Standalone actions ignores resource policy

[Nks]

• Laravel Version: 9.20.0
• Nova Version: 4.12.6
• PHP Version: 8.1.8
• Database Driver & Version: percona:8.0.26-16
• Operating System and Version: Debian GNU/Linux 10
• Browser type and version: Any

Description:

Following this documentation for the actions when using an Action in standalone mode and Policy for a model with a runAction method, the Policy is ignored and is not executed. For inline actions or "mass selection" everything works as expected.

Detailed steps to reproduce the issue on a fresh Nova installation:

• Create any action with nova:action ActionName
• Add action to actions method of the resource:

public function actions(NovaRequest $request)
  {
      return [
          (new Actions\ActionName)->standalone(),
      ];
  }

• Create a model policy with php artisan make:policy
• Add following code to created policy:

public function runAction(Model $model, $action): bool
{
    return false;
}

• Run action from the resource list page

Expected result:

• Actions can not be run by the user

Actual result:

• Actions executing

[crynobone]

Laravel Policy can only be executed against a model and standalone action doesn't have any model to check against.

[hivokas]

@crynobone looks like canRun() callback is also ignored for standalone actions. Is it expected?

[crynobone]

Yes, because there no selected model to authorized to.

[hivokas]

Got it, thanks. I think a note in documentation that standalone actions are not authorizable would be a good precaution.

[hivokas]

Here is my use-case:

(new RunSqlInReadOnlyMode)
  ->standalone()
  ->canRun(fn () => auth()->user()->hasPermission('can-run-sql-in-read-only-mode')),

I genuinely expected it to work, and randomly discovered that it didn't work.

[crynobone]

you should use canSee().