{"action":"created","issue":{"url":"https://api.github.com/repos/laravel/nova-issues/issues/247","repository_url":"https://api.github.com/repos/laravel/nova-issues","labels_url":"https://api.github.com/repos/laravel/nova-issues/issues/247/labels{/name}","comments_url":"https://api.github.com/repos/laravel/nova-issues/issues/247/comments","events_url":"https://api.github.com/repos/laravel/nova-issues/issues/247/events","html_url":"https://github.com/laravel/nova-issues/issues/247","id":354334995,"node_id":"MDU6SXNzdWUzNTQzMzQ5OTU=","number":247,"title":"Unable to allow attach{Model} whilst disallowing create on BelongsToMany relationship","user":{"login":"bencounsell","id":418008,"node_id":"MDQ6VXNlcjQxODAwOA==","avatar_url":"https://avatars2.githubusercontent.com/u/418008?v=4","gravatar_id":"","url":"https://api.github.com/users/bencounsell","html_url":"https://github.com/bencounsell","followers_url":"https://api.github.com/users/bencounsell/followers","following_url":"https://api.github.com/users/bencounsell/following{/other_user}","gists_url":"https://api.github.com/users/bencounsell/gists{/gist_id}","starred_url":"https://api.github.com/users/bencounsell/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bencounsell/subscriptions","organizations_url":"https://api.github.com/users/bencounsell/orgs","repos_url":"https://api.github.com/users/bencounsell/repos","events_url":"https://api.github.com/users/bencounsell/events{/privacy}","received_events_url":"https://api.github.com/users/bencounsell/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2018-08-27T14:10:01Z","updated_at":"2018-08-29T08:53:26Z","closed_at":null,"author_association":"NONE","body":"I want to allow the attachment of a BelongsToMany field, but at the same time disallow creation of the BelongsToMany model by certain users.\r\n\r\nI have the following setup:\r\n\r\n**Models**\r\n- Product\r\n- Category\r\n- Product belongs to many categories.\r\n\r\nI am using Laravel Policy classes to grant/deny permissions on both models. I have read the docs on granting permissions for relationships - using the `attach{Model}` and `detach{Model}` works as expected.\r\n\r\nI run into trouble as soon as I create a CategoryPolicy and return false from `create` method — this removes the \"Attach Category\" button from the Product details page.\r\n\r\nI don't want all users to create new Categories (only admins can do that). However, all users should be allowed to attach existing categories to products.\r\n\r\n**Policies**\r\nProductPolicy.php\r\n\r\n```\r\n    public function attachCategory(User $user, Product $product, Category $category)\r\n    {\r\n        return true;\r\n    }\r\n\r\n    public function detachCategory(User $user, Product $product, Category $category)\r\n    {\r\n        return true;\r\n    }\r\n```\r\n\r\nCategoryPolicy.php\r\n\r\n```\r\n    public function create(User $user)\r\n    {\r\n        return $user->isAdmin();\r\n    }\r\n```\r\n\r\nThis restricts the creation of categories to only admin users — however, it stops the ability for all users to attach and detach categories.\r\n\r\nReturning true from the CategoryPolicy's create method brings the \"Attach Category\" functionality back, but obviously allows categories to be created by anyone.\r\n\r\nI know I could add a layer of validation to the Category creation, to only allows a new category to be saved by certain users, however that would still allow any user access to the category creation form.\r\n\r\nIs there a way to only allow the creation of categories by certain users, but still allow the attachment of categories by any user?"},"comment":{"url":"https://api.github.com/repos/laravel/nova-issues/issues/comments/416877265","html_url":"https://github.com/laravel/nova-issues/issues/247#issuecomment-416877265","issue_url":"https://api.github.com/repos/laravel/nova-issues/issues/247","id":416877265,"node_id":"MDEyOklzc3VlQ29tbWVudDQxNjg3NzI2NQ==","user":{"login":"bencounsell","id":418008,"node_id":"MDQ6VXNlcjQxODAwOA==","avatar_url":"https://avatars2.githubusercontent.com/u/418008?v=4","gravatar_id":"","url":"https://api.github.com/users/bencounsell","html_url":"https://github.com/bencounsell","followers_url":"https://api.github.com/users/bencounsell/followers","following_url":"https://api.github.com/users/bencounsell/following{/other_user}","gists_url":"https://api.github.com/users/bencounsell/gists{/gist_id}","starred_url":"https://api.github.com/users/bencounsell/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bencounsell/subscriptions","organizations_url":"https://api.github.com/users/bencounsell/orgs","repos_url":"https://api.github.com/users/bencounsell/repos","events_url":"https://api.github.com/users/bencounsell/events{/privacy}","received_events_url":"https://api.github.com/users/bencounsell/received_events","type":"User","site_admin":false},"created_at":"2018-08-29T08:53:26Z","updated_at":"2018-08-29T08:53:26Z","author_association":"NONE","body":"Pretty sure this is a dupe of #111 "}}
{"actor":{"display_login":"bencounsell"}}