starred/panel-pelican-dev
1
0
Fork 0
mirror of https://github.com/pelican-dev/panel.git synced 2026-05-04 18:00:48 +03:00
Code Issues 41 Packages Projects Releases 10 Wiki Activity

Move to Policies #475

New Issue
Closed
opened 2026-02-05 17:39:47 +03:00 by OVERLORD · 1 comment
OVERLORD commented 2026-02-05 17:39:47 +03:00
Owner
Copy Link

Originally created by @rmartinoscar on GitHub (Oct 25, 2025).

Overriding the can*() authorization methods on a Resource, RelationManager or ManageRelatedRecords class

Although these methods, such as canCreate(), canViewAny() and canDelete()weren’t documented, if you’re overriding those to provide custom authorization logic in v3, you should be aware that they aren’t always called in v4. The authorization logic has been improved to properly support policy response objects, and these methods were too simple as they are just able to return booleans.

If you can make the authorization customization inside the policy of the model instead, you should do that. If you need to customize the authorization logic in the resource or relation manager class, you should override the get*AuthorizationResponse() methods instead, such as getCreateAuthorizationResponse(), getViewAnyAuthorizationResponse() and getDeleteAuthorizationResponse(). These methods are called when the authorization logic is executed, and they return a policy response object. If you remove the override for the can*() methods, the get*AuthorizationResponse() methods will be used to determine the authorization response boolean, so you don't have to maintain the logic twice.

Source

Originally created by @rmartinoscar on GitHub (Oct 25, 2025). > Overriding the `can*()` authorization methods on a `Resource`, `RelationManager` or `ManageRelatedRecords` class</span> > > Although these methods, such as `canCreate()`, `canViewAny()` and `canDelete()`weren’t documented, if you’re overriding those to provide custom authorization logic in v3, you should be aware that they aren’t always called in v4. The authorization logic has been improved to properly support [policy response objects](https://laravel.com/docs/authorization#policy-responses), and these methods were too simple as they are just able to return booleans. > > If you can make the authorization customization inside the policy of the model instead, you should do that. If you need to customize the authorization logic in the resource or relation manager class, you should override the `get*AuthorizationResponse()` methods instead, such as `getCreateAuthorizationResponse()`, `getViewAnyAuthorizationResponse()` and `getDeleteAuthorizationResponse()`. These methods are called when the authorization logic is executed, and they return a [policy response object](https://laravel.com/docs/authorization#policy-responses). If you remove the override for the `can*()` methods, the `get*AuthorizationResponse()` methods will be used to determine the authorization response boolean, so you don't have to maintain the logic twice. [Source](https://filamentphp.com/docs/4.x/upgrade-guide#low-impact-changes)
OVERLORD commented 2026-02-05 17:39:51 +03:00
Author
Owner
Copy Link

@rmartinoscar commented on GitHub (Oct 25, 2025):

Since Database has a Policy its trying to use it and prevents the subusers from creating them in the client area

@rmartinoscar commented on GitHub (Oct 25, 2025): Since Database has a Policy its trying to use it and prevents the subusers from creating them in the client area
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
not confirmed
pull-request
Mirrored from GitHub Pull Request
 👑 sponsor
💰 fund
🔴 hard
🟡 medium
🟡 medium
🟡 medium
🟢 easy
🟢 easy
🟢 easy
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
OVERLORD
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/panel-pelican-dev#475
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?