Authorizable actions

[jacksleight]

It would be great if Filament could authorize actions in the same way it already authorises the main model methods when a policy exists. I've implemented this in a very basic way using a custom ButtonAction class:

namespace App\Filament\Pages\Actions;

use Filament\Pages\Actions\ButtonAction as FilamentButtonAction;
use Illuminate\Support\Str;

class ButtonAction extends FilamentButtonAction
{
    protected bool $isAuthorizationRequired = false;

    public function requiresAuthorization(bool $condition = true): static
    {
        $this->isAuthorizationRequired = $condition;

        return $this;
    }

    public function isAuthorizationRequired(): bool
    {
        return $this->isAuthorizationRequired;
    }

    public function isAuthorized(): bool
    {
        if (! $this->isAuthorizationRequired) {
            return true;
        }

        return auth()->user()->can(Str::camel($this->name), $this->livewire->record);
    }

    public function isHidden(): bool
    {
        if (! $this->isAuthorized()) {
            return true;
        }

        return parent::isHidden();
    }
}

Then you just call requiresAuthorization() on the button and isHidden() will check whether it's authorized. Because call() also checks isHidden() executing the action is also blocked (although a 403 response would probably be better there).

I was going to submit a PR but I'm sure my solution here isn't ideal, and there are probably various ways this could be implemented.

[ryangjchandler]

Can you not just use the ->hidden() method instead?

[jacksleight]

Totally, this would just be a shortcut/convenience really. Turns this:

ButtonAction::make('sign_off')
    ->hidden(auth()->user()->cannot('sign_off', $this->record))
    ->action(...);

Into this:

ButtonAction::make('sign_off')
    ->requiresAuthorization()
    ->action(...);

Now I'm looking at it this isn't really saving much 😂 .

In my actual use case I have additional conditions in hidden(), so it somewhat simplifies that and helps separate the "hiding because the user isn't authorised" condition from the "hiding because the action isn't applicable" conditions, makes it a bit more readable. But that's probably a bit niche to be fair!

[ryangjchandler]

Yeah, I'd probably hold off for now until there's a bit more demand for it. Are the actions macroable?

[jacksleight]

Ah they are macroable yeah, I could implement something similar that way. Cheers.

[danharrin]

Tbh, the only way I could see this being useful is if you could do ->authorize('actionName', [optional extra policy params]) which calls auth()->user()->can('actionName', [record [extra params]]) under the hood.