為什么我的 Laravel 策略總是返回 false？

Question

該政策的代碼在這里：

class userOwnedClassPolicy
{
    use HandlesAuthorization;
    ...
    public function create(User $user)
    {
        return ($user->userType == 'teacher');
    }
    ...
}

因此，此策略已在AuthServiceProvider.php文件中注冊：

class AuthServiceProvider extends ServiceProvider
{
    //Map models to authorization policies.
    protected $policies = [
        App\Models\classMember::class => App\Policies\classMemberPolicy::class,
        App\Models\evaluation::class => App\Policies\evaluationPolicy::class,
        App\Models\group::class => App\Policies\groupPolicy::class,
        App\Models\groupMember::class => App\Policies\groupMemberPolicy::class,
        App\Models\sharedClass::class => App\Policies\sharedClassPolicy::class,
        App\Models\slg::class => App\Policies\slgPolicy::class,
        App\Models\spreadsheet::class => App\Policies\spreadsheetPolicy::class,
        App\Models\spreadsheetValue::class => App\Policies\spreadsheetValuePolicy::class,
        App\Models\teacher::class => App\Policies\teacherPolicy::class,
        App\Models\test::class => App\Policies\testPolicy::class,
        App\Models\userOwnedClass::class => App\Policies\userOwnedClassPolicy::class
    ];

    public function boot()
    {
        $this->registerPolicies();
    }
}

（我也嘗試過使用文件路徑的字符串來注冊策略，但這沒有任何效果。）

controller代碼的相關部分在這里：

class ClassController extends Controller
{
    ...
    public function store(Request $postReq)
    {
        $this->authorize('create', Auth::user());
        userOwnedClass::create([
            'name' => $postReq->input('className'),
            'ownerId' => Auth::user()->id
        ]);
    }
    ...
}

我嘗試用return true替換策略的create方法中的代碼，但即使這樣也失敗了。 我做錯了什么，為什么 controller 在調用時總是返回 403 錯誤？

Answer 1

當您創建策略userOwnedClassPolicy並將其設置為userOwnedClass中的AuthServiceProvider時：

App\Models\userOwnedClass::class => App\Policies\userOwnedClassPolicy::class

你不能只運行策略方法：

$this->authorize('create', Auth::user());

當您在上面運行此行時，您會告訴 - 檢查\App\Models\User object 的策略的create方法，但您沒有為此 model 創建任何策略。

所以在這種情況下，你應該像這樣運行它：

$this->authorize('create', \App\Models\userOwnedClass::class);

然后 Laravel 將知道它應該從userOwnedClassPolicy策略運行create方法，它會自動將當前經過身份驗證的用戶傳遞給策略方法中的$user變量。