Laravel政策访客用户

Question

I have the following Policy:

<?php

namespace App\Policies;

use App\Models\User;
use Illuminate\Auth\Access\HandlesAuthorization;

class EventPolicy
{
    use HandlesAuthorization;

    /**
     * Determine whether the user can view the whole model.
     *
     * @param User $user
     * @return boolean
     */
    public function list(?User $user) {
        return true;
    }

}

AuthServiceProvider contains the correct binding:

protected $policies = [
    Event::class => EventPolicy::class,
];

In my controller:

public function index() {
    $this->authorize('list');
    return $this->repository->paginate();
}

This return a 403 Forbidden response:

This action is unauthorized.

Laravel documentation states that you can make the user declaring the User optional or setting a default null value. I have tried both to no avail.

I'm running v5.8

Any ideas?

Answer 1

This is probably an internal misbehavior of Laravel because the logic is somehow broken (it is just an assumption).

In this particular case, you shouldn't add any authorization policy for listing, since everyone is allowed to see the results.

So you should simply do it like:

public function index()
{
    return $this->repository->paginate();
}

Define policies only if the users should be actually authorized to do something.

Later edit : is it possible that in the service provider you imported the Event class from Laravel instead of the Event model?