laravel / nova-issues

553 stars 34 forks source link

Policy not applied when `public static $model` overridden in resource #1985

Closed Anticom closed 5 years ago

Anticom commented 5 years ago

Description

When overriding public static $model so that the resource name and model names differ, policies seem to not be applied to that resource.

Steps To Reproduce

Create a model

<?php

namespace App;

use Illuminate\Database\Eloquent\Model;

class TheModel extends Model
{
}

Create a resource for it

<?php

namespace App\Nova;

use Laravel\Nova\Fields\ID;
use Illuminate\Http\Request;
use Laravel\Nova\Http\Requests\NovaRequest;

class TheResource extends Resource
{
    /**
     * The model the resource corresponds to.
     *
     * @var string
     */
    public static $model = 'App\TheModel';

    /**
     * The single value that should be used to represent the resource when being displayed.
     *
     * @var string
     */
    public static $title = 'id';

    /**
     * The columns that should be searched.
     *
     * @var array
     */
    public static $search = ['id'];

    /**
     * Get the fields displayed by the resource.
     *
     * @param  \Illuminate\Http\Request  $request
     * @return array
     */
    public function fields(Request $request)
    {
        return [
            ID::make()->sortable(),
        ];
    }

    /**
     * Get the cards available for the request.
     *
     * @param  \Illuminate\Http\Request  $request
     * @return array
     */
    public function cards(Request $request)
    {
        return [];
    }

    /**
     * Get the filters available for the resource.
     *
     * @param  \Illuminate\Http\Request  $request
     * @return array
     */
    public function filters(Request $request)
    {
        return [];
    }

    /**
     * Get the lenses available for the resource.
     *
     * @param  \Illuminate\Http\Request  $request
     * @return array
     */
    public function lenses(Request $request)
    {
        return [];
    }

    /**
     * Get the actions available for the resource.
     *
     * @param  \Illuminate\Http\Request  $request
     * @return array
     */
    public function actions(Request $request)
    {
        return [];
    }
}

Create a policy for that model

<?php

namespace App\Policies;

use App\User;
use App\TheModel;
use Illuminate\Auth\Access\HandlesAuthorization;

class TheModelPolicy
{
    use HandlesAuthorization;

    /**
     * Determine whether the user can view any booths.
     *
     * @param  \App\User  $user
     * @return mixed
     */
    public function viewAny(User $user)
    {
        return false;
    }

    // ...
}

Register it in AuthServiceProvider

Then if you open up nova the resource doesn't seem to be protected by the policy.

Anticom commented 5 years ago

This can be closed, i targeted the wrong model.