData\Http\Controller\OData::forService}) and each $batch inner request, so both enforce identically:

• a hard denial (a primary / root target) → {@see ForbiddenException} (403);
  • a gated $expand → pruned from the plan + a sap-messages warning on the 200;
  • otherwise → served as-is.

For a $batch inner request the outer $batch Request is passed: the plan is inner-specific and the actor is request-scoped, so per-set gating is correct — an enforcer decides off the plan and the actor, never Request::path().