Filament•9mo ago

Model Policy on page not working

I followed this https://filamentphp.com/docs/3.x/tables/adding-a-table-to-a-livewire-component#adding-the-table to create a table inside a page. Even if I remove the header buttons: ->bulkActions([ Tables\Actions\BulkActionGroup::make([ Tables\Actions\DeleteBulkAction::make(), ]), ]); it should probably just hide the button, anyway in my case i need to show the checkboxes, so I keep the buttons for now. What i would like you to help me is apply my policy on this table. i have this: protected $policies = [ Order::class => OrderPolicy::class, ]; on OrderPolicy.php: public function delete(User $user, Order $model): bool { logger("delete"); return $user->can('SuperAdmin'); } but this method is never called when record is deleted.

Adding a table to a Livewire component - Table Builder - Filament

7 Replies

Dennis Koch•9mo ago

Bulk deleted don't follow delete policy I think. It's for single deletions

MohamedSabil83•9mo ago

Yes, as @Dennis Koch said, the bulk action delete related to deleteAny method in policy. It doesn't came by default when create the policy from command. You have to add it the policy file like following:

public function deleteAny(User $user): bool
{
    // Your condition here
}

public function deleteAny(User $user): bool
{
    // Your condition here
}

CrocoOP•9mo ago

Hmm, after several tests, this is indeed the case for resources, but not for pages, so policies are still not called. I've tried several combinations :

    public function deleteAny(User $user): bool
    { logger("DEL 1");
        return $user->can('SuperAdmin');
    }

    public function canDeleteAny(User $user): bool
    { logger("DEL 2");
        return $user->can('SuperAdmin');
    }

    public function canDelete(User $user): bool
    { logger("DEL 3");
        return $user->can('SuperAdmin');
    }

    public function forceDeleteAny(User $user): bool
    { logger("DEL 4");
        return $user->can('SuperAdmin');
    }
    public function canForceDeleteAny(User $user): bool
    { logger("DEL 5");
        return $user->can('SuperAdmin');
    }

    public function deleteAny(User $user): bool
    { logger("DEL 1");
        return $user->can('SuperAdmin');
    }

    public function canDeleteAny(User $user): bool
    { logger("DEL 2");
        return $user->can('SuperAdmin');
    }

    public function canDelete(User $user): bool
    { logger("DEL 3");
        return $user->can('SuperAdmin');
    }

    public function forceDeleteAny(User $user): bool
    { logger("DEL 4");
        return $user->can('SuperAdmin');
    }
    public function canForceDeleteAny(User $user): bool
    { logger("DEL 5");
        return $user->can('SuperAdmin');
    }

😁 I know some does not exist. My page:

class Billing extends Page implements HasForms, HasTable
{

class Billing extends Page implements HasForms, HasTable
{

I even tried to add this:

protected static bool $shouldSkipAuthorization = false;

protected static bool $shouldSkipAuthorization = false;

The only thing working is to overwrite delete Model method:

    // prevent unauthorized delete
    public function delete(){
        if (!auth()->user()->isSuperAdmin()) {
            return false;
        }
        parent::delete();
    }

    // prevent unauthorized delete
    public function delete(){
        if (!auth()->user()->isSuperAdmin()) {
            return false;
        }
        parent::delete();
    }

But this is not policy at all, I would like to make sure policy work at all time.

Dennis Koch•9mo ago

Yeah might be that policies are only attached for resources and you need to manually set authorization on custom pages

CrocoOP•9mo ago

It supposed to be attached to the model because the $policies array contains models. Should I then set authorization on page like?:

use App\Filament\Pages\Billing;
    protected $policies = [
        User::class => UserPolicy::class,
        Order::class => OrderPolicy::class,
        Billing::class => OrderPolicy::class,
    ];

use App\Filament\Pages\Billing;
    protected $policies = [
        User::class => UserPolicy::class,
        Order::class => OrderPolicy::class,
        Billing::class => OrderPolicy::class,
    ];

Because this is not working either. I'm using Order model inside Billing page.

MohamedSabil83•9mo ago

Didn't notice that you use a custom page. In that case, you have to chain ->authorize('deleteAny', YourModel::class) with your DeleteBulkAction

CrocoOP•9mo ago

Hmm, if i attach it to the button it will secure only that button , what if someone manage to send the delete request to my instance/model.

Gaming

Programming

Model Policy on page not working