Search code examples
phplaravelpolicy

Laravel policy for editing


So I have created a policy and registered it in the AuthServicePRovider, but it always returns false. It is my first time working with policies so I am sure I am doing it wrong, but following a few examples, nothing has worked for me.

I am logged in with user that has an id of 1. I try to edit a label that has a user_id of 1, returns false, and also when trying to edit a label that has a user_id of 2. This last one works as expected, but f the user_id and label->user_id match, I should ave a form displayed. Instead, I get this each time:

This action is unauthorized.

Any ideas?

AuthServiceProvider: (Tried both but both don't work):

protected $policies = [
    'App\Label' => 'App\Policies\LabelPolicy'
];

And this one also did not do the trick:

protected $policies = [
    Label::class => LabelPolicy::class
];

LabelsController@edit:

public function edit(Label $label)
{
    // $this->authorize('edit', $label); // This also returns false

    if (auth()->user()->cannot('edit', $label)) {
        dd('NO'); // This is always shown
    }
}

LabelPolicy:

public function edit(Label $label)
{
    dd('test'); // This is never shown anywhere
    return auth()->user()->id === $label->user_id;
}

Solution

  • The policies expects actually two inputs, the first input is always the User class, the second input is the Model and defaults to the Model class. So in your case:

    LabelPolicy

    public function edit(User $user, Label $label)
    {
        return $user->id === $label->user_id;
    }
    

    LabelsController@edit:

    public function edit(Label $label)
    {
        $this->authorize($label);
    }