Add support for generating policies

[faustbrian]

Resolves #42

Questions

• Should we include some boilerplate like https://laravel.com/docs/10.x/authorization#customising-policy-response-status in the stubs? Might save users a bit of typing since most policies follow the same structures of user_id, team_id or role checks.

Description

• When meta.policies=true is specified then controller authorization according to https://laravel.com/docs/10.x/authorization#authorizing-resource-controllers will be generated and a policy class with all supported methods will be generated.
• When meta.policies=method,method,method is specified then controller authorization according to https://laravel.com/docs/10.x/authorization#authorizing-actions-using-policies will be generated and a policy class with the specified methods will be generated.
• Generating policy classes based on the given configuration

Examples

authorizeResource

Input

models:
  Ticket:
    team_id: id foreign
    type: string nullable
    subtype: string nullable
    name: string
    slug: string

controllers:
  Ticket:
    index:
      query: all:tickets
      render: ticket.index with:tickets
    create:
      render: ticket.create
    store:
      validate: title, content
      save: ticket
      send: ReviewNotification to:ticket.author with:ticket
      dispatch: SyncMedia with:ticket
      fire: NewTicket with:ticket
      flash: ticket.id
      redirect: ticket.index
    show:
      render: ticket.show with:ticket
    edit:
      render: ticket.edit with:ticket
    update:
      validate: ticket
      update: ticket
      flash: ticket.id
      redirect: ticket.index
    destroy:
      delete: ticket
      flash: ticket.id
      redirect: ticket.index
    meta:
      policies: true

Output

<?php

namespace App\Http\Controllers;

use App\Events\NewTicket;
use App\Http\Requests\TicketStoreRequest;
use App\Http\Requests\TicketUpdateRequest;
use App\Jobs\SyncMedia;
use App\Models\Ticket;
use Illuminate\Http\RedirectResponse;
use Illuminate\Http\Request;
use Illuminate\View\View;

class TicketController extends Controller
{
    public function __construct()
    {
        $this->authorizeResource(Ticket::class, 'ticket');
    }

    public function index(Request $request): View
    {
        $tickets = Ticket::all();

        return view('ticket.index', compact('tickets'));
    }

    public function create(Request $request): View
    {
        return view('ticket.create');
    }

    public function store(TicketStoreRequest $request): RedirectResponse
    {
        $ticket = Ticket::create($request->validated());


        SyncMedia::dispatch($ticket);

        event(new NewTicket($ticket));

        $request->session()->flash('ticket.id', $ticket->id);

        return redirect()->route('ticket.index');
    }

    public function show(Request $request, Ticket $ticket): View
    {
        return view('ticket.show', compact('ticket'));
    }

    public function edit(Request $request, Ticket $ticket): View
    {
        return view('ticket.edit', compact('ticket'));
    }

    public function update(TicketUpdateRequest $request, Ticket $ticket): RedirectResponse
    {
        $ticket->update($request->validated());

        $request->session()->flash('ticket.id', $ticket->id);

        return redirect()->route('ticket.index');
    }

    public function destroy(Request $request, Ticket $ticket): RedirectResponse
    {
        $ticket->delete();

        $request->session()->flash('ticket.id', $ticket->id);

        return redirect()->route('ticket.index');
    }
}

policies

Input

models:
  Ticket:
    team_id: id foreign
    type: string nullable
    subtype: string nullable
    name: string
    slug: string

controllers:
  Ticket:
    index:
      query: all:tickets
      render: ticket.index with:tickets
    create:
      render: ticket.create
    store:
      validate: title, content
      save: ticket
      send: ReviewNotification to:ticket.author with:ticket
      dispatch: SyncMedia with:ticket
      fire: NewTicket with:ticket
      flash: ticket.id
      redirect: ticket.index
    show:
      render: ticket.show with:ticket
    edit:
      render: ticket.edit with:ticket
    update:
      validate: ticket
      update: ticket
      flash: ticket.id
      redirect: ticket.index
    destroy:
      delete: ticket
      flash: ticket.id
      redirect: ticket.index
    meta:
      policies: index,create,store,show,edit,update,destroy

Output

<?php

namespace App\Http\Controllers;

use App\Events\NewTicket;
use App\Http\Requests\TicketStoreRequest;
use App\Http\Requests\TicketUpdateRequest;
use App\Jobs\SyncMedia;
use App\Models\Ticket;
use Illuminate\Http\RedirectResponse;
use Illuminate\Http\Request;
use Illuminate\View\View;

class TicketController extends Controller
{
    public function index(Request $request): View
    {
        $this->authorize('index', Ticket::class);

        $tickets = Ticket::all();

        return view('ticket.index', compact('tickets'));
    }

    public function create(Request $request): View
    {
        $this->authorize('create', Ticket::class);

        return view('ticket.create');
    }

    public function store(TicketStoreRequest $request): RedirectResponse
    {
        $this->authorize('store', Ticket::class);


        $ticket = Ticket::create($request->validated());


        SyncMedia::dispatch($ticket);

        event(new NewTicket($ticket));

        $request->session()->flash('ticket.id', $ticket->id);

        return redirect()->route('ticket.index');
    }

    public function show(Request $request, Ticket $ticket): View
    {
        $this->authorize('show', Ticket::class);

        return view('ticket.show', compact('ticket'));
    }

    public function edit(Request $request, Ticket $ticket): View
    {
        $this->authorize('edit', $ticket);

        return view('ticket.edit', compact('ticket'));
    }

    public function update(TicketUpdateRequest $request, Ticket $ticket): RedirectResponse
    {
        $this->authorize('update', $ticket);


        $ticket->update($request->validated());

        $request->session()->flash('ticket.id', $ticket->id);

        return redirect()->route('ticket.index');
    }

    public function destroy(Request $request, Ticket $ticket): RedirectResponse
    {
        $this->authorize('destroy', $ticket);

        $ticket->delete();

        $request->session()->flash('ticket.id', $ticket->id);

        return redirect()->route('ticket.index');
    }
}

[jasonmccreary]

I really don't like adding more config. Can these be packed down into one config? For example, the default is to use controller authorization unless meta.policies is true? Or vice-versa.

[faustbrian]

Sure. Do you have a list of possible values for the meta.policies property or should it just be true results in authorizeResource being used and otherwise the specified methods are used?

Edit: Updated the OP with the new syntax.

[jasonmccreary]

Nice. I'll need to update the docs once this is tagged. But I like the syntax.

[faustbrian]

Added tests for all the new lexers and generators.

[jasonmccreary]

See comment.

[faustbrian]

@jasonmccreary think I made all requested changes