使用 Lumen 进行简单的访问授权

Question

尝试使用 Lumen 实现简单的访问授权。它在执行更新 (PUT) 操作时起作用。 但我也想处理访问例如所有文章。

我也尝试了viewAny 或view 策略方法但没有成功。

路由器

$router->group(['prefix' => 'api/v1'], function () use ($router) {
    $router->get('articles',  ['uses' => 'ArticleController@showAllArticles']);
    $router->get('articles/{id}', ['uses' => 'ArticleController@showOneArticle']);
    $router->post('articles', ['uses' => 'ArticleController@create']);
    $router->delete('articles/{id}', ['uses' => 'ArticleController@delete']);
    $router->put('articles/{id}', ['uses' => 'ArticleController@update']);
});

AuthServiceProvider

class AuthServiceProvider extends ServiceProvider
{
    public function boot()
    {
        Gate::policy('App\Article', 'App\Policies\ArticlePolicy');

        $this->app['auth']->viaRequest('api', function ($request) {
            return app('auth')->setRequest($request)->user();
        });
    }
}

政策

namespace App\Policies;

use App\User;
use App\Article;

class ArticlePolicy
{
    public function showAllArticles(User $user, Article $post)
    {
        // not working
        return true;
    }

    public function update(User $user, Article $post)
    {
        // this works
        return true;
    }
}

控制器

namespace App\Http\Controllers;

use App\Article;
use Illuminate\Http\Request;

class ArticleController extends Controller
{
    public function __construct()
    {
        $this->middleware('auth:api');
    }

    public function showAllArticles()
    {
        $this->authorize('showAllArticles');
        return response()->json(Article::all());
    }

    public function showOneArticle($id)
    {
        return response()->json(Article::find($id));
    }


    public function update($id, Request $request)
    {
        $article = Article::findOrFail($id);
        $this->authorize('update', $article);
        $article->update($request->all());

        return response()->json($article, 200);
    }
}

Answer 1

根据关于授权的 Laravel 文档：

“当定义不接收模型实例的策略方法时，例如 create 方法，它不会接收模型实例。相反，您应该将方法定义为 only认证用户："

public function create(User $user)

所以：

public function showAllArticles(User $user)

“如前所述，像create 这样的某些操作可能不需要模型实例。在这些情况下，您应该将类​​名传递给authorize 方法。类名将用于确定要使用的策略授权操作时："

$this->authorize('create', Post::class);

所以：

$this->authorize('showAllArticles', Article::class);

Laravel 7.x Docs - Authorization - Writing Policies - Methods without Models

Laravel 7.x Docs - Authorization - Authorizing Actions Using Policies - via Controller Helperauthorize

无需解释。