Filter records based on Nova Permissions

[muhammadsaeedparacha]

Currently, nova lists all records of a selected resource.

But a User might not be able to view all records, or view any record for that matter based on Laravel Policies that Nova respects. The package should apply viewAny and view permissions from a model policy.

Not sure how to achieve this yet but I'll figure it out and create a PR

[wdelfuego]

Good point, I agree that this should be the default behavior.

I'd say the place to implement this is in MonthCalendar::allEvents; instead of adding all models to $this->allEvents directly, a check could be performed on each model before adding it. It would be nice if that check implements the policy check you mentioned and also allows the user to add additional checks in their own calendar data provider subclass.

So in MonthCalendar::allEvents I'd do something like:

foreach($models->lazy() as $model)
{
    if($this->policyAllowsView($model) && $this->shouldShow($model))
    {
        $this->allEvents[] = $this->resourceToEvent(new $novaResourceClass($model), $dateAttribute);
    }
}

policyAllowsView could be a private method that implements your solution and shouldShow could be a protected method that returns true by default but allows the developer to overwrite its behavior for custom display checks.

[wdelfuego]

NB maybe it is desirable to be able to show events in the calendar to users even though their policy disallows viewing or editing the related model. For those cases the urlForResource method should return null so the event isn't clickable for those users, but the event should still be included in the allEvents array. So it'd be nice to make your proposal the default behavior but allow the developer to explicitly configure the policies to be ignored for certain models (for example by implementing a shouldRespectPolicies(string $resourceClass) method that returns true by default).

[wdelfuego]

I have just released 1.3 that automatically excludes events from the calendar if the current user doesn't have view rights according to a Laravel policy. If no policy exists at all, all instances of the resource will be shown on the calendar.

Instead of implementing the aforementioned shouldRespectPolicies method, it respects the authorizable method that exists on Nova resource classes by default; if that method returns false, all instances of the resource will be included regardless of Laravel policies.

[alexWaterfront]

Hello, sorry in advance if that's the wrong place to submit this, i was thinking, is it possible to filter the records by using a where statement? More specifically i want to filter them by a category attribute (my resource is inspection and i want each user to see only his own inspections so something like

Inspection::whereHas('user', function ( $query){
                $query->where('user_id', Auth::user()->id);
            }))

[wdelfuego]

That's what the exclude method on your CalendarDataProvider is for :).

I think in your case you could implement it like this;

use Laravel\Nova\Resource as NovaResource;
use App\Nova\Inspection;

protected function exclude(NovaResource $resource) : bool
{
    if($resource instanceof Inspection)
    {
        return $resource->model()->user_id && ($resource->model()->user_id != Auth::user()->id);
    }
    return false;
}

[wdelfuego]

By the way, an easier and more general solution in your case would be to implement the Laravel policies for Inspection according to your use case. The calendar should respect those automatically for the logged in user.

[alexWaterfront]

That's great thank you so much for the quick response, all the best!! :)