Laravel 9中ProductPolicy始终返回‘This action is unauthorized’求助

环境信息 #

• Laravel版本：9
• PHP版本：8.1.1

问题描述 #

我为Product模型创建了ProductPolicy，希望每次验证用户是否具备更新/删除产品的权限，但在ProductController中执行授权操作时，始终返回提示This action is unauthorized。

我使用了默认Request类，并已在AuthServiceProvider中完成模型与策略的绑定。以下是相关文件代码：

相关代码 #

api.php #

Route::group([
    'prefix' => 'token/{token}',
    'middleware' => 'token'
], function () {
    Route::apiResource('category', \App\Http\Controllers\Category\CategoryController::class);
    Route::apiResource('product', \App\Http\Controllers\Product\ProductController::class);
});

ProductController #

namespace App\Http\Controllers\Product;

use App\Facades\CurrentBot;
use App\Http\Controllers\Controller;
use App\Models\Bot;
use App\Models\Product;
use Illuminate\Auth\Access\AuthorizationException;
use Illuminate\Database\Eloquent\Builder;

class ProductController extends Controller
{
    /**
     * Update the specified resource in storage.
     *
     * @param Request $request
     * @param Product $product
     * @return Response
     * @throws AuthorizationException
     */
    public function update(Request $request, Product $product)
    {
        $this->authorize('update', [$product]);

        $request->validate([
            'name' => 'string',
            'description' => 'string',
            'amount' => 'numeric',
            'thumb' => 'file|max:2048'
        ]);

        $product->fill($request->all());

        if ($request->file('thumb')) {
            $save = $request->file('thumb')->store('/public/images');
            $product->thumb = $save;
        }

        return response($product->save());
    }
}

Product 模型 #

namespace App\Models;

use Illuminate\Database\Eloquent\Factories\HasFactory;
use Illuminate\Database\Eloquent\Model;

class Product extends Model
{
    use HasFactory;

    protected $fillable = [
        'name',
        'description',
        'thumb',
        'amount',
        'category_id'
    ];
}

ProductPolicy #

namespace App\Policies;

use App\Facades\CurrentBot;
use App\Models\Product;
use App\Models\User;
use Illuminate\Auth\Access\HandlesAuthorization;
use Illuminate\Auth\Access\Response;
use Illuminate\Database\Eloquent\Builder;

class ProductPolicy
{
    use HandlesAuthorization;

    /**
     * Determine whether the user can update the model.
     *
     * @param User $user
     * @param Product $product
     * @return Response|bool
     */
    public function update(User $user, Product $product): Response|bool
    {
        return CurrentBot::me()->categories()->whereHas('products',  function (Builder $query) use ($product) {
            return $query->where('id', $product->id);
        })->exists();
    }
}

已尝试的解决方案 #

我已查阅资料，常见解决方案有两种：

• 在自定义Request类中将authorize方法设为false；
• 在AuthServiceProvider中绑定模型与策略类。

我已在AuthServiceProvider中完成如下绑定，但问题仍未解决：

protected $policies = [
    Product::class => ProductPolicy::class,
];

内容的提问来源于stack exchange，提问作者Milly Khamroev