BelongsToMany relationship are not loaded in policy, but works fine on test. How to fix this?

[furatamasensei]

I want to authorize fieldReport to be viewable only by the tagged users, the author of the reporter, and the customer (the company owner). I have problem trying to get the relationship inside the policy to be checked. It always returns an empty array when I dd the relation. My taggedUsers->contains method are always false because of this.

FieldReportPolicy.php

class FieldReportPolicy
{
    use HandlesAuthorization;

    ...

    /**
     * Determine whether the user can view the model.
     *
     * @param  \App\Models\User  $user
     * @param  \App\Models\FieldReport  $fieldReport
     * @return mixed
     */
    public function view(User $user, FieldReport $fieldReport)
    {
        dd($fieldReport->taggedUsers);
        
        return $user->can('view fieldReport')
            && $fieldReport->taggedUsers->contains(['id' => $user->id])
            || $user->id === $fieldReport->user_id
            || $user->getRoleNames()->contains('customer');
    }

    ...
}

Result

Illuminate\Database\Eloquent\Collection {#3262
  #items: []
}

Meanwhile in my test, when I dd the relation, it was there and attached exactly with the proper parent object. How to fix this?

Feature\FieldReportTest.php

class FieldReportTest extends TestCase
{
    ...

    public function testShowShouldBeAccessibleByEmployeeThatAreTagged()
    {
        $company = Company::factory()->createOne([
            'user_id' => $this->user->id,
        ]);

        $branch = Branch::factory()->createOne([
            'user_id' => $company->user_id,
            'company_id' => $company->id
        ]);

        $someone = User::factory()->createOne([
            'company_id' => $company->id,
            'branch_id' => $branch->id,
        ]);

        $someonesReport = FieldReport::factory()->createOne([
            'user_id' => $someone->id,
            'company_id' => $company->id,
            'branch_id' => $branch->id,
        ]);

        $someonesReport->taggedUsers()->attach($this->user->id);

        // Here...
        dd($someonesReport->taggedUsers);

        $this->actingAs($this->user->assignRole('employee'), 'api')
            ->getJson(route('fieldReports.show', $someonesReport))
            ->assertOk()
            ->assertJsonFragment($someonesReport->toArray());
    }

    ...
}

Result

Illuminate\Database\Eloquent\Collection {#4904
  #items: array:1 [
    0 => App\Models\User {#4743
      #fillable: array:8 [
        0 => "subscription_id"
        1 => "company_id"
        2 => "branch_id"
        3 => "department_id"
        4 => "division_id"
        5 => "name"
        6 => "email"
        7 => "password"
      ]
      #hidden: array:2 [
        0 => "password"
        1 => "remember_token"
      ]
      #casts: array:1 [
        "email_verified_at" => "datetime"
      ]
      #connection: "mysql"
      #table: "users"
      #primaryKey: "id"
      #keyType: "int"
      +incrementing: true
      #with: []
      #withCount: []
      #perPage: 15
      +exists: true
      +wasRecentlyCreated: false
      #attributes: array:15 [
        "id" => 11
        "registrar_id" => null
        "subscription_id" => null
        "company_id" => null
        "branch_id" => null
        "department_id" => null
        "division_id" => null
        "name" => "Cindy Durgan Jr."
        "email" => "[email protected]"
        "email_verified_at" => "2020-11-23 09:26:54"
        "created_at" => "2020-11-23 09:26:54"
        "updated_at" => "2020-11-23 09:26:54"
        "banned_at" => null
      ]
      #original: array:17 [
        "id" => 11
        "registrar_id" => null
        "subscription_id" => null
        "company_id" => null
        "branch_id" => null
        "department_id" => null
        "division_id" => null
        "name" => "Cindy Durgan Jr."
        "email" => "[email protected]"
        "email_verified_at" => "2020-11-23 09:26:54"
        "created_at" => "2020-11-23 09:26:54"
        "updated_at" => "2020-11-23 09:26:54"
        "banned_at" => null
        "pivot_field_report_id" => 25
        "pivot_participant_id" => 11
      ]
      #changes: []
      #classCastCache: []
      #dates: []
      #dateFormat: null
      #appends: []
      #dispatchesEvents: []
      #observables: []
      #relations: array:1 [
        "pivot" => Illuminate\Database\Eloquent\Relations\Pivot {#5719
          +incrementing: false
          #guarded: []
          #connection: "mysql"
          #table: "field_report_participant"
          #primaryKey: "id"
          #keyType: "int"
          #with: []
          #withCount: []
          #perPage: 15
          +exists: true
          +wasRecentlyCreated: false
          #attributes: array:2 [
            "field_report_id" => 25
            "participant_id" => 11
          ]
          #original: array:2 [
            "field_report_id" => 25
            "participant_id" => 11
          ]
          #changes: []
          #casts: []
          #classCastCache: []
          #dates: []
          #dateFormat: null
          #appends: []
          #dispatchesEvents: []
          #observables: []
          #relations: []
          #touches: []
          +timestamps: false
          #hidden: []
          #visible: []
          #fillable: []
          +pivotParent: App\Models\FieldReport {#4641
            #fillable: array:5 [
              0 => "company_id"
              1 => "branch_id"
              2 => "user_id"
              3 => "title"
              4 => "chronology"
            ]
            #connection: "mysql"
            #table: null
            #primaryKey: "id"
            #keyType: "int"
            +incrementing: true
            #with: []
            #withCount: []
            #perPage: 15
            +exists: true
            +wasRecentlyCreated: true
            #attributes: array:8 [
              "title" => "voluptate"
              "chronology" => "trimmed because it is too long"
              "user_id" => 12
              "company_id" => 10
              "branch_id" => 10
              "updated_at" => "2020-11-23 09:26:54"
              "created_at" => "2020-11-23 09:26:54"
              "id" => 25
            ]
            #original: array:8 [
              "title" => "voluptate"
              "chronology" => "trimmed because it is too long"
              "user_id" => 12
              "company_id" => 10
              "branch_id" => 10
              "updated_at" => "2020-11-23 09:26:54"
              "created_at" => "2020-11-23 09:26:54"
              "id" => 25
            ]
            #changes: []
            #casts: []
            #classCastCache: []
            #dates: []
            #dateFormat: null
            #appends: []
            #dispatchesEvents: []
            #observables: []
            #relations: array:1 [
              "taggedUsers" => Illuminate\Database\Eloquent\Collection {#4904}
            ]
            #touches: []
            +timestamps: true
            #hidden: []
            #visible: []
            #guarded: array:1 [
              0 => "*"
            ]
          }
          #foreignKey: "field_report_id"
          #relatedKey: "participant_id"
        }
      ]
      #touches: []
      +timestamps: true
      #visible: []
      #guarded: array:1 [
        0 => "*"
      ]
      #rememberTokenName: "remember_token"
      #accessToken: null
      -roleClass: null
      -permissionClass: null
    }
  ]
}

[furatamasensei]

I found the problem as well as the answer for this question. It was my mistake dd-ing on the Policy class. The test was dumped early even before it touches my targetted test case, the rest of the test were blocked because the app got die-ed, the attach method on my test case are not even get called. This is why I got an empty array.

The reason why I got 403 was here:

$fieldReport->taggedUsers->contains(['id' => $user->id]);

I was awfully trying to check the existence of both key and value when the taggedUsers are already an array containing that key. The contains method are meant to be used to check an existence of value given in an array, not the entire key value pair.

I simply changed to this and it passes:

$fieldReport->taggedUsers->contains($user->id)

Everything works as expected now. All tests passes.