Laravel Policy bug | 易学教程

问题

I have used Laravel Policies successfully in the past but am having issues with one currently.

In an ArticleController I have the following method:

/**
 * Show the form for creating a new resource.
 *
 * @return \Illuminate\Http\Response
 */
public function create()
{
    $this->authorize('create', Article::class);

    $categories = $this->categories;

    return view('editable.news.create', compact('categories'));
}

My ArticlePolicy looks like this:

<?php

namespace App\Policies;

use Illuminate\Auth\Access\HandlesAuthorization;
use App\User;
use App\Article;

class ArticlePolicy
{
    use HandlesAuthorization;

    /**
     * Create a new policy instance.
     *
     * @return void
     */
    public function __construct()
    {
        //
    }

    /**
     * Determine whether the user can view the post.
     *
     * @param  \App\User $user
     * @param  \App\Post $post
     * @return mixed
     */
    public function show(User $user, Article $article)
    {
        // If the article is published
        if ($article->published) {
            return true;
        }

        // A user with permission can view unpublished articles
        if ($user->can('view unpublished articles')) {
            return true;
        }

        // Authors can view their own unpublished posts
        if ($user->username === $article->author->username) {
            return true;
        }
    }

    /**
     * Determine whether the user can create posts.
     *
     * @param  \App\User $user
     * @return mixed
     */
    public function create(User $user)
    {
        return true;
    }

    /**
     * Determine whether the user can update the post.
     *
     * @param  \App\User $user
     * @param  \App\Post $post
     * @return mixed
     */
    public function update(User $user, Article $article)
    {
        if ($user->can('edit own articles')) {
            return $user->username === $article->author->username;
        }

        if ($user->can('edit any articles')) {
            return true;
        }
    }

    /**
     * Determine whether the user can delete the post.
     *
     * @param  \App\User $user
     * @param  \App\Post $post
     * @return mixed
     */
    public function delete(User $user, Article $article)
    {
        // A user can delete their own articles
        if ($user->can('delete own articles')) {
            return $user->username === $article->author->username;
        }

        // A user with permission can delete any article
        if ($user->can('delete any articles')) {
            return true;
        }
    }
}

You can see in the create method I am just returning true, this is deliberate.

Whenever I hit the create blade I always receive a 403 error.

I also have an accompanying test:

/** @test */
public function a_user_with_permission_can_create_an_article()
{
    $this->setupPermissions();

    $user = factory(User::class)->create();

    $user->assignRole('news contributor');

    $article = factory(Article::class)->raw(['excerpt' => null]);

    $this->actingAs($user)
        ->get(route('thanos.articles.create'))
        ->assertStatus(200);

    $this->post(route('thanos.articles.store'), $article);

    $this->assertDatabaseHas('articles', [
        'user_username' => $user->username,
        'title' => $article['title']
    ]);
}

来源：https://stackoverflow.com/questions/57824918/laravel-policy-bug

标签

php

laravel