Filament•8mo ago

createOptionForm not adhering to model policies

So, I've just created a new model, and policy for the model. Added the table/column through migrations. Now, when I add the means to add this to the main Resource, I get the option to add a related record, but even though I have permisisons set in the DB, and the model policy in place (no permissions from the policy granted) I am able to add new related models. Is this intended? I'm thinking it shouldn't be? Code to create the Option Form:

Select::make('industry_id')
    ->relationship('industry', 'name')
    ->searchable()
    ->preload()
    ->createOptionForm([
        TextInput::make('name')
            ->required(),
    ]),

Select::make('industry_id')
    ->relationship('industry', 'name')
    ->searchable()
    ->preload()
    ->createOptionForm([
        TextInput::make('name')
            ->required(),
    ]),

With this, I am able to create Industries regardless of whether the user I'm logged in as has any of the permissions.

1 Reply

DomThomas•7mo ago

Yes, for this sample, I do this :

Select::make('industry_id')
    ->relationship('industry', 'name')
    ->searchable()
    ->preload()
    ->createOptionForm([
        TextInput::make('name')
            ->required(),
    ])
    ->createOptionAction(fn (Forms\Components\Actions\Action $action) => 
   $action->authorize('create',Industry::class))

Select::make('industry_id')
    ->relationship('industry', 'name')
    ->searchable()
    ->preload()
    ->createOptionForm([
        TextInput::make('name')
            ->required(),
    ])
    ->createOptionAction(fn (Forms\Components\Actions\Action $action) => 
   $action->authorize('create',Industry::class))

Gaming

Programming

createOptionForm not adhering to model policies