Laravel Policy (Too few arguments to function App\Policy) - php

Question

I am trying to setup my policy for users. However I keep on getting an error of:
Too few arguments to function App\Policies\UserPolicy::update(), 1 passed in /vendor/laravel/framework/src/Illuminate/Auth/Access/Gate.php on line 481 and exactly 2 expected (View: /resources/views/users/index.blade.php)
ErrorException /app/Policies/UserPolicy.php 20
which is on the UserPolicy#update function
When I am logged in as super_admin, it works fine but it throws this error whenever I am logged in as a user of different role.
Below is my current implementation:
UserPolicy
class UserPolicy
{
use HandlesAuthorization;
public function update(User $user, User $userEdit) {
if ($user->id == $userEdit->id) {
return true;
}
return $user->can('update_user');
}
public function before($user, $ability) {
if ($user->hasRole('super_admin')) {
return true;
}
}
}
UsersController
class UsersController extends Controller {
public function __construct() {
$this->middleware('auth');
}
public function edit(User $user) {
$this->authorize('update', $user);
return view('users.edit', [
'user' => User::with('roles', 'level')->find($user->id),
'surveys' => \App\Survey::all(),
]);
}
public function update(UserRequest $request, User $user) {
$this->authorize('update', $user);
$request->save();
session()->flash('success', 'User successfully updated');
// means user is editing his own profile
if (auth()->id() == $user->id) {
return redirect('/dashboard');
} else {
return redirect('/users');
}
}
}
UserRequest
class UserRequest extends FormRequest {
public function authorize() {
return true;
}
public function rules() {
switch ($this->method()) {
case 'POST':
return [
'name' => 'required|string',
'email' => 'required|string|email|max:255|unique:users',
'role' => 'required|exists:roles,id',
'level' => 'required|string',
];
break;
case 'PATCH':
return [
'name' => 'required|string|max:255',
'email' => 'required|string|email|max:255|unique:users,email,'.$this->user->id,
'role' => 'sometimes|exists:roles,id',
'level' => 'sometimes|string',
'password' => 'nullable|sometimes|string|min:6|confirmed'
];
break;
default:
break;
}
}
public function save() {
switch (request()->method()) {
case 'POST':
$this->createUser();
break;
case 'PATCH':
$this->updateUser();
break;
default:
break;
}
}
protected function createUser() {
// random generate password
$password = str_random(8);
$user = User::create([
'name' => request('name'),
'email' => request('email'),
'level_id' => request('level'),
'password' => Hash::make($password),
]);
$user->assignRoleById(request('role'));
Mail::to($user)->send(new WelcomeMail($user, $password));
}
protected function updateUser() {
$user = User::findOrFail($this->user->id);
$user->name = request('name');
$user->email = request('email');
if (request('password') != '') {
$user->password = Hash::make(request('password'));
}
if (request('level') != '') {
$user->level_id = request('level');
}
$user->update();
if (request('role') != '') {
$user->roles()->sync([request('role')]);
}
}
}
AuthServiceProvider
class AuthServiceProvider extends ServiceProvider
{
/**
* The policy mappings for the application.
*
* #var array
*/
protected $policies = [
\App\User::class => \App\Policies\UserPolicy::class,
];
/**
* Register any authentication / authorization services.
*
* #return void
*/
public function boot()
{
$this->registerPolicies();
foreach ($this->getPermissions() as $permission) {
Gate::define($permission->name, function($user) use ($permission) {
return $user->hasRole($permission->roles);
});
}
}
protected function getPermissions() {
return Permission::with('roles')->get();
}
}

Answer 1

In my views file I'm calling
#can('update', App\User::class)
<!-- html code --!>
#endcan
instead of
#can('update', $user)
<!-- html code --!>
#endcan
I was not passing the user instance into the function which was causing the error.

Answer 2

In UserRequest you haven't given any parameters when you call $user->update();. The update() function requires for a UserRequest instance, as well as a User.
Give this a try: $user->update(request()->all(), $user)
Edit:
I would just move the following...
$this->authorize('update', $user);
$request->save();
session()->flash('success', 'User successfully updated');
// means user is editing his own profile
if (auth()->id() == $user->id) {
return redirect('/dashboard');
} else {
return redirect('/users');
}
...to the updateUser() function.