Laravel Policies with Many-to-Many relationship

Question

Role and Permission are two models and since they have many-to-many relationship, I have an intermediate table called permission_role table. But this doesn't have a Model. I am trying to attach a Permission to a Role . But $this->authorize('create', RolePermission::class); always fails with error "This action is unauthorized."

Route :

Route::post('/rolepermissions/{role}/addpermission', 'RolePermissionController@store')
       ->name('rolepermission.store');

RolePermissionController :

public function store(StoreRolePermission $request, Role $role)

{
    $this->authorize('create', RolePermission::class);

    ...
}

RolePermissionPolicy :

public function create(User $user)
{
    if (($user->usertype == 'ADMIN') || ($user->usertype == 'SUPERADMIN'))
    {
        return true;
    }
    else
    {
        return false;
    }
}

Is it because the intermediate table does not have an associated Model?

Answer 1

I had a similar scenario, and I'm doing:

Auth:user()->can('create', RolePermission::class); , instead of authorize.

I think (have not tested) you can also do:

$this->authorize('create', [RolePermission::class, Auth::user()]) . The second argument in the array will get passed as the only param in your policy.

I'm very new to Laravel, I got some help to solve a similar issue, hope this works for you.