[5.7] Authorize Middleware Doesn't Accept String Parameters

[damiankloip]

When using authorization gates, they can be used with arbitrary parameters that aren't necessarily models. E.g.

In blade templates:

@can('ability', 'some_value')

And, as middleware via authorize in controllers:

$this->authorize('ability', 'some_value')

However, when trying to do that at the route middleware level, the Authorize middleware always assumes the parameter will be a model. So it's not possible to do the following:

Route::middleware('can:ability,some_value')

This breaks currently as getGateArguments (and then getModel) assumes the parameter will be a model (or class name) and tries to resolve it from route parameters as so. So the above example would be turned into an array of arguments like [null] instead.

This can be solved quite simply by passing the $model value as the default value to the route() call.

It doesn't seem like this should cause any existing breakage, as it currently returns an array of null values in this case. Tests also don't fail with the change - only with the new test case added here (before the fix). This also makes the behaviour more consist across all usage.

[TBlindaruk]

Could you add test like:

1. The route has parameter document
2. You pass the value document for some_value

[damiankloip]

Thanks @TBlindaruk - do you mean like 2aa094d ? So we pass a parameter, get that back and is available in the ability callback.

[TBlindaruk]

yes, like this, but I`m not sure if it is good behavior

[damiankloip]

This behaviour already exists though? If you had a parameter on the route, the existing code calling route() would already return this anyway. The new test method added doesn't really test the change with the default value but the current logic.

[lucasmichot]

I guess this is actually the other way round ;-)
$this->assertEquals('success', $response->content());

[damiankloip]

Happy to change this, every other assertion like this in the file is $this->assertEquals($response->content(), 'success') though.

[lucasmichot]

same

[emiliopedrollo]

This change broke our code.

We had something like this:

Route::get('/{forum}/{post}/{comment}')->middleware(['can:view,comment,forum,post']);
Route::get('/allforums/{post}/{comment}')->middleware(['can:view,comment,null,post']);

and on our Policy:

public function view(User $user, Comment $comment, Forum $forum = null, Post $post = null) {
    ...
}

And then when someone accessed the second rout the forum parameter would be null and now it becomes a string 'null' instead triggering a FatalThrowableError exception as the argument accepts either a Forum model or a null value.