authorize('view', $group); abort_unless((int) $asset->group_id === (int) $group->id, 404); abort_unless($asset->canBeViewedBy($request->user()), 403); return $this->assets->downloadResponse($asset); } }