// if post isn't found by $id, show 404
$post = Post::findOrFail($id);

// if user isn't owner of post, show 403
if (!Auth::user() || Auth::user()->id != $post->user_id) {
    abort(403);
}

return view('post-edit',compact('post'));