[6.x] Update authorization / permissions by duncanmcclean · Pull Request #11516 · statamic/cms

duncanmcclean · 2025-02-28T11:20:53Z

This pull request:

Only applies our auth logic to Statamic permissions, which prevents us from interfering with custom auth gates.
Moves our auth logic from Gate::before to after, enabling users to more easily deny access to things.
Adds super user checks to before in most Statamic policies to continue to avoid overhead when users are super.

…tatamic permission

Otherwise, when the `Authorize` middleware checks if the user has access to the CP, `Permission:all()` in the `Gate::before()` closure won't return any permissions as they haven't been booted yet.

Until I figure out a better solution. 🤔

Since there's no `DroidsClass` policy, I've updated this test to authorize using a permission instead, which'll work.

…ation

… a statamic one

Since more stuff gets evaluated now (all the permissions are compiled) all the sites will be looped over. Many tests were setting up sites without explicit names. They don't really need them so here the site name will fall back to the handle.

jasonvarga · 2025-03-13T13:51:18Z

Since we're checking whether an ability is a Statamic one, I had to add a way to get all the resolved permissions. The Permission::all() you had there wouldn't work since it would include placeholders. e.g. edit {collection} entries. The ability passed would be edit blog entries. Permission::flattened() will now resolve all of them.

… instead

…egistered statamic permission

…e we want code coverage for that.

duncanmcclean · 2025-02-28T11:20:53Z

This pull request:

Only applies our auth logic to Statamic permissions, which prevents us from interfering with custom auth gates.
Moves our auth logic from Gate::before to after, enabling users to more easily deny access to things.
Adds super user checks to before in most Statamic policies to continue to avoid overhead when users are super.

Closes#8337.
Closes#10832.

…tatamic permission

Otherwise, when the `Authorize` middleware checks if the user has access to the CP, `Permission:all()` in the `Gate::before()` closure won't return any permissions as they haven't been booted yet.

Until I figure out a better solution. 🤔

Since there's no `DroidsClass` policy, I've updated this test to authorize using a permission instead, which'll work.

…ation

… a statamic one

Since more stuff gets evaluated now (all the permissions are compiled) all the sites will be looped over. Many tests were setting up sites without explicit names. They don't really need them so here the site name will fall back to the handle.

jasonvarga · 2025-03-13T13:51:18Z

Since we're checking whether an ability is a Statamic one, I had to add a way to get all the resolved permissions. The Permission::all() you had there wouldn't work since it would include placeholders. e.g. edit {collection} entries. The ability passed would be edit blog entries. Permission::flattened() will now resolve all of them.

… instead

…egistered statamic permission

…e we want code coverage for that.

duncanmcclean · 2025-02-28T11:20:53Z

This pull request:

Only applies our auth logic to Statamic permissions, which prevents us from interfering with custom auth gates.
Moves our auth logic from Gate::before to after, enabling users to more easily deny access to things.
Adds super user checks to before in most Statamic policies to continue to avoid overhead when users are super.

Closes#8337.
Closes#10832.

…tatamic permission

Otherwise, when the `Authorize` middleware checks if the user has access to the CP, `Permission:all()` in the `Gate::before()` closure won't return any permissions as they haven't been booted yet.

Until I figure out a better solution. 🤔

Since there's no `DroidsClass` policy, I've updated this test to authorize using a permission instead, which'll work.

…ation

… a statamic one

Since more stuff gets evaluated now (all the permissions are compiled) all the sites will be looped over. Many tests were setting up sites without explicit names. They don't really need them so here the site name will fall back to the handle.

jasonvarga · 2025-03-13T13:51:18Z

Since we're checking whether an ability is a Statamic one, I had to add a way to get all the resolved permissions. The Permission::all() you had there wouldn't work since it would include placeholders. e.g. edit {collection} entries. The ability passed would be edit blog entries. Permission::flattened() will now resolve all of them.

… instead

…egistered statamic permission

…e we want code coverage for that.

duncanmcclean · 2025-02-28T11:20:53Z

This pull request:

Only applies our auth logic to Statamic permissions, which prevents us from interfering with custom auth gates.
Moves our auth logic from Gate::before to after, enabling users to more easily deny access to things.
Adds super user checks to before in most Statamic policies to continue to avoid overhead when users are super.

Closes#8337.
Closes#10832.

…tatamic permission

Otherwise, when the `Authorize` middleware checks if the user has access to the CP, `Permission:all()` in the `Gate::before()` closure won't return any permissions as they haven't been booted yet.

Until I figure out a better solution. 🤔

Since there's no `DroidsClass` policy, I've updated this test to authorize using a permission instead, which'll work.

…ation

… a statamic one

Since more stuff gets evaluated now (all the permissions are compiled) all the sites will be looped over. Many tests were setting up sites without explicit names. They don't really need them so here the site name will fall back to the handle.

jasonvarga · 2025-03-13T13:51:18Z

Since we're checking whether an ability is a Statamic one, I had to add a way to get all the resolved permissions. The Permission::all() you had there wouldn't work since it would include placeholders. e.g. edit {collection} entries. The ability passed would be edit blog entries. Permission::flattened() will now resolve all of them.

… instead

…egistered statamic permission

…e we want code coverage for that.

duncanmcclean · 2025-02-28T11:20:53Z

This pull request:

Only applies our auth logic to Statamic permissions, which prevents us from interfering with custom auth gates.
Moves our auth logic from Gate::before to after, enabling users to more easily deny access to things.
Adds super user checks to before in most Statamic policies to continue to avoid overhead when users are super.

Closes#8337.
Closes#10832.

…tatamic permission

Otherwise, when the `Authorize` middleware checks if the user has access to the CP, `Permission:all()` in the `Gate::before()` closure won't return any permissions as they haven't been booted yet.

Until I figure out a better solution. 🤔

Since there's no `DroidsClass` policy, I've updated this test to authorize using a permission instead, which'll work.

…ation

… a statamic one

Since more stuff gets evaluated now (all the permissions are compiled) all the sites will be looped over. Many tests were setting up sites without explicit names. They don't really need them so here the site name will fall back to the handle.

jasonvarga · 2025-03-13T13:51:18Z

Since we're checking whether an ability is a Statamic one, I had to add a way to get all the resolved permissions. The Permission::all() you had there wouldn't work since it would include placeholders. e.g. edit {collection} entries. The ability passed would be edit blog entries. Permission::flattened() will now resolve all of them.

… instead

…egistered statamic permission

…e we want code coverage for that.

duncanmcclean · 2025-02-28T11:20:53Z

This pull request:

Only applies our auth logic to Statamic permissions, which prevents us from interfering with custom auth gates.
Moves our auth logic from Gate::before to after, enabling users to more easily deny access to things.
Adds super user checks to before in most Statamic policies to continue to avoid overhead when users are super.

Closes#8337.
Closes#10832.

…tatamic permission

Otherwise, when the `Authorize` middleware checks if the user has access to the CP, `Permission:all()` in the `Gate::before()` closure won't return any permissions as they haven't been booted yet.

Until I figure out a better solution. 🤔

Since there's no `DroidsClass` policy, I've updated this test to authorize using a permission instead, which'll work.

…ation

… a statamic one

Since more stuff gets evaluated now (all the permissions are compiled) all the sites will be looped over. Many tests were setting up sites without explicit names. They don't really need them so here the site name will fall back to the handle.

jasonvarga · 2025-03-13T13:51:18Z

Since we're checking whether an ability is a Statamic one, I had to add a way to get all the resolved permissions. The Permission::all() you had there wouldn't work since it would include placeholders. e.g. edit {collection} entries. The ability passed would be edit blog entries. Permission::flattened() will now resolve all of them.

… instead

…egistered statamic permission

…e we want code coverage for that.

duncanmcclean · 2025-02-28T11:20:53Z

This pull request:

Only applies our auth logic to Statamic permissions, which prevents us from interfering with custom auth gates.
Moves our auth logic from Gate::before to after, enabling users to more easily deny access to things.
Adds super user checks to before in most Statamic policies to continue to avoid overhead when users are super.

Closes#8337.
Closes#10832.

…tatamic permission

Otherwise, when the `Authorize` middleware checks if the user has access to the CP, `Permission:all()` in the `Gate::before()` closure won't return any permissions as they haven't been booted yet.

Until I figure out a better solution. 🤔

Since there's no `DroidsClass` policy, I've updated this test to authorize using a permission instead, which'll work.

…ation

… a statamic one

Since more stuff gets evaluated now (all the permissions are compiled) all the sites will be looped over. Many tests were setting up sites without explicit names. They don't really need them so here the site name will fall back to the handle.

jasonvarga · 2025-03-13T13:51:18Z

Since we're checking whether an ability is a Statamic one, I had to add a way to get all the resolved permissions. The Permission::all() you had there wouldn't work since it would include placeholders. e.g. edit {collection} entries. The ability passed would be edit blog entries. Permission::flattened() will now resolve all of them.

… instead

…egistered statamic permission

…e we want code coverage for that.

duncanmcclean · 2025-02-28T11:20:53Z

This pull request:

Only applies our auth logic to Statamic permissions, which prevents us from interfering with custom auth gates.
Moves our auth logic from Gate::before to after, enabling users to more easily deny access to things.
Adds super user checks to before in most Statamic policies to continue to avoid overhead when users are super.

Closes#8337.
Closes#10832.

…tatamic permission

Otherwise, when the `Authorize` middleware checks if the user has access to the CP, `Permission:all()` in the `Gate::before()` closure won't return any permissions as they haven't been booted yet.

Until I figure out a better solution. 🤔

Since there's no `DroidsClass` policy, I've updated this test to authorize using a permission instead, which'll work.

…ation

… a statamic one

Since more stuff gets evaluated now (all the permissions are compiled) all the sites will be looped over. Many tests were setting up sites without explicit names. They don't really need them so here the site name will fall back to the handle.

jasonvarga · 2025-03-13T13:51:18Z

Since we're checking whether an ability is a Statamic one, I had to add a way to get all the resolved permissions. The Permission::all() you had there wouldn't work since it would include placeholders. e.g. edit {collection} entries. The ability passed would be edit blog entries. Permission::flattened() will now resolve all of them.

… instead

…egistered statamic permission

…e we want code coverage for that.

duncanmcclean added 9 commits February 28, 2025 11:17

Only perform super user check in Gate::before() when ability is a S…
7aa69fa
…tatamic permission

Ensure permissions are booted before authorization is handled
39a696e
Otherwise, when the `Authorize` middleware checks if the user has access to the CP, `Permission:all()` in the `Gate::before()` closure won't return any permissions as they haven't been booted yet.

Remove commented out dd() from middleware 😄
f34eafa

Add super user check to the before method in authorization policies.
639a059

Ensure permissions exist, otherwise the super user check will fail.
8fa1c6b

Move the middleware back to where they were originally.
1b91834

Boot permissions in Gate::before() method...
7770675
Until I figure out a better solution. 🤔

Update an existing test
1995374
Since there's no `DroidsClass` policy, I've updated this test to authorize using a permission instead, which'll work.

Fix super authorization in AssetFolderPolicy
b365909

duncanmcclean commented Feb 28, 2025
View reviewed changes

Comment threadsrc/Providers/AuthServiceProvider.php Outdated

duncanmcclean added 2 commits March 6, 2025 15:13

Merge remote-tracking branch 'origin/master' into super-user-authoriz…
f23a4c9
…ation

Return early when permissions have already been booted.
3ce7705

duncanmcclean marked this pull request as ready for review March 6, 2025 15:25

jasonvarga requested changes Mar 6, 2025
View reviewed changes

Comment threadsrc/Providers/AuthServiceProvider.php Outdated

Move super user check to Gate::after()
88e702f

duncanmcclean force-pushed the super-user-authorization branch from 1136551 to 88e702fCompare March 7, 2025 12:46

duncanmcclean added 3 commits March 7, 2025 14:47

Refactor super user / permission check
d9b9567

Re-work the logic a little to allow for wildcard permissions
1327752

Register permission in test
ee19523

duncanmcclean requested a review from jasonvarga March 7, 2025 16:13

jasonvarga added 6 commits March 11, 2025 14:42

Merge branch 'master' into super-user-authorization
7abb312

Test for booting once
de15f90

nitpick
f59a7e4

Add gate tests
0803113

Add a flattened method and use that to check if a given permission is…
99d8acf
… a statamic one

fix test failures ...
ca39b67
Since more stuff gets evaluated now (all the permissions are compiled) all the sites will be looped over. Many tests were setting up sites without explicit names. They don't really need them so here the site name will fall back to the handle.

jasonvarga added 3 commits March 13, 2025 10:07

These tests aren't concerned with permissions so just remove the cans…
34d421c
… instead

Test gate should not explicitly deny
705cc02

User clearer names
fd7b7cb

jasonvarga added 5 commits March 13, 2025 11:03

Avoid even checking if user has permission if that ability is not a r…
2de3e31
…egistered statamic permission

Bring back existing can() usage, but with an actual gate policy, sinc…
c04820e
…e we want code coverage for that.

Don't just register the successful one, and add a note.
3e87ca5

Make chainable
691a0a8

Explain
91162f8

jasonvarga changed the title ~~[6.x] Re-work super user authorization check~~[6.x] Update authorization / permissionsMar 13, 2025

jasonvarga merged commit a8726dd into masterMar 13, 2025

jasonvarga deleted the super-user-authorization branch March 13, 2025 15:23

This was referenced Mar 13, 2025
Can't use Nova, Telescope Gate in Laravel #8337
Closed
Global Gate::before() checks affect Laravel policy checks outside of Statamic #10832
Closed

This was referenced Sep 2, 2025
[6.x] Cache flattened permissions #12258
Merged
[6.x] Fix permission labels not being localized correctly #12316
Merged

duncanmcclean added 9 commits February 28, 2025 11:17

Only perform super user check in Gate::before() when ability is a S…
7aa69fa
…tatamic permission

Ensure permissions are booted before authorization is handled
39a696e
Otherwise, when the `Authorize` middleware checks if the user has access to the CP, `Permission:all()` in the `Gate::before()` closure won't return any permissions as they haven't been booted yet.

Remove commented out dd() from middleware 😄
f34eafa

Add super user check to the before method in authorization policies.
639a059

Ensure permissions exist, otherwise the super user check will fail.
8fa1c6b

Move the middleware back to where they were originally.
1b91834

Boot permissions in Gate::before() method...
7770675
Until I figure out a better solution. 🤔

Update an existing test
1995374
Since there's no `DroidsClass` policy, I've updated this test to authorize using a permission instead, which'll work.

Fix super authorization in AssetFolderPolicy
b365909

duncanmcclean commented Feb 28, 2025
View reviewed changes

Comment threadsrc/Providers/AuthServiceProvider.php Outdated

duncanmcclean added 2 commits March 6, 2025 15:13

Merge remote-tracking branch 'origin/master' into super-user-authoriz…
f23a4c9
…ation

Return early when permissions have already been booted.
3ce7705

duncanmcclean marked this pull request as ready for review March 6, 2025 15:25

jasonvarga requested changes Mar 6, 2025
View reviewed changes

Comment threadsrc/Providers/AuthServiceProvider.php Outdated

Move super user check to Gate::after()
88e702f

duncanmcclean force-pushed the super-user-authorization branch from 1136551 to 88e702fCompare March 7, 2025 12:46

duncanmcclean added 3 commits March 7, 2025 14:47

Refactor super user / permission check
d9b9567

Re-work the logic a little to allow for wildcard permissions
1327752

Register permission in test
ee19523

duncanmcclean requested a review from jasonvarga March 7, 2025 16:13

jasonvarga added 6 commits March 11, 2025 14:42

Merge branch 'master' into super-user-authorization
7abb312

Test for booting once
de15f90

nitpick
f59a7e4

Add gate tests
0803113

Add a flattened method and use that to check if a given permission is…
99d8acf
… a statamic one

fix test failures ...
ca39b67
Since more stuff gets evaluated now (all the permissions are compiled) all the sites will be looped over. Many tests were setting up sites without explicit names. They don't really need them so here the site name will fall back to the handle.

jasonvarga added 3 commits March 13, 2025 10:07

These tests aren't concerned with permissions so just remove the cans…
34d421c
… instead

Test gate should not explicitly deny
705cc02

User clearer names
fd7b7cb

jasonvarga added 5 commits March 13, 2025 11:03

Avoid even checking if user has permission if that ability is not a r…
2de3e31
…egistered statamic permission

Bring back existing can() usage, but with an actual gate policy, sinc…
c04820e
…e we want code coverage for that.

Don't just register the successful one, and add a note.
3e87ca5

Make chainable
691a0a8

Explain
91162f8

jasonvarga changed the title ~~[6.x] Re-work super user authorization check~~[6.x] Update authorization / permissionsMar 13, 2025

jasonvarga merged commit a8726dd into masterMar 13, 2025

jasonvarga deleted the super-user-authorization branch March 13, 2025 15:23

This was referenced Mar 13, 2025
Can't use Nova, Telescope Gate in Laravel #8337
Closed
Global Gate::before() checks affect Laravel policy checks outside of Statamic #10832
Closed

This was referenced Sep 2, 2025
[6.x] Cache flattened permissions #12258
Merged
[6.x] Fix permission labels not being localized correctly #12316
Merged

duncanmcclean added 9 commits February 28, 2025 11:17

Only perform super user check in Gate::before() when ability is a S…
7aa69fa
…tatamic permission

Ensure permissions are booted before authorization is handled
39a696e
Otherwise, when the `Authorize` middleware checks if the user has access to the CP, `Permission:all()` in the `Gate::before()` closure won't return any permissions as they haven't been booted yet.

Remove commented out dd() from middleware 😄
f34eafa

Add super user check to the before method in authorization policies.
639a059

Ensure permissions exist, otherwise the super user check will fail.
8fa1c6b

Move the middleware back to where they were originally.
1b91834

Boot permissions in Gate::before() method...
7770675
Until I figure out a better solution. 🤔

Update an existing test
1995374
Since there's no `DroidsClass` policy, I've updated this test to authorize using a permission instead, which'll work.

Fix super authorization in AssetFolderPolicy
b365909

duncanmcclean commented Feb 28, 2025
View reviewed changes

Comment threadsrc/Providers/AuthServiceProvider.php Outdated

duncanmcclean added 2 commits March 6, 2025 15:13

Merge remote-tracking branch 'origin/master' into super-user-authoriz…
f23a4c9
…ation

Return early when permissions have already been booted.
3ce7705

duncanmcclean marked this pull request as ready for review March 6, 2025 15:25

jasonvarga requested changes Mar 6, 2025
View reviewed changes

Comment threadsrc/Providers/AuthServiceProvider.php Outdated

Move super user check to Gate::after()
88e702f

duncanmcclean force-pushed the super-user-authorization branch from 1136551 to 88e702fCompare March 7, 2025 12:46

duncanmcclean added 3 commits March 7, 2025 14:47

Refactor super user / permission check
d9b9567

Re-work the logic a little to allow for wildcard permissions
1327752

Register permission in test
ee19523

duncanmcclean requested a review from jasonvarga March 7, 2025 16:13

jasonvarga added 6 commits March 11, 2025 14:42

Merge branch 'master' into super-user-authorization
7abb312

Test for booting once
de15f90

nitpick
f59a7e4

Add gate tests
0803113

Add a flattened method and use that to check if a given permission is…
99d8acf
… a statamic one

fix test failures ...
ca39b67
Since more stuff gets evaluated now (all the permissions are compiled) all the sites will be looped over. Many tests were setting up sites without explicit names. They don't really need them so here the site name will fall back to the handle.

jasonvarga added 3 commits March 13, 2025 10:07

These tests aren't concerned with permissions so just remove the cans…
34d421c
… instead

Test gate should not explicitly deny
705cc02

User clearer names
fd7b7cb

jasonvarga added 5 commits March 13, 2025 11:03

Avoid even checking if user has permission if that ability is not a r…
2de3e31
…egistered statamic permission

Bring back existing can() usage, but with an actual gate policy, sinc…
c04820e
…e we want code coverage for that.

Don't just register the successful one, and add a note.
3e87ca5

Make chainable
691a0a8

Explain
91162f8

jasonvarga changed the title ~~[6.x] Re-work super user authorization check~~[6.x] Update authorization / permissionsMar 13, 2025

jasonvarga merged commit a8726dd into masterMar 13, 2025

jasonvarga deleted the super-user-authorization branch March 13, 2025 15:23

This was referenced Mar 13, 2025
Can't use Nova, Telescope Gate in Laravel #8337
Closed
Global Gate::before() checks affect Laravel policy checks outside of Statamic #10832
Closed

This was referenced Sep 2, 2025
[6.x] Cache flattened permissions #12258
Merged
[6.x] Fix permission labels not being localized correctly #12316
Merged

duncanmcclean added 9 commits February 28, 2025 11:17

Only perform super user check in Gate::before() when ability is a S…
7aa69fa
…tatamic permission

Ensure permissions are booted before authorization is handled
39a696e
Otherwise, when the `Authorize` middleware checks if the user has access to the CP, `Permission:all()` in the `Gate::before()` closure won't return any permissions as they haven't been booted yet.

Remove commented out dd() from middleware 😄
f34eafa

Add super user check to the before method in authorization policies.
639a059

Ensure permissions exist, otherwise the super user check will fail.
8fa1c6b

Move the middleware back to where they were originally.
1b91834

Boot permissions in Gate::before() method...
7770675
Until I figure out a better solution. 🤔

Update an existing test
1995374
Since there's no `DroidsClass` policy, I've updated this test to authorize using a permission instead, which'll work.

Fix super authorization in AssetFolderPolicy
b365909

duncanmcclean commented Feb 28, 2025
View reviewed changes

Comment threadsrc/Providers/AuthServiceProvider.php Outdated

duncanmcclean added 2 commits March 6, 2025 15:13

Merge remote-tracking branch 'origin/master' into super-user-authoriz…
f23a4c9
…ation

Return early when permissions have already been booted.
3ce7705

duncanmcclean marked this pull request as ready for review March 6, 2025 15:25

jasonvarga requested changes Mar 6, 2025
View reviewed changes

Comment threadsrc/Providers/AuthServiceProvider.php Outdated

Move super user check to Gate::after()
88e702f

duncanmcclean force-pushed the super-user-authorization branch from 1136551 to 88e702fCompare March 7, 2025 12:46

duncanmcclean added 3 commits March 7, 2025 14:47

Refactor super user / permission check
d9b9567

Re-work the logic a little to allow for wildcard permissions
1327752

Register permission in test
ee19523

duncanmcclean requested a review from jasonvarga March 7, 2025 16:13

jasonvarga added 6 commits March 11, 2025 14:42

Merge branch 'master' into super-user-authorization
7abb312

Test for booting once
de15f90

nitpick
f59a7e4

Add gate tests
0803113

Add a flattened method and use that to check if a given permission is…
99d8acf
… a statamic one

fix test failures ...
ca39b67
Since more stuff gets evaluated now (all the permissions are compiled) all the sites will be looped over. Many tests were setting up sites without explicit names. They don't really need them so here the site name will fall back to the handle.

jasonvarga added 3 commits March 13, 2025 10:07

These tests aren't concerned with permissions so just remove the cans…
34d421c
… instead

Test gate should not explicitly deny
705cc02

User clearer names
fd7b7cb

jasonvarga added 5 commits March 13, 2025 11:03

Avoid even checking if user has permission if that ability is not a r…
2de3e31
…egistered statamic permission

Bring back existing can() usage, but with an actual gate policy, sinc…
c04820e
…e we want code coverage for that.

Don't just register the successful one, and add a note.
3e87ca5

Make chainable
691a0a8

Explain
91162f8

jasonvarga changed the title ~~[6.x] Re-work super user authorization check~~[6.x] Update authorization / permissionsMar 13, 2025

jasonvarga merged commit a8726dd into masterMar 13, 2025

jasonvarga deleted the super-user-authorization branch March 13, 2025 15:23

This was referenced Mar 13, 2025
Can't use Nova, Telescope Gate in Laravel #8337
Closed
Global Gate::before() checks affect Laravel policy checks outside of Statamic #10832
Closed

This was referenced Sep 2, 2025
[6.x] Cache flattened permissions #12258
Merged
[6.x] Fix permission labels not being localized correctly #12316
Merged

duncanmcclean added 9 commits February 28, 2025 11:17

Only perform super user check in Gate::before() when ability is a S…
7aa69fa
…tatamic permission

Ensure permissions are booted before authorization is handled
39a696e
Otherwise, when the `Authorize` middleware checks if the user has access to the CP, `Permission:all()` in the `Gate::before()` closure won't return any permissions as they haven't been booted yet.

Remove commented out dd() from middleware 😄
f34eafa

Add super user check to the before method in authorization policies.
639a059

Ensure permissions exist, otherwise the super user check will fail.
8fa1c6b

Move the middleware back to where they were originally.
1b91834

Boot permissions in Gate::before() method...
7770675
Until I figure out a better solution. 🤔

Update an existing test
1995374
Since there's no `DroidsClass` policy, I've updated this test to authorize using a permission instead, which'll work.

Fix super authorization in AssetFolderPolicy
b365909

duncanmcclean commented Feb 28, 2025
View reviewed changes

Comment threadsrc/Providers/AuthServiceProvider.php Outdated

duncanmcclean added 2 commits March 6, 2025 15:13

Merge remote-tracking branch 'origin/master' into super-user-authoriz…
f23a4c9
…ation

Return early when permissions have already been booted.
3ce7705

duncanmcclean marked this pull request as ready for review March 6, 2025 15:25

jasonvarga requested changes Mar 6, 2025
View reviewed changes

Comment threadsrc/Providers/AuthServiceProvider.php Outdated

Move super user check to Gate::after()
88e702f

duncanmcclean force-pushed the super-user-authorization branch from 1136551 to 88e702fCompare March 7, 2025 12:46

duncanmcclean added 3 commits March 7, 2025 14:47

Refactor super user / permission check
d9b9567

Re-work the logic a little to allow for wildcard permissions
1327752

Register permission in test
ee19523

duncanmcclean requested a review from jasonvarga March 7, 2025 16:13

jasonvarga added 6 commits March 11, 2025 14:42

Merge branch 'master' into super-user-authorization
7abb312

Test for booting once
de15f90

nitpick
f59a7e4

Add gate tests
0803113

Add a flattened method and use that to check if a given permission is…
99d8acf
… a statamic one

fix test failures ...
ca39b67
Since more stuff gets evaluated now (all the permissions are compiled) all the sites will be looped over. Many tests were setting up sites without explicit names. They don't really need them so here the site name will fall back to the handle.

jasonvarga added 3 commits March 13, 2025 10:07

These tests aren't concerned with permissions so just remove the cans…
34d421c
… instead

Test gate should not explicitly deny
705cc02

User clearer names
fd7b7cb

jasonvarga added 5 commits March 13, 2025 11:03

Avoid even checking if user has permission if that ability is not a r…
2de3e31
…egistered statamic permission

Bring back existing can() usage, but with an actual gate policy, sinc…
c04820e
…e we want code coverage for that.

Don't just register the successful one, and add a note.
3e87ca5

Make chainable
691a0a8

Explain
91162f8

jasonvarga changed the title ~~[6.x] Re-work super user authorization check~~[6.x] Update authorization / permissionsMar 13, 2025

jasonvarga merged commit a8726dd into masterMar 13, 2025

jasonvarga deleted the super-user-authorization branch March 13, 2025 15:23

This was referenced Mar 13, 2025
Can't use Nova, Telescope Gate in Laravel #8337
Closed
Global Gate::before() checks affect Laravel policy checks outside of Statamic #10832
Closed

This was referenced Sep 2, 2025
[6.x] Cache flattened permissions #12258
Merged
[6.x] Fix permission labels not being localized correctly #12316
Merged

duncanmcclean added 9 commits February 28, 2025 11:17

Only perform super user check in Gate::before() when ability is a S…
7aa69fa
…tatamic permission

Ensure permissions are booted before authorization is handled
39a696e
Otherwise, when the `Authorize` middleware checks if the user has access to the CP, `Permission:all()` in the `Gate::before()` closure won't return any permissions as they haven't been booted yet.

Remove commented out dd() from middleware 😄
f34eafa

Add super user check to the before method in authorization policies.
639a059

Ensure permissions exist, otherwise the super user check will fail.
8fa1c6b

Move the middleware back to where they were originally.
1b91834

Boot permissions in Gate::before() method...
7770675
Until I figure out a better solution. 🤔

Update an existing test
1995374
Since there's no `DroidsClass` policy, I've updated this test to authorize using a permission instead, which'll work.

Fix super authorization in AssetFolderPolicy
b365909

duncanmcclean commented Feb 28, 2025
View reviewed changes

Comment threadsrc/Providers/AuthServiceProvider.php Outdated

duncanmcclean added 2 commits March 6, 2025 15:13

Merge remote-tracking branch 'origin/master' into super-user-authoriz…
f23a4c9
…ation

Return early when permissions have already been booted.
3ce7705

duncanmcclean marked this pull request as ready for review March 6, 2025 15:25

jasonvarga requested changes Mar 6, 2025
View reviewed changes

Comment threadsrc/Providers/AuthServiceProvider.php Outdated

Move super user check to Gate::after()
88e702f

duncanmcclean force-pushed the super-user-authorization branch from 1136551 to 88e702fCompare March 7, 2025 12:46

duncanmcclean added 3 commits March 7, 2025 14:47

Refactor super user / permission check
d9b9567

Re-work the logic a little to allow for wildcard permissions
1327752

Register permission in test
ee19523

duncanmcclean requested a review from jasonvarga March 7, 2025 16:13

jasonvarga added 6 commits March 11, 2025 14:42

Merge branch 'master' into super-user-authorization
7abb312

Test for booting once
de15f90

nitpick
f59a7e4

Add gate tests
0803113

Add a flattened method and use that to check if a given permission is…
99d8acf
… a statamic one

fix test failures ...
ca39b67
Since more stuff gets evaluated now (all the permissions are compiled) all the sites will be looped over. Many tests were setting up sites without explicit names. They don't really need them so here the site name will fall back to the handle.

jasonvarga added 3 commits March 13, 2025 10:07

These tests aren't concerned with permissions so just remove the cans…
34d421c
… instead

Test gate should not explicitly deny
705cc02

User clearer names
fd7b7cb

jasonvarga added 5 commits March 13, 2025 11:03

Avoid even checking if user has permission if that ability is not a r…
2de3e31
…egistered statamic permission

Bring back existing can() usage, but with an actual gate policy, sinc…
c04820e
…e we want code coverage for that.

Don't just register the successful one, and add a note.
3e87ca5

Make chainable
691a0a8

Explain
91162f8

jasonvarga changed the title ~~[6.x] Re-work super user authorization check~~[6.x] Update authorization / permissionsMar 13, 2025

jasonvarga merged commit a8726dd into masterMar 13, 2025

jasonvarga deleted the super-user-authorization branch March 13, 2025 15:23

This was referenced Mar 13, 2025
Can't use Nova, Telescope Gate in Laravel #8337
Closed
Global Gate::before() checks affect Laravel policy checks outside of Statamic #10832
Closed

This was referenced Sep 2, 2025
[6.x] Cache flattened permissions #12258
Merged
[6.x] Fix permission labels not being localized correctly #12316
Merged

duncanmcclean added 9 commits February 28, 2025 11:17

Only perform super user check in Gate::before() when ability is a S…
7aa69fa
…tatamic permission

Ensure permissions are booted before authorization is handled
39a696e
Otherwise, when the `Authorize` middleware checks if the user has access to the CP, `Permission:all()` in the `Gate::before()` closure won't return any permissions as they haven't been booted yet.

Remove commented out dd() from middleware 😄
f34eafa

Add super user check to the before method in authorization policies.
639a059

Ensure permissions exist, otherwise the super user check will fail.
8fa1c6b

Move the middleware back to where they were originally.
1b91834

Boot permissions in Gate::before() method...
7770675
Until I figure out a better solution. 🤔

Update an existing test
1995374
Since there's no `DroidsClass` policy, I've updated this test to authorize using a permission instead, which'll work.

Fix super authorization in AssetFolderPolicy
b365909

duncanmcclean commented Feb 28, 2025
View reviewed changes

Comment threadsrc/Providers/AuthServiceProvider.php Outdated

duncanmcclean added 2 commits March 6, 2025 15:13

Merge remote-tracking branch 'origin/master' into super-user-authoriz…
f23a4c9
…ation

Return early when permissions have already been booted.
3ce7705

duncanmcclean marked this pull request as ready for review March 6, 2025 15:25

jasonvarga requested changes Mar 6, 2025
View reviewed changes

Comment threadsrc/Providers/AuthServiceProvider.php Outdated

Move super user check to Gate::after()
88e702f

duncanmcclean force-pushed the super-user-authorization branch from 1136551 to 88e702fCompare March 7, 2025 12:46

duncanmcclean added 3 commits March 7, 2025 14:47

Refactor super user / permission check
d9b9567

Re-work the logic a little to allow for wildcard permissions
1327752

Register permission in test
ee19523

duncanmcclean requested a review from jasonvarga March 7, 2025 16:13

jasonvarga added 6 commits March 11, 2025 14:42

Merge branch 'master' into super-user-authorization
7abb312

Test for booting once
de15f90

nitpick
f59a7e4

Add gate tests
0803113

Add a flattened method and use that to check if a given permission is…
99d8acf
… a statamic one

fix test failures ...
ca39b67
Since more stuff gets evaluated now (all the permissions are compiled) all the sites will be looped over. Many tests were setting up sites without explicit names. They don't really need them so here the site name will fall back to the handle.

jasonvarga added 3 commits March 13, 2025 10:07

These tests aren't concerned with permissions so just remove the cans…
34d421c
… instead

Test gate should not explicitly deny
705cc02

User clearer names
fd7b7cb

jasonvarga added 5 commits March 13, 2025 11:03

Avoid even checking if user has permission if that ability is not a r…
2de3e31
…egistered statamic permission

Bring back existing can() usage, but with an actual gate policy, sinc…
c04820e
…e we want code coverage for that.

Don't just register the successful one, and add a note.
3e87ca5

Make chainable
691a0a8

Explain
91162f8

jasonvarga changed the title ~~[6.x] Re-work super user authorization check~~[6.x] Update authorization / permissionsMar 13, 2025

jasonvarga merged commit a8726dd into masterMar 13, 2025

jasonvarga deleted the super-user-authorization branch March 13, 2025 15:23

This was referenced Mar 13, 2025
Can't use Nova, Telescope Gate in Laravel #8337
Closed
Global Gate::before() checks affect Laravel policy checks outside of Statamic #10832
Closed

This was referenced Sep 2, 2025
[6.x] Cache flattened permissions #12258
Merged
[6.x] Fix permission labels not being localized correctly #12316
Merged

duncanmcclean added 9 commits February 28, 2025 11:17

Only perform super user check in Gate::before() when ability is a S…
7aa69fa
…tatamic permission

Ensure permissions are booted before authorization is handled
39a696e
Otherwise, when the `Authorize` middleware checks if the user has access to the CP, `Permission:all()` in the `Gate::before()` closure won't return any permissions as they haven't been booted yet.

Remove commented out dd() from middleware 😄
f34eafa

Add super user check to the before method in authorization policies.
639a059

Ensure permissions exist, otherwise the super user check will fail.
8fa1c6b

Move the middleware back to where they were originally.
1b91834

Boot permissions in Gate::before() method...
7770675
Until I figure out a better solution. 🤔

Update an existing test
1995374
Since there's no `DroidsClass` policy, I've updated this test to authorize using a permission instead, which'll work.

Fix super authorization in AssetFolderPolicy
b365909

duncanmcclean commented Feb 28, 2025
View reviewed changes

Comment threadsrc/Providers/AuthServiceProvider.php Outdated

duncanmcclean added 2 commits March 6, 2025 15:13

Merge remote-tracking branch 'origin/master' into super-user-authoriz…
f23a4c9
…ation

Return early when permissions have already been booted.
3ce7705

duncanmcclean marked this pull request as ready for review March 6, 2025 15:25

jasonvarga requested changes Mar 6, 2025
View reviewed changes

Comment threadsrc/Providers/AuthServiceProvider.php Outdated

Move super user check to Gate::after()
88e702f

duncanmcclean force-pushed the super-user-authorization branch from 1136551 to 88e702fCompare March 7, 2025 12:46

duncanmcclean added 3 commits March 7, 2025 14:47

Refactor super user / permission check
d9b9567

Re-work the logic a little to allow for wildcard permissions
1327752

Register permission in test
ee19523

duncanmcclean requested a review from jasonvarga March 7, 2025 16:13

jasonvarga added 6 commits March 11, 2025 14:42

Merge branch 'master' into super-user-authorization
7abb312

Test for booting once
de15f90

nitpick
f59a7e4

Add gate tests
0803113

Add a flattened method and use that to check if a given permission is…
99d8acf
… a statamic one

fix test failures ...
ca39b67
Since more stuff gets evaluated now (all the permissions are compiled) all the sites will be looped over. Many tests were setting up sites without explicit names. They don't really need them so here the site name will fall back to the handle.

jasonvarga added 3 commits March 13, 2025 10:07

These tests aren't concerned with permissions so just remove the cans…
34d421c
… instead

Test gate should not explicitly deny
705cc02

User clearer names
fd7b7cb

jasonvarga added 5 commits March 13, 2025 11:03

Avoid even checking if user has permission if that ability is not a r…
2de3e31
…egistered statamic permission

Bring back existing can() usage, but with an actual gate policy, sinc…
c04820e
…e we want code coverage for that.

Don't just register the successful one, and add a note.
3e87ca5

Make chainable
691a0a8

Explain
91162f8

jasonvarga changed the title ~~[6.x] Re-work super user authorization check~~[6.x] Update authorization / permissionsMar 13, 2025

jasonvarga merged commit a8726dd into masterMar 13, 2025

jasonvarga deleted the super-user-authorization branch March 13, 2025 15:23

This was referenced Mar 13, 2025
Can't use Nova, Telescope Gate in Laravel #8337
Closed
Global Gate::before() checks affect Laravel policy checks outside of Statamic #10832
Closed

This was referenced Sep 2, 2025
[6.x] Cache flattened permissions #12258
Merged
[6.x] Fix permission labels not being localized correctly #12316
Merged

Uh oh!

Uh oh!

Conversation

duncanmcclean commented Feb 28, 2025• edited by jasonvarga Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jasonvarga commented Mar 13, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

duncanmcclean commented Feb 28, 2025• edited by jasonvarga Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jasonvarga commented Mar 13, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

duncanmcclean commented Feb 28, 2025• edited by jasonvarga Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jasonvarga commented Mar 13, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

duncanmcclean commented Feb 28, 2025• edited by jasonvarga Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jasonvarga commented Mar 13, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

duncanmcclean commented Feb 28, 2025• edited by jasonvarga Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

duncanmcclean commented Feb 28, 2025•
edited by jasonvarga
Loading

duncanmcclean commented Feb 28, 2025•
edited by jasonvarga
Loading

duncanmcclean commented Feb 28, 2025•
edited by jasonvarga
Loading

duncanmcclean commented Feb 28, 2025•
edited by jasonvarga
Loading

duncanmcclean commented Feb 28, 2025•
edited by jasonvarga
Loading

duncanmcclean commented Feb 28, 2025•
edited by jasonvarga
Loading

duncanmcclean commented Feb 28, 2025•
edited by jasonvarga
Loading