custom action with nested canSee and canRun showing 404

[shimaxu]

• Laravel Version: ^9.19
• Nova Version: ~4.0
• PHP Version: ^8.0.2
• Database Driver & Version: Ver 8.0.23 for osx10.16 on x86_64
• Operating System and Version: macOS Monterey 12.6 (21G115)
• Browser type and version: Google Chrome Version 105.0.5195.125 (Official Build) (x86_64)

Description:

Hello,

I am having difficulties running custom action by overriding laravel policies using canSee and canRun method in my custom action.

I am occurring this issue when i compare multiple edge cases using && comparison operators inside canSee and canRun callback function. See the detailed steps below

Detailed steps to reproduce the issue on a fresh Nova installation:

I have create a LeavePolicy as follow:

<?php

namespace App\Policies;

use App\Models\Leave;
use App\Models\User;
use Illuminate\Auth\Access\HandlesAuthorization;

class LeavePolicy
{
    use HandlesAuthorization;

    /**
     * Determine whether the user can view any models.
     *
     * @param  \App\Models\User  $user
     * @return \Illuminate\Auth\Access\Response|bool
     */
    public function viewAny(User $user)
    {
        return true;
    }

    /**
     * Determine whether the user can view the model.
     *
     * @param  \App\Models\User  $user
     * @param  \App\Models\Leave  $leave
     * @return \Illuminate\Auth\Access\Response|bool
     */
    public function view(User $user, Leave $leave)
    {
        return true;
    }

    /**
     * Determine whether the user can create models.
     *
     * @param  \App\Models\User  $user
     * @return \Illuminate\Auth\Access\Response|bool
     */
    public function create(User $user)
    {
        return false;
    }

    /**
     * Determine whether the user can update the model.
     *
     * @param  \App\Models\User  $user
     * @param  \App\Models\Leave  $leave
     * @return \Illuminate\Auth\Access\Response|bool
     */
    public function update(User $user, Leave $leave)
    {
        return false;
    }

    /**
     * Determine whether the user can delete the model.
     *
     * @param  \App\Models\User  $user
     * @param  \App\Models\Leave  $leave
     * @return \Illuminate\Auth\Access\Response|bool
     */
    public function delete(User $user, Leave $leave)
    {
        return false;
    }

    /**
     * Determine whether the user can restore the model.
     *
     * @param  \App\Models\User  $user
     * @param  \App\Models\Leave  $leave
     * @return \Illuminate\Auth\Access\Response|bool
     */
    public function restore(User $user, Leave $leave)
    {
        return false;
    }

    /**
     * Determine whether the user can permanently delete the model.
     *
     * @param  \App\Models\User  $user
     * @param  \App\Models\Leave  $leave
     * @return \Illuminate\Auth\Access\Response|bool
     */
    public function forceDelete(User $user, Leave $leave)
    {
        return false;
    }

}

Approve Action:

<?php

namespace App\Nova\Actions;

use App\Enums\LeaveStatus;
use Illuminate\Bus\Queueable;
use Illuminate\Queue\InteractsWithQueue;
use Illuminate\Support\Collection;
use Laravel\Nova\Actions\Action;
use Laravel\Nova\Fields\ActionFields;
use Laravel\Nova\Http\Requests\NovaRequest;

class Approve extends Action
{
    use InteractsWithQueue, Queueable;

    /**
     * Perform the action on the given models.
     *
     * @param  \Laravel\Nova\Fields\ActionFields  $fields
     * @param  \Illuminate\Support\Collection  $models
     * @return mixed
     */
    public function handle(ActionFields $fields, Collection $models)
    {
        foreach ($models as $model) {
            $model->update(['status' => LeaveStatus::Approved]);
        }
        return Action::message('Leave Approved!');
    }

    /**
     * Get the fields available on the action.
     *
     * @param  \Laravel\Nova\Http\Requests\NovaRequest  $request
     * @return array
     */
    public function fields(NovaRequest $request)
    {
        return [];
    }
}

Registered Action in Leave Resource

    /**
     * Get the actions available for the resource.
     *
     * @param \Laravel\Nova\Http\Requests\NovaRequest $request
     * @return array
     */
    public function actions(NovaRequest $request)
    {
        return [
           (new Actions\Approve)
               ->confirmText('Are you sure you want to approve this leave?')
               ->confirmButtonText('Approve')
               ->cancelButtonText("Don't approve")
               ->showInline()
                ->canSee(function ($request) {
                    return $this->leaveType?->required_approval && $request->user()->role == RoleType::Admin && $this->status !== LeaveStatus::Approved;
               })
               ->canRun(function ($request) {
                  return $this->leaveType?->required_approval && $request->user()->role == RoleType::Admin && $this->status !== LeaveStatus::Approved;
               }),

        ];
    }`

[crynobone]

Shouldn't you just do the following:

    /**
     * Get the actions available for the resource.
     *
     * @param \Laravel\Nova\Http\Requests\NovaRequest $request
     * @return array
     */
    public function actions(NovaRequest $request)
    {
        return [
           (new Actions\Approve)
               ->confirmText('Are you sure you want to approve this leave?')
               ->confirmButtonText('Approve')
               ->cancelButtonText("Don't approve")
               ->showInline()
                ->canSee(function ($request) {
                    return true;
               })
               ->canRun(function ($request, $model) {
                  return $model->leaveType?->required_approval 
                      && $request->user()->role == RoleType::Admin 
                      && $model->status !== LeaveStatus::Approved;
               }),

        ];
    }`

[shimaxu]

Thank you @crynobone . it's working now. i thought canSee also i have to give those conditions. but it effects when i write canRun callback. Really Appreciated.