Authorizing Attaching / Detaching not working

[Sergej-Tihonov]

• Laravel Version: 9.24.0
• Nova Version: 4.12.14
• PHP Version: 8.1

Description:

I have a Many-To-Many relation where I want prevent the attachment and detachment.
The relation works fine and I have created policy methods related to the documentation: https://nova.laravel.com/docs/4.0/resources/authorization.html#authorizing-attaching-detaching

Both methods in the policy are called and false is returned, but it is ignored.
The attach button is shown and I can attach the model.

Is there something that prevents it or is it a bug?

p.s.: I have a pivot table in between with simple int value. Looks like, that it does not makes a difference

On another model I have Belongs-To relation, there the policy add{Model} works fine.

Detailed steps to reproduce the issue on a fresh Nova installation:

Here my related classes to understand the situation:

class SchoolYear extends Model
{
    public function schools(): BelongsToMany
    {
        return $this->belongsToMany(School::class)
            ->using(SchoolSchoolYear::class)
            ->withPivot([
                'participants',
            ]);
    }
}

class School extends Model
{
    public function schoolYears(): BelongsToMany
    {
        return $this->belongsToMany(SchoolYear::class)
            ->using(SchoolSchoolYear::class)
            ->withPivot([
                'participants',
            ]);
    }
}

class SchoolYear extends Resource
{
    public function fields(NovaRequest $request): array
    {
        return [            
            BelongsToMany::make(__('nova.school.plural'), 'schools', School::class)
                ->fields(new SchoolSchoolYearFields()),
        ];
    }
}

class School extends Resource
{
    public function fields(NovaRequest $request): array
    {
        return [
            BelongsToMany::make(__('nova.school_year.plural'), 'schoolYears', SchoolYear::class)
                ->fields(new SchoolSchoolYearFields()),
        ];
    }
}

Here just the relevant part of the policies. All the other methods are returning true.

class SchoolPolicy
{
    use HandlesAuthorization;

    public function attachSchoolYear(User $user, School $school, SchoolYear $schoolYear): bool
    {
        return false;
    }

    public function detachSchoolYear(User $user, School $school, SchoolYear $schoolYear): bool
    {
        return false;
    }
}

class SchoolYearPolicy
{
    use HandlesAuthorization;

    public function attachSchool(User $user, SchoolYear $schoolYear, School $school): bool
    {
        return false;
    }

    public function detachSchool(User $user, SchoolYear $schoolYear, School $school): bool
    {
        return false;
    }
}

[crynobone]

you need to use attachAnySchool and attachAnySchoolYear to prevent attaching any. attach{Model} is used to filter the dropdown on the attaching page.

[Sergej-Tihonov]

@crynobone thank you very much. Changed to attachAny{Model} and it works like expected.
Missed that part totally in the documentation. My bad.