Skip to content

Commit b27ef84

Browse files
GautierDeleGautierDele
committed
✨ disable authorizations
1 parent d8c2ad9 commit b27ef84

File tree

13 files changed

+192
-19
lines changed

13 files changed

+192
-19
lines changed

‎README.md‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -92,5 +92,4 @@ TODO
9292
- Custom directives (Filters / sorting)
9393
- Actions / Metrics
9494
- Automatic documentation with extension possible
95-
- Add the possibility to disable authorization
9695
- Refactor the response class

‎src/Concerns/Authorizable.php‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,9 @@ trait Authorizable
1818
*/
1919
public function authorizeTo($ability, $model)
2020
{
21-
Gate::authorize($ability, $model);
21+
if ($this->isAuthorizingEnabled()) {
22+
Gate::authorize($ability, $model);
23+
}
2224
}
2325

2426
/**
@@ -30,6 +32,9 @@ public function authorizeTo($ability, $model)
3032
*/
3133
public function authorizedTo($ability, $model)
3234
{
33-
return Gate::check($ability, $model);
35+
if ($this->isAuthorizingEnabled()) {
36+
return Gate::check($ability, $model);
37+
}
38+
return true;
3439
}
3540
}

‎src/Concerns/PerformsRestOperations.php‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,7 @@ public function destroy(DestroyRequest $request) {
5555
->get();
5656

5757
foreach ($models as $model) {
58-
$this->authorizeTo('delete', $model);
58+
self::newResource()->authorizeTo('delete', $model);
5959

6060
$resource->performDelete($request, $model);
6161
}
@@ -76,7 +76,7 @@ public function restore(RestoreRequest $request) {
7676
->get();
7777

7878
foreach ($models as $model) {
79-
$this->authorizeTo('restore', $model);
79+
self::newResource()->authorizeTo('restore', $model);
8080

8181
$resource->performRestore($request, $model);
8282
}
@@ -97,7 +97,7 @@ public function forceDelete(ForceDestroyRequest $request) {
9797
->get();
9898

9999
foreach ($models as $model) {
100-
$this->authorizeTo('forceDelete', $model);
100+
self::newResource()->authorizeTo('forceDelete', $model);
101101

102102
$resource->performForceDelete($request, $model);
103103
}

‎src/Concerns/Resource/DisableAuthorizations.php‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
<?php
2+
3+
namespace Lomkit\Rest\Concerns\Resource;
4+
5+
trait DisableAuthorizations
6+
{
7+
public function isAuthorizingEnabled() : bool {
8+
return false;
9+
}
10+
}

‎src/Http/Controllers/Controller.php‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@
44

55
use Illuminate\Database\Eloquent\Builder;
66
use Illuminate\Database\Eloquent\Model;
7+
use Illuminate\Support\Facades\Gate;
78
use Lomkit\Rest\Concerns\Authorizable;
89
use Lomkit\Rest\Concerns\PerformsModelOperations;
910
use Lomkit\Rest\Concerns\PerformsRestOperations;
@@ -15,8 +16,7 @@
1516

1617
abstract class Controller extends \Illuminate\Routing\Controller
1718
{
18-
use PerformsRestOperations,
19-
Authorizable;
19+
use PerformsRestOperations;
2020

2121
/**
2222
* The resource the entry corresponds to.
@@ -39,4 +39,6 @@ public static function newResource(): Resource
3939

4040
return new $resource;
4141
}
42+
43+
//@TODO: are controllers useless in a certain way ??
4244
}

‎src/Http/Resource.php‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
namespace Lomkit\Rest\Http;
44

55
use Illuminate\Database\Eloquent\Model;
6+
use Lomkit\Rest\Concerns\Authorizable;
67
use Lomkit\Rest\Concerns\PerformsModelOperations;
78
use Lomkit\Rest\Concerns\PerformsQueries;
89
use Lomkit\Rest\Concerns\Resource\ConfiguresRestParameters;
@@ -18,7 +19,8 @@ class Resource
1819
Relationable,
1920
Paginable,
2021
Rulable,
21-
ConfiguresRestParameters;
22+
ConfiguresRestParameters,
23+
Authorizable;
2224

2325
/**
2426
* The model the entry corresponds to.
@@ -69,4 +71,8 @@ public function defaultOrderBy(RestRequest $request) {
6971
public function isAutomaticGatingEnabled() : bool {
7072
return config('rest.automatic_gates.enabled');
7173
}
74+
75+
public function isAuthorizingEnabled() : bool {
76+
return true;
77+
}
7278
}

‎src/Query/Builder.php‎

Lines changed: 1 addition & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -6,26 +6,20 @@
66
use Illuminate\Support\Str;
77
use Illuminate\Support\Traits\Conditionable;
88
use Illuminate\Support\Traits\Tappable;
9-
use Lomkit\Rest\Concerns\Authorizable;
109
use Lomkit\Rest\Contracts\QueryBuilder;
1110
use Lomkit\Rest\Http\Controllers\Controller;
1211
use Lomkit\Rest\Http\Requests\RestRequest;
1312
use Lomkit\Rest\Http\Resource;
1413
use Lomkit\Rest\Query\Traits\PerformMutation;
1514
use Lomkit\Rest\Query\Traits\PerformSearch;
16-
use Lomkit\Rest\Relations\BelongsTo;
17-
use Lomkit\Rest\Relations\BelongsToMany;
18-
use Lomkit\Rest\Relations\HasMany;
19-
use Lomkit\Rest\Relations\HasOne;
2015
use RuntimeException;
2116

2217
class Builder implements QueryBuilder
2318
{
2419
use Tappable,
2520
Conditionable,
2621
PerformSearch,
27-
PerformMutation,
28-
Authorizable;
22+
PerformMutation;
2923

3024
/**
3125
* Construct a new query builder for a resource.

‎src/Query/Traits/PerformMutation.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@ public function applyMutation(array $mutation = [], $attributes = []) {
4141
if ($mutation['operation'] === 'create') {
4242
$model = $this->resource::newModel();
4343

44-
$this->authorizeTo('create', $model);
44+
$this->resource->authorizeTo('create', $model);
4545

4646
return $this->mutateModel(
4747
$model,
@@ -53,7 +53,7 @@ public function applyMutation(array $mutation = [], $attributes = []) {
5353
if ($mutation['operation'] === 'update') {
5454
$model = $this->resource::newModel()::find($mutation['key']);
5555

56-
$this->authorizeTo('update', $model);
56+
$this->resource->authorizeTo('update', $model);
5757

5858
return $this->mutateModel(
5959
$model,

‎src/Query/Traits/PerformSearch.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111
trait PerformSearch
1212
{
1313
public function search(array $parameters = []) {
14-
$this->authorizeTo('viewAny', $this->resource::$model);
14+
$this->resource->authorizeTo('viewAny', $this->resource::$model);
1515

1616
$this->resource->searchQuery(app()->make(RestRequest::class), $this->queryBuilder);
1717

‎tests/Feature/Controllers/NoAuthorizationTest.php‎

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
<?php
2+
3+
namespace Lomkit\Rest\Tests\Feature\Controllers;
4+
5+
use Illuminate\Support\Carbon;
6+
use Illuminate\Support\Facades\Gate;
7+
use Lomkit\Rest\Http\Requests\RestRequest;
8+
use Lomkit\Rest\Tests\Feature\TestCase;
9+
use Lomkit\Rest\Tests\Support\Database\Factories\BelongsToManyRelationFactory;
10+
use Lomkit\Rest\Tests\Support\Database\Factories\BelongsToRelationFactory;
11+
use Lomkit\Rest\Tests\Support\Database\Factories\HasManyRelationFactory;
12+
use Lomkit\Rest\Tests\Support\Database\Factories\HasOneRelationFactory;
13+
use Lomkit\Rest\Tests\Support\Database\Factories\ModelFactory;
14+
use Lomkit\Rest\Tests\Support\Database\Factories\SoftDeletedModelFactory;
15+
use Lomkit\Rest\Tests\Support\Models\BelongsToManyRelation;
16+
use Lomkit\Rest\Tests\Support\Models\BelongsToRelation;
17+
use Lomkit\Rest\Tests\Support\Models\Model;
18+
use Lomkit\Rest\Tests\Support\Models\SoftDeletedModel;
19+
use Lomkit\Rest\Tests\Support\Policies\CreatePolicy;
20+
use Lomkit\Rest\Tests\Support\Policies\DeletePolicy;
21+
use Lomkit\Rest\Tests\Support\Policies\ForceDeletePolicy;
22+
use Lomkit\Rest\Tests\Support\Policies\GreenPolicy;
23+
use Lomkit\Rest\Tests\Support\Policies\RedPolicy;
24+
use Lomkit\Rest\Tests\Support\Policies\RestorePolicy;
25+
use Lomkit\Rest\Tests\Support\Policies\UpdatePolicy;
26+
use Lomkit\Rest\Tests\Support\Policies\ViewPolicy;
27+
use Lomkit\Rest\Tests\Support\Rest\Resources\AutomaticGatingResource;
28+
use Lomkit\Rest\Tests\Support\Rest\Resources\BelongsToManyResource;
29+
use Lomkit\Rest\Tests\Support\Rest\Resources\BelongsToResource;
30+
use Lomkit\Rest\Tests\Support\Rest\Resources\HasManyResource;
31+
use Lomkit\Rest\Tests\Support\Rest\Resources\HasOneResource;
32+
use Lomkit\Rest\Tests\Support\Rest\Resources\ModelResource;
33+
use Lomkit\Rest\Tests\Support\Rest\Resources\NoAuthorizationResource;
34+
use Lomkit\Rest\Tests\Support\Rest\Resources\NoExposedFieldsResource;
35+
use Lomkit\Rest\Tests\Support\Rest\Resources\SoftDeletedModelResource;
36+
37+
class NoAuthorizationTest extends TestCase
38+
{
39+
public function test_searching_with_no_authorizations(): void
40+
{
41+
$model = ModelFactory::new()
42+
->create();
43+
44+
Gate::policy(Model::class, RedPolicy::class);
45+
46+
$response = $this->post(
47+
'/api/no-authorization/search',
48+
[],
49+
['Accept' => 'application/json']
50+
);
51+
52+
$this->assertResourcePaginated(
53+
$response,
54+
[$model],
55+
new NoAuthorizationResource
56+
);
57+
}
58+
59+
public function test_mutating_with_no_authorizations(): void
60+
{
61+
$modelToCreate = ModelFactory::new()->makeOne();
62+
63+
Gate::policy(Model::class, RedPolicy::class);
64+
65+
$response = $this->post(
66+
'/api/no-authorization/mutate',
67+
[
68+
'mutate' => [
69+
[
70+
'operation' => 'create',
71+
'attributes' => [
72+
'name' => $modelToCreate->name,
73+
'number' => $modelToCreate->number
74+
]
75+
],
76+
],
77+
],
78+
['Accept' => 'application/json']
79+
);
80+
81+
$this->assertMutatedResponse(
82+
$response,
83+
[$modelToCreate],
84+
);
85+
}
86+
87+
public function test_deleting_with_no_authorizations(): void
88+
{
89+
$model = ModelFactory::new()->count(1)->createOne();
90+
91+
Gate::policy(Model::class, RedPolicy::class);
92+
93+
$response = $this->delete(
94+
'/api/no-authorization',
95+
[
96+
'resources' => [$model->getKey()]
97+
],
98+
['Accept' => 'application/json']
99+
);
100+
101+
$this->assertResourceModel($response, [$model], new ModelResource);
102+
$this->assertDatabaseMissing('models', $model->only('id'));
103+
}
104+
}

0 commit comments

Comments
 (0)