Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.

BladeOfGaladrial's avatar

Conflict Between Gate::before and Policy before Method in Laravel RBAC

I am using spatie/laravel-permission to implement RBAC on my application. I have made 2 roles (for now) namely Super Admin and Content where Super admin will have permission to do everything while Content role (with permission 'view_model') will only have permissions give to it by super admin.

I in boot() method of AppServiceProvider have following config

Gate::before(function ($user, $ability) {
    return $user->hasRole("Super Admin") ? true : null;
});

in my blade views I am using @can() helpers.

To make my backend secure, my routes are defined as following

Route::controller(ModelAdminController::class)->group(function () {
        Route::get('/models', 'index')->name('model.index')->middleware('can:view_model');
});

Now while all of this works as intended I also have defined ModelPolicy inside app\Policy and I quite cannot understand what's going on, reading from the package documentation's best practices section it insists on using ModelPolicy, but when I do define a before() method in-side as such

class ModelPolicy //extends SuperAdminPolicyGrant /* Planning to extarct before method in a seperate class */
{
    /**
     * Determine whether the user can view the model.
     */
    public function view(User $user): bool
    {
        return $user->can('view_model');
    }

    public function before (User $user, string $abilities): ?bool
    {
        
        if($user->hasRole("Super Admin"))
        {
            return true;
        }
        
        return null;
    }
}

The user with role "Super Admin" gets 403. What's happening here?

0 likes
0 replies

Please or to participate in this conversation.