Filament•4mo ago

createOptionForm not checking policys

Hi! I'm developing a Process management system. Each ticket has a "label" (urgent, need help, etc) If a user has not the role to create a label, the select label with a createOptionForm allows the user to create a label, it does not check the policy of the model. How can I solve this?

5 Replies

LeandroFerreira•4mo ago

fn() => auth()->user()->can('xx') ? Ticketlabel::createForm() : null ?

PabloZagniOP•4mo ago

Shows an empty form

403gtfo•4mo ago

@PabloZagni Did you manage to find a solution to this? I've just realized the huge security hole I introduce due to this :S Ah just worked out: My solution for my country field The button still appears but action is blocked.

Select::make('country_id')->relationship('country', 'name')
  ->rules(['integer', 'exists:countries,id'])
  ->searchable()
  ->preload()
  ->createOptionForm(
    fn(Request $request) => (
      $request->user()->cannot('create', Country::class)) ? abort(403) : CountryResource::formFields()
  ),

Select::make('country_id')->relationship('country', 'name')
  ->rules(['integer', 'exists:countries,id'])
  ->searchable()
  ->preload()
  ->createOptionForm(
    fn(Request $request) => (
      $request->user()->cannot('create', Country::class)) ? abort(403) : CountryResource::formFields()
  ),

kirakatou•4mo ago

@J H u can use when for visibility

Select::make('country_id')->relationship('country', 'name')
  ->rules(['integer', 'exists:countries,id'])
  ->searchable()
  ->preload()
  ->when(auth()->user()->can('create', Country::class), function ($field) {
      return $field->createOptionForm(fn() => CountryResource::formFields());
  })

Select::make('country_id')->relationship('country', 'name')
  ->rules(['integer', 'exists:countries,id'])
  ->searchable()
  ->preload()
  ->when(auth()->user()->can('create', Country::class), function ($field) {
      return $field->createOptionForm(fn() => CountryResource::formFields());
  })

PabloZagniOP•4mo ago

I'm very happy to contribute! I'll try your code

Gaming

Programming

createOptionForm not checking policys