MenuItem ignores Policies

[Muetze42]

• Laravel Version: #.#.#
• Nova Version: 4.0.0
• PHP Version: 8.0.9 (local) / 8.1.3 (production)

I create a menu:

                MenuSection::make(__('Products'), [
                    MenuItem::resource(Product::class),
                ])

Policiy:

class ProductPolicy
{
    use HandlesAuthorization;

    /**
     * Determine whether the user can view any models.
     *
     * @param  User  $user
     * @return bool
     */
    public function viewAny(User $user): bool
    {
        return false;
    }

Even if you do not have the rights to see the resource, it is displayed in the menu and when you call it, a 403 message appears.

[crynobone]

Menu by itself doesn't have any knowledge about policy at the moment. But will look into it soon.

[vv-ac]

Will appreciate that, not having the possibility to provide policy logic to a self created menu kills any access logic that has more than one dimension.

[davidhemphill]

👋 Hi there! In order to keep this repository focused on bug reports, we auto-close feature requests and requests for help. Feel free to post your feature requests so others can discuss and add reactions. We'll keep an eye on them for later planning.

[Muetze42]

I have first created a solution, which works for me....
https://novapackages.com/packages/norman-huth/nova-menu

[crynobone]

This has been implemented in 4.2.5. You can use MenuItem::canSee() and it's automatically applied for MenuItem::dashboard() and MenuItem::resource().