{"action":"created","issue":{"url":"https://api.github.com/repos/laravel/ideas/issues/1222","repository_url":"https://api.github.com/repos/laravel/ideas","labels_url":"https://api.github.com/repos/laravel/ideas/issues/1222/labels{/name}","comments_url":"https://api.github.com/repos/laravel/ideas/issues/1222/comments","events_url":"https://api.github.com/repos/laravel/ideas/issues/1222/events","html_url":"https://github.com/laravel/ideas/issues/1222","id":331596843,"node_id":"MDU6SXNzdWUzMzE1OTY4NDM=","number":1222,"title":"Allow Anonymous / Guest policy checks","user":{"login":"garygreen","id":1702638,"node_id":"MDQ6VXNlcjE3MDI2Mzg=","avatar_url":"https://avatars2.githubusercontent.com/u/1702638?v=4","gravatar_id":"","url":"https://api.github.com/users/garygreen","html_url":"https://github.com/garygreen","followers_url":"https://api.github.com/users/garygreen/followers","following_url":"https://api.github.com/users/garygreen/following{/other_user}","gists_url":"https://api.github.com/users/garygreen/gists{/gist_id}","starred_url":"https://api.github.com/users/garygreen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/garygreen/subscriptions","organizations_url":"https://api.github.com/users/garygreen/orgs","repos_url":"https://api.github.com/users/garygreen/repos","events_url":"https://api.github.com/users/garygreen/events{/privacy}","received_events_url":"https://api.github.com/users/garygreen/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2018-06-12T13:50:51Z","updated_at":"2018-06-12T19:50:21Z","closed_at":null,"author_association":"NONE","body":"## The problem\r\n\r\nAt the moment, if you don't have an authed user all policy checks will be skipped and authorization is always denied:\r\n\r\n```php\r\n// No authed user, so the policy check isn't even called (Auth::user() = null)\r\nGate::allows('view', $picture);\r\n\r\nclass PicturePolicy {\r\n\r\n    public function view(User $user, Picture $picture)\r\n    {\r\n        // Won't be called.\r\n    }\r\n\r\n}\r\n```\r\n\r\nYou can get around this by using a `null-object` pattern and passing a blank user to be checked:\r\n\r\n```php\r\n// Policy check will be called.\r\n// You can test for anonymous by doing $user->exists in your policy.\r\nGate::forUser(Auth::user() ?? new User)->allows('view', $picture);\r\n```\r\n\r\nHowever this breaks down when you use things like blade directives:\r\n\r\n```php\r\n// Policy won't be called, again.\r\n@can('view', $picture)\r\n```\r\n\r\n## Current Solution\r\n\r\nYou could solve this by doing the above - manually passing a null user, but with that you need to be aware across your whole codebase which policy checks accepts anonymous users. Or you could have the permission logic exist on your model, but then that defeats the purpose of having separate logic for checking of permissions in your policies.\r\n\r\n### Proposed Solution\r\n\r\nAllow policies to be defined as accepting a `null` User.\r\n\r\nYou hint to the gate which policies accept anonymous user checks:\r\n\r\n```php\r\n// Allow anonymous check for specific policy and method\r\nGate::acceptsAnonymousCheck('App\\Policies\\PicturePolicy@view');\r\n\r\n// Allow anonymous check for whole policy\r\nGate::acceptsAnonymousCheck('App\\Policies\\PicturePolicy');\r\n\r\n// Allow anonymous checks for all policies.\r\nGate::acceptsAnonymousCheck(true);\r\n\r\nclass PicturePolicy {\r\n\r\n    public function view(User $user = null, Picture $picture)\r\n    {\r\n         if (is_null($user)) {\r\n            // Anonymous user.\r\n        }\r\n    }\r\n\r\n}\r\n```"},"comment":{"url":"https://api.github.com/repos/laravel/ideas/issues/comments/396711689","html_url":"https://github.com/laravel/ideas/issues/1222#issuecomment-396711689","issue_url":"https://api.github.com/repos/laravel/ideas/issues/1222","id":396711689,"node_id":"MDEyOklzc3VlQ29tbWVudDM5NjcxMTY4OQ==","user":{"login":"garygreen","id":1702638,"node_id":"MDQ6VXNlcjE3MDI2Mzg=","avatar_url":"https://avatars2.githubusercontent.com/u/1702638?v=4","gravatar_id":"","url":"https://api.github.com/users/garygreen","html_url":"https://github.com/garygreen","followers_url":"https://api.github.com/users/garygreen/followers","following_url":"https://api.github.com/users/garygreen/following{/other_user}","gists_url":"https://api.github.com/users/garygreen/gists{/gist_id}","starred_url":"https://api.github.com/users/garygreen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/garygreen/subscriptions","organizations_url":"https://api.github.com/users/garygreen/orgs","repos_url":"https://api.github.com/users/garygreen/repos","events_url":"https://api.github.com/users/garygreen/events{/privacy}","received_events_url":"https://api.github.com/users/garygreen/received_events","type":"User","site_admin":false},"created_at":"2018-06-12T19:50:21Z","updated_at":"2018-06-12T19:50:21Z","author_association":"NONE","body":"@koenhoeijmakers see here for example use cases: https://github.com/laravel/framework/pull/20660#issuecomment-396629249\r\n\r\nLooks like there has been various PRs done but Taylor has rejected them all (not necessarily because anonymous / guest checks shouldn't be added, but implementation details are tricky)\r\n"}}
{"actor":{"display_login":"garygreen"}}