Laravel policy return unauthorized

Question

I am trying to implement policies in my project. All tries have proven unsuccessful despite following documentation to the letter. And also read numerous posts on SO about it and other media. I did as described in docs, but nonetheless it doesn't work. What gives?

In AuthServiceProvider:

<?php

namespace App\Providers;

use App\User;
use App\Job;
use App\Policies\JobPolicy;

use Illuminate\Foundation\Support\Providers\AuthServiceProvider as ServiceProvider;
use Illuminate\Support\Facades\Gate;

class AuthServiceProvider extends ServiceProvider
{
    /**
     * The policy mappings for the application.
     *
     * @var array
     */
    protected $policies = [
        'App\Job' => 'App\Policies\JobPolicy',
        //Job::class => JobPolicy::class,
    ];

    /**
     * Register any authentication / authorization services.
     *
     * @return void
     */
    public function boot()
    {
        $this->registerPolicies();

        //
    }
}

In policy:

<?php

namespace App\Policies;

use App\Job;
use App\User;
use Illuminate\Auth\Access\HandlesAuthorization;

class JobPolicy
{
    use HandlesAuthorization;

    /**
     * Determine whether the user can view any jobs.
     *
     * @param  \App\User  $user
     * @return mixed
     */
    public function viewAny(User $user,Job $job)
    {
        //return (($user->isAdmin() || $user->isModerator() || $user->isUser()) && $user->status==1);
        //return ($user->isMod());
        return true;
    }

In controller:

public function index()
    {
        $this->authorize('viewAny', User::class, Job::class);
        return view("jobs.index");
    }

My User model:

<?php

namespace App;

use Illuminate\Contracts\Auth\MustVerifyEmail;
use Illuminate\Foundation\Auth\User as Authenticatable;
use Illuminate\Notifications\Notifiable;
use App\Role;

class User extends Authenticatable
{
    use Notifiable;

    /**
     * The attributes that are mass assignable.
     *
     * @var array
     */
    protected $fillable = [
        'name', 'email', 'password',"role_id"
    ];

    /**
     * The attributes that should be hidden for arrays.
     *
     * @var array
     */
    protected $hidden = [
        'password', 'remember_token',
    ];

    /**
     * The attributes that should be cast to native types.
     *
     * @var array
     */
    protected $casts = [
        'email_verified_at' => 'datetime',
    ];

    public function role(){
        return $this->belongsTo("App\Role", "role_id");
    }

    public function isMod()
    {
        $user = User::find(auth()->user()->id);
        $role = $user->role()->first()->name;

        if($role==="job board moderator"){
            return true;
        }
        else{
            return false;
        }

    }

}

And Job model:

<?php

namespace App;

use Illuminate\Database\Eloquent\Model;
use App\User;

class Job extends Model
{
    protected $fillable = [
        "title", "description", "email"
    ];

    public function user(){
        return $this->belongsTo("App\User","user_id");
    }

}

Roman Meyer · Accepted Answer · 2019-11-08T12:10:01.367

3

In policy:

public function viewAny(User $user)
{
  return true;
}

In controller:

public function index()
{
  $this->authorize('viewAny', Job::class);

  return view("jobs.index");
}

edited Nov 08 '19 at 12:10

answered Nov 08 '19 at 11:55

Roman Meyer

2,634
2
20
27

i've updated answer. try now. `$this->authorize` should check current user in background – Roman Meyer Nov 08 '19 at 12:05
Ha! It works! But why does it? Considering that i passing through `authorize` model class, but method in policy receives as a argument instance of User? I don't see that kind stuff in docs. How? What? ... – Veljko Stefanovic Nov 08 '19 at 12:14
if it solved your problem, please mark answer as correct. all magic doing laravel itself, you can read more here https://laravel.com/docs/5.7/container – Roman Meyer Nov 08 '19 at 12:17

Augusto Moura · Answer 2 · 2019-11-08T12:38:09.257

2

The way to call a model policy method changes depending on the number of parameters it has.

No object

/* In policy*/ 
public function viewAny(User $user)

/* In controller */ 
$this->authorize('viewAny', Job::class)`

1 object

/* In policy*/ 
public function view(User $user, Job $job)

/* In controller */ 
$this->authorize('view', $job)

More than 1 object

/* In policy*/ 
public function view(User $user, Job $job, AnotherModel $model)

/* In controller */ 
$this->authorize('view', [$job, $model])

Source: https://laravel.com/docs/5.8/authorization#creating-policies

edited Nov 08 '19 at 12:38

answered Nov 08 '19 at 12:29

Augusto Moura

1,224
7
17

So basically, to method in policy as argument a instance of what is going to be evaluated i.e. user if is he an admin for example, and in you pass to `authorize` as argument a model of what to be allowed to be accessed if condition in policy itself is met? Is my understanding right? – Veljko Stefanovic Nov 08 '19 at 12:43

Laravel policy return unauthorized

2 Answers2