ActionEvents logs no longer applying Policies

[WillyReyno]

• Laravel Version: 11.44.0
• Nova Version: 5.2.6, but applies to all versions of Nova 5.
• PHP Version: 8.3.2
• Database Driver & Version: MySQL 8.0
• Operating System and Version: Ubuntu (Docker)
• Browser type and version: Chrome 133.0.6943.127

Description:

Since upgrading to Laravel Nova 5, Policies no longer applies to Nova ActionEvents. All Nova users are able to see ActionEvent history of a resource regardless of the rules set in the Policy.

Tested with multiple Nova 5 versions.
Works fine with Laravel Nova 4.35.6.

Detailed steps to reproduce the issue on a fresh Nova installation:

• Install Laravel Nova 5
• Create a Resource and add the Laravel\Nova\Actions\Actionable trait to its Model
• Create an ActionEventPolicy and return false in every method
• Declare the policy in AuthServiceProvider.php

protected $policies = [
        Laravel\Nova\Actions\ActionEvent::class => ActionEventPolicy::class,
];

• Open the resource and see the Action Events block visible, regardless of the Policy's method returning false.

[crynobone]

use App\Policies\ActionEventPolicy;

// ...

public function register(): void 
{
    \Laravel\Nova\Actions\ActionResource::$policy = ActionEventPolicy::class;
}

[crynobone]

setting the property to null should also work

[WillyReyno]

It works, thank you!

Is there a recommended file/method to call this from?

[crynobone]

I would recommend on the register() method in NovaServiceProvider