Policy not evaluated or reflected in UI for repeaters

[davidbankes]

• Laravel Version: 10.45.1
• Nova Version: 4.32.13
• PHP Version: 8.2.16
• Database Driver & Version:
• Operating System and Version: MacOs 14.2.1
• Browser type and version: FF 122.01
• Reproduction Repository: N/A

Description:

I have a parent model/resource with a HasMany relation. I have two UIs to manage the child relation: a HasMany field on the parent resource, and a Repeater on the parent resource. Both refer to the same underlying model.

The HasMany relation will reflect the associated Policy (e.g., the delete button will disappear if the nova user lacks permission to delete the resource). But on the repeater, all UI remains.

Detailed steps to reproduce the issue on a fresh Nova installation:

1. Create a model & resource with a HasMany model & resource.
2. Create a policy for the child resource that disallows, e.g., creation or deletion.
3. Create a Repeater for the child resource on the parent. Note that it still has UI for creation and deletion of models.

[crynobone]

Resources are saved within database transaction, and we need to check policy while looping each repeater row. if we implement this the whole save needs to be reverted upon authorization failure.