Hiding menu from sidebar by policy - problem with relations.

Hi! It's me again :-) Problem for today: I created policy rules for all the resources that I planned to hide - I used viewAny -> true if the user has permission to see them. Only superAdmin can see all of them. But at the same time, if the hidden resource is associated with a resource that is not hidden, the field with the associated resource (relationship belongs to) disappeared. So I gave access to these resources to a user who can only handle part of the backend, and the related fields show up, but the resource is displayed in the sidebar. Is there any way to hide resource from sidebar and in the same time show it in the fields, and in the same time restrict resource that is not viewable for users they have no access to particular resource?

philipbaginski

6 years ago

Level 2

I used code:

public static function availableForNavigation(Request $request)
{
    return $request->user()->can('superAdmin');
}

, so other users can not see resource in the sidebar. But if they will provide url with resource address, the resource is viewable. Is there any solution to make it better?

alaa_elshekh

6 years ago

Level 2

Hi have you tried this in resource public static $displayInNavigation = false;

philipbaginski

6 years ago

Level 2

Of course. But the problem is: I have to hide it from sidebar for non administrator users. That is easy:

public static function availableForNavigation(Request $request) { return $request->user()->can('superAdmin'); }

But I have a user e.g. Shop Manager, which is going to have an access only to Shop resource, with all rights to manage this resourse. Before I did it with policy file, but I realised that if I will cut access by 'viewAny' to the resource, this resource will not show up in other resource e.g. If for user Shop Manager I will cut access to Location resource (he does not need to see this resource), in the same time Shop resource will not show Location on the index page or detail page. Right now I have control over viewable resources, I can hide recource link from sidebar, but still there is an access to the resource by url address.

Please or to participate in this conversation.