Conflict Between Gate::before and Policy before Method in Laravel RBAC
I am using spatie/laravel-permission to implement RBAC on my application.
I have made 2 roles (for now) namely Super Admin and Content where Super admin will have permission to do everything while Content role (with permission 'view_model') will only have permissions give to it by super admin.
I in boot() method of AppServiceProvider have following config
Gate::before(function ($user, $ability) {
return $user->hasRole("Super Admin") ? true : null;
});
in my blade views I am using @can() helpers.
To make my backend secure, my routes are defined as following
Route::controller(ModelAdminController::class)->group(function () {
Route::get('/models', 'index')->name('model.index')->middleware('can:view_model');
});
Now while all of this works as intended I also have defined ModelPolicy inside app\Policy and I quite cannot understand what's going on, reading from the package documentation's best practices section it insists on using ModelPolicy, but when I do define a before() method in-side as such
class ModelPolicy //extends SuperAdminPolicyGrant /* Planning to extarct before method in a seperate class */
{
/**
* Determine whether the user can view the model.
*/
public function view(User $user): bool
{
return $user->can('view_model');
}
public function before (User $user, string $abilities): ?bool
{
if($user->hasRole("Super Admin"))
{
return true;
}
return null;
}
}
The user with role "Super Admin" gets 403. What's happening here?
Please or to participate in this conversation.