You could have hooked into the PostPolicy::like method using our Extend\Policy extender. That would have the added benefit of automatically hiding the button to unauthorized users in the UI, and not triggering the event at all.
That policy doesn't really "exist" by default, because Flarum checks like policy on Post, which defaults to PostPolicy::can(), which defaults to DiscussionPolicy::<ability>Posts(), which defaults to DiscussionPolicy::can(), which defaults to User::hasPermission(). But extensions can hook into any of those steps, like for example my (outdated) lock-likes extension which hooks into DiscussionPolicy::likePosts().
