Filament•2y ago

Based on a permission, how can a user view only their own records?

If the permission is anebaled in filament shield, then you can see all records, but if its disabled then youcan only see your own records.

12 Replies

MatthewOP•2y ago

I tried using the permissions from the policies, but when diasbling "view any", I dont see anything

tesse05•2y ago

in your ModelResource, getEloquentQuery function do this:

    public static function getEloquentQuery(): Builder
    {
        $user = auth()->user();

        $query = parent::getEloquentQuery();

        if ($user->your_permission_condition) {
            return $query->where());
        }

        return $query;
    }

MatthewOP•2y ago

Im really frustrated

    public static function form(Form $form): Form
    {
        return $form
            ->schema([
                Select::make('activity_id')
                    ->label('Activity')
                    ->options(Activity::all()->pluck('name', 'id'))
                    ->searchable()
                    ->required(),
                Forms\Components\Textarea::make('description')
                    ->required()
                    ->maxLength(500),
                Forms\Components\DateTimePicker::make('date')
                    ->withoutTime()
                    ->required(),
                Forms\Components\TimePicker::make('time')
                    ->withoutDate()
                    ->withoutSeconds()
                    ->required(),
                Select::make('project_id')
                    ->label('Project')
                    ->options(Project::all()->pluck('name', 'id'))
                    ->searchable()
                    ->required(),
                Select::make('worker_user_id')
                    ->label('Worker')
                    ->options(User::all()->pluck('name', 'id'))
                    ->searchable()
                    ->required()
                    ->disabled(auth()->user()->can('view_all_registrations_time'))
                    ->default(Auth()->id()),
            ]);
    }

    public static function form(Form $form): Form
    {
        return $form
            ->schema([
                Select::make('activity_id')
                    ->label('Activity')
                    ->options(Activity::all()->pluck('name', 'id'))
                    ->searchable()
                    ->required(),
                Forms\Components\Textarea::make('description')
                    ->required()
                    ->maxLength(500),
                Forms\Components\DateTimePicker::make('date')
                    ->withoutTime()
                    ->required(),
                Forms\Components\TimePicker::make('time')
                    ->withoutDate()
                    ->withoutSeconds()
                    ->required(),
                Select::make('project_id')
                    ->label('Project')
                    ->options(Project::all()->pluck('name', 'id'))
                    ->searchable()
                    ->required(),
                Select::make('worker_user_id')
                    ->label('Worker')
                    ->options(User::all()->pluck('name', 'id'))
                    ->searchable()
                    ->required()
                    ->disabled(auth()->user()->can('view_all_registrations_time'))
                    ->default(Auth()->id()),
            ]);
    }

    public static function table(Table $table): Table
    {
        return $table
            ->columns([
                TextColumn::make('date')
                    ->date()
                    ->label('Date'),
                TextColumn::make('time')->time('H:i'),
                TextColumn::make('project.name'),
                TextColumn::make('activity.name'),
                TextColumn::make('worker.name'),
                TextColumn::make('description')
                    ->limit(10)
            ])
            ->filters([
                //
            ])
            ->actions([
                Tables\Actions\EditAction::make(),
            ])
            ->bulkActions([
                Tables\Actions\DeleteBulkAction::make(),
            ]);
    }

    public static function table(Table $table): Table
    {
        return $table
            ->columns([
                TextColumn::make('date')
                    ->date()
                    ->label('Date'),
                TextColumn::make('time')->time('H:i'),
                TextColumn::make('project.name'),
                TextColumn::make('activity.name'),
                TextColumn::make('worker.name'),
                TextColumn::make('description')
                    ->limit(10)
            ])
            ->filters([
                //
            ])
            ->actions([
                Tables\Actions\EditAction::make(),
            ])
            ->bulkActions([
                Tables\Actions\DeleteBulkAction::make(),
            ]);
    }

    public static function getEloquentQuery(): Builder
    {
        $user = auth()->user();

        $query = parent::getEloquentQuery();
        // dd($user->can('purchaser_expense'));
        if ($user->can('view_all_registrations_time')) {
            return $query->where('worker_user_id',$user->id);
        }

        return $query;
    }

    public static function getPermissionPrefixes(): array
    {
        return [
            'view',
            'view_any',
            'create',
            'update',
            'restore',
            'restore_any',
            'replicate',
            'reorder',
            'delete',
            'delete_any',
            'force_delete',
            'force_delete_any',
            'view_all_registrations'
        ];
    }

    public static function getEloquentQuery(): Builder
    {
        $user = auth()->user();

        $query = parent::getEloquentQuery();
        // dd($user->can('purchaser_expense'));
        if ($user->can('view_all_registrations_time')) {
            return $query->where('worker_user_id',$user->id);
        }

        return $query;
    }

    public static function getPermissionPrefixes(): array
    {
        return [
            'view',
            'view_any',
            'create',
            'update',
            'restore',
            'restore_any',
            'replicate',
            'reorder',
            'delete',
            'delete_any',
            'force_delete',
            'force_delete_any',
            'view_all_registrations'
        ];
    }

SOmetimes the permissions works, and other times it doesntg I do not understand why The resource is called TimeRegistrationResource For example, I am on admin_user account; it works, I switch to a filament_user account; it works, I switch back to admin_user account, and it doesnt work anymore using dd($user->can('view_all_registrations_time')), no matter if the permission is enabled or disabled on filament shield page, it always returns false, And the resource implements " HasShieldPermissions " @Dennis Koch ?