Use Policies rather then overriding can*() functions (#1837)

Co-authored-by: Boy132 <mail@boy132.de>

app/Filament/Admin/Resources/DatabaseHosts/DatabaseHostResource.php

@@ -91,7 +91,7 @@ class DatabaseHostResource extends Resource
             ->checkIfRecordIsSelectableUsing(fn (DatabaseHost $databaseHost) => !$databaseHost->databases_count)
             ->recordActions([
                 ViewAction::make()
-                    ->hidden(fn ($record) => static::canEdit($record)),
+                    ->hidden(fn ($record) => static::getEditAuthorizationResponse($record)->allowed()),
                 EditAction::make(),
             ])
             ->groupedBulkActions([

app/Filament/Admin/Resources/Mounts/MountResource.php

@@ -95,7 +95,7 @@ class MountResource extends Resource
             ])
             ->recordActions([
                 ViewAction::make()
-                    ->hidden(fn ($record) => static::canEdit($record)),
+                    ->hidden(fn ($record) => static::getEditAuthorizationResponse($record)->allowed()),
                 EditAction::make(),
             ])
             ->groupedBulkActions([

app/Filament/Admin/Resources/Roles/RoleResource.php

@@ -97,7 +97,7 @@ class RoleResource extends Resource
             ])
             ->recordActions([
                 ViewAction::make()
-                    ->hidden(fn ($record) => static::canEdit($record)),
+                    ->hidden(fn ($record) => static::getEditAuthorizationResponse($record)->allowed()),
                 EditAction::make(),
             ])
             ->checkIfRecordIsSelectableUsing(fn (Role $role) => !$role->isRootAdmin() && $role->users_count <= 0)

app/Filament/Admin/Resources/Users/UserResource.php

@@ -130,7 +130,7 @@ class UserResource extends Resource
             ])
             ->recordActions([
                 ViewAction::make()
-                    ->hidden(fn ($record) => static::canEdit($record)),
+                    ->hidden(fn ($record) => static::getEditAuthorizationResponse($record)->allowed()),
                 EditAction::make(),
             ])
             ->checkIfRecordIsSelectableUsing(fn (User $user) => user()?->id !== $user->id && !$user->servers_count)

app/Filament/Admin/Resources/Webhooks/WebhookResource.php

@@ -97,7 +97,7 @@ class WebhookResource extends Resource
             ])
             ->recordActions([
                 ViewAction::make()
-                    ->hidden(fn (WebhookConfiguration $record) => static::canEdit($record)),
+                    ->hidden(fn (WebhookConfiguration $record) => static::getEditAuthorizationResponse($record)->allowed()),
                 EditAction::make(),
                 ReplicateAction::make()
                     ->iconButton()

app/Filament/Server/Resources/Activities/ActivityResource.php

@@ -6,7 +6,6 @@ use App\Filament\Admin\Resources\Users\Pages\EditUser;
 use App\Filament\Components\Tables\Columns\DateTimeColumn;
 use App\Filament\Server\Resources\Activities\Pages\ListActivities;
 use App\Models\ActivityLog;
-use App\Models\Permission;
 use App\Models\Role;
 use App\Models\Server;
 use App\Models\User;
@@ -164,11 +163,6 @@ class ActivityResource extends Resource
             });
     }
 
-    public static function canViewAny(): bool
-    {
-        return user()?->can(Permission::ACTION_ACTIVITY_READ, Filament::getTenant());
-    }
-
     /** @return array<string, PageRegistration> */
     public static function getDefaultPages(): array
     {

app/Filament/Server/Resources/Allocations/AllocationResource.php

@@ -23,7 +23,6 @@ use Filament\Tables\Columns\IconColumn;
 use Filament\Tables\Columns\TextColumn;
 use Filament\Tables\Columns\TextInputColumn;
 use Filament\Tables\Table;
-use Illuminate\Database\Eloquent\Model;
 
 class AllocationResource extends Resource
 {
@@ -122,26 +121,6 @@ class AllocationResource extends Resource
             ]);
     }
 
-    public static function canViewAny(): bool
-    {
-        return user()?->can(Permission::ACTION_ALLOCATION_READ, Filament::getTenant());
-    }
-
-    public static function canCreate(): bool
-    {
-        return user()?->can(Permission::ACTION_ALLOCATION_CREATE, Filament::getTenant());
-    }
-
-    public static function canEdit(Model $record): bool
-    {
-        return user()?->can(Permission::ACTION_ALLOCATION_UPDATE, Filament::getTenant());
-    }
-
-    public static function canDelete(Model $record): bool
-    {
-        return user()?->can(Permission::ACTION_ALLOCATION_DELETE, Filament::getTenant());
-    }
-
     /** @return array<string, PageRegistration> */
     public static function getDefaultPages(): array
     {

app/Filament/Server/Resources/Backups/BackupResource.php

@@ -40,7 +40,6 @@ use Filament\Support\Enums\IconSize;
 use Filament\Tables\Columns\IconColumn;
 use Filament\Tables\Columns\TextColumn;
 use Filament\Tables\Table;
-use Illuminate\Database\Eloquent\Model;
 use Illuminate\Http\Client\ConnectionException;
 use Illuminate\Http\Request;
 use Symfony\Component\HttpKernel\Exception\HttpException;
@@ -298,21 +297,6 @@ class BackupResource extends Resource
             ]);
     }
 
-    public static function canViewAny(): bool
-    {
-        return user()?->can(Permission::ACTION_BACKUP_READ, Filament::getTenant());
-    }
-
-    public static function canCreate(): bool
-    {
-        return user()?->can(Permission::ACTION_BACKUP_CREATE, Filament::getTenant());
-    }
-
-    public static function canDelete(Model $record): bool
-    {
-        return user()?->can(Permission::ACTION_BACKUP_DELETE, Filament::getTenant());
-    }
-
     /** @return array<string, PageRegistration> */
     public static function getDefaultPages(): array
     {

app/Filament/Server/Resources/Databases/DatabaseResource.php

@@ -31,7 +31,6 @@ use Filament\Schemas\Schema;
 use Filament\Support\Enums\IconSize;
 use Filament\Tables\Columns\TextColumn;
 use Filament\Tables\Table;
-use Illuminate\Database\Eloquent\Model;
 use Illuminate\Support\Str;
 
 class DatabaseResource extends Resource
@@ -210,31 +209,6 @@ class DatabaseResource extends Resource
             ]);
     }
 
-    public static function canViewAny(): bool
-    {
-        return user()?->can(Permission::ACTION_DATABASE_READ, Filament::getTenant());
-    }
-
-    public static function canView(Model $record): bool
-    {
-        return user()?->can(Permission::ACTION_DATABASE_READ, Filament::getTenant());
-    }
-
-    public static function canCreate(): bool
-    {
-        return user()?->can(Permission::ACTION_DATABASE_CREATE, Filament::getTenant());
-    }
-
-    public static function canEdit(Model $record): bool
-    {
-        return user()?->can(Permission::ACTION_DATABASE_UPDATE, Filament::getTenant());
-    }
-
-    public static function canDelete(Model $record): bool
-    {
-        return user()?->can(Permission::ACTION_DATABASE_DELETE, Filament::getTenant());
-    }
-
     /** @return array<string, PageRegistration> */
     public static function getDefaultPages(): array
     {

app/Filament/Server/Resources/Files/FileResource.php

@@ -7,14 +7,11 @@ use App\Filament\Server\Resources\Files\Pages\EditFiles;
 use App\Filament\Server\Resources\Files\Pages\ListFiles;
 use App\Filament\Server\Resources\Files\Pages\SearchFiles;
 use App\Models\File;
-use App\Models\Permission;
 use App\Traits\Filament\BlockAccessInConflict;
 use App\Traits\Filament\CanCustomizePages;
 use App\Traits\Filament\CanCustomizeRelations;
-use Filament\Facades\Filament;
 use Filament\Resources\Pages\PageRegistration;
 use Filament\Resources\Resource;
-use Illuminate\Database\Eloquent\Model;
 
 class FileResource extends Resource
 {
@@ -30,26 +27,6 @@ class FileResource extends Resource
 
     protected static bool $isScopedToTenant = false;
 
-    public static function canViewAny(): bool
-    {
-        return user()?->can(Permission::ACTION_FILE_READ, Filament::getTenant());
-    }
-
-    public static function canCreate(): bool
-    {
-        return user()?->can(Permission::ACTION_FILE_CREATE, Filament::getTenant());
-    }
-
-    public static function canEdit(Model $record): bool
-    {
-        return user()?->can(Permission::ACTION_FILE_UPDATE, Filament::getTenant());
-    }
-
-    public static function canDelete(Model $record): bool
-    {
-        return user()?->can(Permission::ACTION_FILE_DELETE, Filament::getTenant());
-    }
-
     /** @return array<string, PageRegistration> */
     public static function getDefaultPages(): array
     {

app/Filament/Server/Resources/Schedules/ScheduleResource.php

@@ -13,7 +13,6 @@ use App\Filament\Server\Resources\Schedules\Pages\ListSchedules;
 use App\Filament\Server\Resources\Schedules\Pages\ViewSchedule;
 use App\Filament\Server\Resources\Schedules\RelationManagers\TasksRelationManager;
 use App\Helpers\Utilities;
-use App\Models\Permission;
 use App\Models\Schedule;
 use App\Traits\Filament\BlockAccessInConflict;
 use App\Traits\Filament\CanCustomizePages;
@@ -26,7 +25,6 @@ use Filament\Actions\CreateAction;
 use Filament\Actions\DeleteAction;
 use Filament\Actions\EditAction;
 use Filament\Actions\ViewAction;
-use Filament\Facades\Filament;
 use Filament\Forms\Components\Select;
 use Filament\Forms\Components\TextInput;
 use Filament\Forms\Components\Toggle;
@@ -46,7 +44,6 @@ use Filament\Support\Exceptions\Halt;
 use Filament\Tables\Columns\IconColumn;
 use Filament\Tables\Columns\TextColumn;
 use Filament\Tables\Table;
-use Illuminate\Database\Eloquent\Model;
 use Illuminate\Support\HtmlString;
 use Throwable;
 
@@ -64,26 +61,6 @@ class ScheduleResource extends Resource
 
     protected static string|\BackedEnum|null $navigationIcon = 'tabler-clock';
 
-    public static function canViewAny(): bool
-    {
-        return user()?->can(Permission::ACTION_SCHEDULE_READ, Filament::getTenant());
-    }
-
-    public static function canCreate(): bool
-    {
-        return user()?->can(Permission::ACTION_SCHEDULE_CREATE, Filament::getTenant());
-    }
-
-    public static function canEdit(Model $record): bool
-    {
-        return user()?->can(Permission::ACTION_SCHEDULE_UPDATE, Filament::getTenant());
-    }
-
-    public static function canDelete(Model $record): bool
-    {
-        return user()?->can(Permission::ACTION_SCHEDULE_DELETE, Filament::getTenant());
-    }
-
     /**
      * @throws Exception
      */
@@ -357,7 +334,8 @@ class ScheduleResource extends Resource
                     ->state(fn (Schedule $schedule) => $schedule->status === ScheduleStatus::Active ? $schedule->next_run_at : null),
             ])
             ->recordActions([
-                ViewAction::make(),
+                ViewAction::make()
+                    ->hidden(fn ($record) => static::getEditAuthorizationResponse($record)->allowed()),
                 EditAction::make(),
                 DeleteAction::make()
                     ->after(function (Schedule $schedule) {

app/Filament/Server/Resources/Users/UserResource.php

@@ -37,7 +37,6 @@ use Filament\Support\Enums\IconSize;
 use Filament\Tables\Columns\ImageColumn;
 use Filament\Tables\Columns\TextColumn;
 use Filament\Tables\Table;
-use Illuminate\Database\Eloquent\Model;
 
 class UserResource extends Resource
 {
@@ -63,26 +62,6 @@ class UserResource extends Resource
         return $server->subusers->count();
     }
 
-    public static function canViewAny(): bool
-    {
-        return user()?->can(Permission::ACTION_USER_READ, Filament::getTenant());
-    }
-
-    public static function canCreate(): bool
-    {
-        return user()?->can(Permission::ACTION_USER_CREATE, Filament::getTenant());
-    }
-
-    public static function canEdit(Model $record): bool
-    {
-        return user()?->can(Permission::ACTION_USER_UPDATE, Filament::getTenant());
-    }
-
-    public static function canDelete(Model $record): bool
-    {
-        return user()?->can(Permission::ACTION_USER_DELETE, Filament::getTenant());
-    }
-
     public static function defaultTable(Table $table): Table
     {
         /** @var Server $server */

app/Policies/Admin/ApiKeyPolicy.php

@@ -1,6 +1,6 @@
 <?php
 
-namespace App\Policies;
+namespace App\Policies\Admin;
 
 class ApiKeyPolicy
 {

app/Policies/Admin/DatabaseHostPolicy.php

@@ -1,6 +1,6 @@
 <?php
 
-namespace App\Policies;
+namespace App\Policies\Admin;
 
 use App\Models\DatabaseHost;
 use App\Models\User;

app/Policies/Admin/DefaultPolicies.php

@@ -1,6 +1,6 @@
 <?php
 
-namespace App\Policies;
+namespace App\Policies\Admin;
 
 use App\Models\User;
 use Illuminate\Database\Eloquent\Model;

app/Policies/Admin/EggPolicy.php

@@ -1,6 +1,6 @@
 <?php
 
-namespace App\Policies;
+namespace App\Policies\Admin;
 
 class EggPolicy
 {

app/Policies/Admin/MountPolicy.php

@@ -1,6 +1,6 @@
 <?php
 
-namespace App\Policies;
+namespace App\Policies\Admin;
 
 use App\Models\Mount;
 use App\Models\User;

app/Policies/Admin/NodePolicy.php

@@ -1,6 +1,6 @@
 <?php
 
-namespace App\Policies;
+namespace App\Policies\Admin;
 
 use App\Models\Node;
 use App\Models\User;

app/Policies/Admin/RolePolicy.php

@@ -1,6 +1,6 @@
 <?php
 
-namespace App\Policies;
+namespace App\Policies\Admin;
 
 class RolePolicy
 {

app/Policies/Admin/ServerPolicy.php

@@ -0,0 +1,10 @@
+<?php
+
+namespace App\Policies\Admin;
+
+class ServerPolicy
+{
+    use DefaultPolicies;
+
+    protected string $modelName = 'server';
+}

app/Policies/Admin/UserPolicy.php

@@ -1,6 +1,6 @@
 <?php
 
-namespace App\Policies;
+namespace App\Policies\Admin;
 
 use App\Models\User;
 use Illuminate\Database\Eloquent\Model;

app/Policies/Admin/WebhookConfigurationPolicy.php

@@ -1,6 +1,6 @@
 <?php
 
-namespace App\Policies;
+namespace App\Policies\Admin;
 
 class WebhookConfigurationPolicy
 {

app/Policies/DatabasePolicy.php

@@ -1,10 +0,0 @@
-<?php
-
-namespace App\Policies;
-
-class DatabasePolicy
-{
-    use DefaultPolicies;
-
-    protected string $modelName = 'database';
-}

app/Policies/Server/ActivityLogPolicy.php

@@ -0,0 +1,21 @@
+<?php
+
+namespace App\Policies\Server;
+
+use App\Models\Permission;
+use App\Models\User;
+use Filament\Facades\Filament;
+use Illuminate\Database\Eloquent\Model;
+
+class ActivityLogPolicy
+{
+    public function viewAny(User $user): bool
+    {
+        return $user->can(Permission::ACTION_ACTIVITY_READ, Filament::getTenant());
+    }
+
+    public function view(User $user, Model $model): bool
+    {
+        return $user->can(Permission::ACTION_ACTIVITY_READ, Filament::getTenant());
+    }
+}

app/Policies/Server/AllocationPolicy.php

@@ -0,0 +1,36 @@
+<?php
+
+namespace App\Policies\Server;
+
+use App\Models\Permission;
+use App\Models\User;
+use Filament\Facades\Filament;
+use Illuminate\Database\Eloquent\Model;
+
+class AllocationPolicy
+{
+    public function viewAny(User $user): bool
+    {
+        return $user->can(Permission::ACTION_ALLOCATION_READ, Filament::getTenant());
+    }
+
+    public function view(User $user, Model $record): bool
+    {
+        return $user->can(Permission::ACTION_ALLOCATION_READ, Filament::getTenant());
+    }
+
+    public function create(User $user): bool
+    {
+        return $user->can(Permission::ACTION_ALLOCATION_CREATE, Filament::getTenant());
+    }
+
+    public function edit(User $user, Model $record): bool
+    {
+        return $user->can(Permission::ACTION_ALLOCATION_UPDATE, Filament::getTenant());
+    }
+
+    public function delete(User $user, Model $record): bool
+    {
+        return $user->can(Permission::ACTION_ALLOCATION_DELETE, Filament::getTenant());
+    }
+}

app/Policies/Server/BackupPolicy.php

@@ -0,0 +1,31 @@
+<?php
+
+namespace App\Policies\Server;
+
+use App\Models\Permission;
+use App\Models\User;
+use Filament\Facades\Filament;
+use Illuminate\Database\Eloquent\Model;
+
+class BackupPolicy
+{
+    public function viewAny(User $user): bool
+    {
+        return $user->can(Permission::ACTION_BACKUP_READ, Filament::getTenant());
+    }
+
+    public function view(User $user, Model $record): bool
+    {
+        return $user->can(Permission::ACTION_BACKUP_READ, Filament::getTenant());
+    }
+
+    public function create(User $user): bool
+    {
+        return $user->can(Permission::ACTION_BACKUP_CREATE, Filament::getTenant());
+    }
+
+    public function delete(User $user, Model $record): bool
+    {
+        return $user->can(Permission::ACTION_BACKUP_DELETE, Filament::getTenant());
+    }
+}

app/Policies/Server/DatabasePolicy.php

@@ -0,0 +1,36 @@
+<?php
+
+namespace App\Policies\Server;
+
+use App\Models\Permission;
+use App\Models\User;
+use Filament\Facades\Filament;
+use Illuminate\Database\Eloquent\Model;
+
+class DatabasePolicy
+{
+    public function viewAny(User $user): bool
+    {
+        return $user->can(Permission::ACTION_DATABASE_READ, Filament::getTenant());
+    }
+
+    public function view(User $user, Model $record): bool
+    {
+        return $user->can(Permission::ACTION_DATABASE_READ, Filament::getTenant());
+    }
+
+    public function create(User $user): bool
+    {
+        return $user->can(Permission::ACTION_DATABASE_CREATE, Filament::getTenant());
+    }
+
+    public function edit(User $user, Model $record): bool
+    {
+        return $user->can(Permission::ACTION_DATABASE_UPDATE, Filament::getTenant());
+    }
+
+    public function delete(User $user, Model $record): bool
+    {
+        return $user->can(Permission::ACTION_DATABASE_DELETE, Filament::getTenant());
+    }
+}

app/Policies/Server/FilePolicy.php

@@ -0,0 +1,36 @@
+<?php
+
+namespace App\Policies\Server;
+
+use App\Models\Permission;
+use App\Models\User;
+use Filament\Facades\Filament;
+use Illuminate\Database\Eloquent\Model;
+
+class FilePolicy
+{
+    public function viewAny(User $user): bool
+    {
+        return $user->can(Permission::ACTION_FILE_READ, Filament::getTenant());
+    }
+
+    public function view(User $user, Model $record): bool
+    {
+        return $user->can(Permission::ACTION_FILE_READ_CONTENT, Filament::getTenant());
+    }
+
+    public function create(User $user): bool
+    {
+        return $user->can(Permission::ACTION_FILE_CREATE, Filament::getTenant());
+    }
+
+    public function edit(User $user, Model $record): bool
+    {
+        return $user->can(Permission::ACTION_FILE_UPDATE, Filament::getTenant());
+    }
+
+    public function delete(User $user, Model $record): bool
+    {
+        return $user->can(Permission::ACTION_FILE_DELETE, Filament::getTenant());
+    }
+}

app/Policies/Server/SchedulePolicy.php

@@ -0,0 +1,36 @@
+<?php
+
+namespace App\Policies\Server;
+
+use App\Models\Permission;
+use App\Models\User;
+use Filament\Facades\Filament;
+use Illuminate\Database\Eloquent\Model;
+
+class SchedulePolicy
+{
+    public function viewAny(User $user): bool
+    {
+        return $user->can(Permission::ACTION_SCHEDULE_READ, Filament::getTenant());
+    }
+
+    public function view(User $user, Model $record): bool
+    {
+        return $user->can(Permission::ACTION_SCHEDULE_READ, Filament::getTenant());
+    }
+
+    public function create(User $user): bool
+    {
+        return $user->can(Permission::ACTION_SCHEDULE_CREATE, Filament::getTenant());
+    }
+
+    public function edit(User $user, Model $record): bool
+    {
+        return $user->can(Permission::ACTION_SCHEDULE_UPDATE, Filament::getTenant());
+    }
+
+    public function delete(User $user, Model $record): bool
+    {
+        return $user->can(Permission::ACTION_SCHEDULE_DELETE, Filament::getTenant());
+    }
+}

app/Policies/Server/ServerPolicy.php

@@ -1,6 +1,6 @@
 <?php
 
-namespace App\Policies;
+namespace App\Policies\Server;
 
 use App\Models\Permission;
 use App\Models\Server;
@@ -8,10 +8,6 @@ use App\Models\User;
 
 class ServerPolicy
 {
-    use DefaultPolicies;
-
-    protected string $modelName = 'server';
-
     /**
      * Runs before any of the functions are called. Used to determine if the (sub-)user has permissions.
      */
@@ -48,8 +44,10 @@ class ServerPolicy
      * This is a horrendous hack to avoid Laravel's "smart" behavior that does
      * not call the before() function if there isn't a function matching the
      * policy permission.
+     *
+     * @param  array<string, mixed>  $arguments
      */
-    public function __call(string $name, mixed $arguments): void
+    public function __call(string $name, array $arguments): void
     {
         // do nothing
     }

app/Policies/Server/UserPolicy.php

@@ -0,0 +1,36 @@
+<?php
+
+namespace App\Policies\Server;
+
+use App\Models\Permission;
+use App\Models\User;
+use Filament\Facades\Filament;
+use Illuminate\Database\Eloquent\Model;
+
+class UserPolicy
+{
+    public function viewAny(User $user): bool
+    {
+        return $user->can(Permission::ACTION_USER_READ, Filament::getTenant());
+    }
+
+    public function view(User $user, Model $record): bool
+    {
+        return $user->can(Permission::ACTION_USER_READ, Filament::getTenant());
+    }
+
+    public function create(User $user): bool
+    {
+        return $user->can(Permission::ACTION_USER_CREATE, Filament::getTenant());
+    }
+
+    public function edit(User $user, Model $record): bool
+    {
+        return $user->can(Permission::ACTION_USER_UPDATE, Filament::getTenant());
+    }
+
+    public function delete(User $user, Model $record): bool
+    {
+        return $user->can(Permission::ACTION_USER_DELETE, Filament::getTenant());
+    }
+}

app/Providers/AppServiceProvider.php

@@ -26,6 +26,7 @@ use App\Services\Helpers\SoftwareVersionService;
 use Dedoc\Scramble\Scramble;
 use Dedoc\Scramble\Support\Generator\OpenApi;
 use Dedoc\Scramble\Support\Generator\SecurityScheme;
+use Filament\Facades\Filament;
 use Illuminate\Config\Repository;
 use Illuminate\Database\Eloquent\Relations\Relation;
 use Illuminate\Foundation\Application;
@@ -106,8 +107,21 @@ class AppServiceProvider extends ServiceProvider
             ]);
         }
 
-        Gate::before(function (User $user, $ability) {
+        Gate::before(fn (User $user, $ability) => $user->isRootAdmin() ? true : null);
-            return $user->isRootAdmin() ? true : null;
+
+        Gate::guessPolicyNamesUsing(function (string $modelClass) {
+            $panelId = mb_ucfirst(Filament::getCurrentOrDefaultPanel()->getId());
+
+            if ($panelId === 'App') {
+                return;
+            }
+
+            $modelName = class_basename($modelClass);
+            $class = "App\\Policies\\{$panelId}\\{$modelName}Policy";
+
+            if (class_exists($class)) {
+                return $class;
+            }
         });
 
         AboutCommand::add('Pelican', [