Possible to register a policy without a model?

You can have policy method without model https://laravel.com/docs/master/authorization#methods-without-models

@jdillon Policies are meant to dictate access to models. How can you have a policy without a corresponding model? What is a policy for if not a model?

@keizah Thank you for the reply! I understand that it's possible to call an authorization method without passing in a model.

What I'm actually asking is if it's possible to register a Policy in the $policies array in AuthServiceProvider somehow without registering a model along with it. After having another look at the documentation, I think I need to use A Gate

@martinbean Being relatively new to Laravel, my initial understanding was that policies were for Authorization in general, but my understanding is incomplete. As I mentioned in another reply, it seems like I need to leverage Gatesto meet my need. Thoughts on this approach?

@jdillon You’ve not actually said what it is you’re trying to do, so can’t really advise.

If you explain what it is you’re trying to achieve, I’d be able to point you in the right direction.

@martinbean Ultimately I want to grant authorization to entities within an application. Some entities have corresponding models, but there are also certain entities, more like actions, I guess, that I want to authorize, and in that case there isn't a model I can register with a policy.

My initial question was if it was possible to register a policy in the $policies array somehow without a model associated with it (or even if it made sense to do so), so that along with entities that have models, I could also authorize certain application actions.

Your response above essentially answered my question, and prompted me to re-read the authorization docs where I saw this approach: Gate::define('update-post', 'App\Policies\PostPolicy@update');. I think this meets my need as I can define various Gates in AuthServiceProvider that call the various methods of a Policy class and then call $this->authorize in controller methods. So in essence, I am able to use a Policy class, without necessarily providing a model.

Again, I'm new to laravel, so any thoughts on this approach are welcome!

@jdillon I still don’t really follow if I’m honest. Policies dictate if an entity can perform an action. They’re not used to determine if an “action” can perform… an action? As you see, that makes no sense.

Think of policies like this: “can X do Y?” If you let us know what “X” is in your application, then we can probably point you in the direction of the most appropriate authorisation strategy.

@martinbean I apologize if I'm not being clear here, and I appreciate your time. X would be a user, but Y could be a CRUD operation, or something else that requires business logic to determine if a user has authorization to perform a certain action.

Use a gate or work out the logic:

pseudocode

public function makeInvoice()
    {
        if (a required role of bkeep is not true here) {   // bkeep = bookkeeper
            return redirect('somewhere); // whereever you redirect to if not authorized
        }
        // Rest of method here is accomplished if 
        // the logged in used has the required role of 'bkeep'.
    }

A spatie example I saw a while back:

public function update(Request $request, Post $post) {
    if ($post->author !== auth()->user()->id || auth()->user()->cannot('edit posts'))
        abort(404);// or redirect, or whatever action 
    }
    //rest of method if all okay
}

But you still also have to have code to make sure someone does not change something in the url. Meaning the Auth::user()->id matches an FK.

And you need to use a scope to ensure user is seeing only their data and admin can see all or more.

RBAC involves several steps.

In addition to J5Dev answer, if you want to keep your rules as a Policy, you can do this:

// App\Providers\AuthServiceProvider.php
public function boot()
{
    $this->registerPolicies();

    Gate::define('clearCache', [CachePolicy::class, 'clearCache']);
}

In this example, CachePolicy has no model.

Then, call it in your controller:

public function clearCache() {
  if (! Gate::allows('clearCache')) {
    abort(403, "Not allowed");
  }
  /* ... */
}

I like this structure because it keeps all your authorization rules in one place: the App/Policies folder.