Authorization Checks in transitionTo

[gitmiro]

Hey Guys

First of all, awesome lib! May I ask if it has already been considered putting authorization checks inside the transitionTo Method? I would love to set an Attribute on a transition in order to mark it as "restricted". The transitionTo method could then verify if such an Attribute exists. If yes, do the necesseray checks:

#[Attribute(Attribute::TARGET_CLASS)]
class Restricted
{
    public function __construct(
        #[Immutable] private ?string $permission = null,
        #[Immutable] private ?string $model = null
    )
    {
    }

    public function getPermission(): ?string
    {
        return $this->permission;
    }

    public function getModel(): ?string
    {
        return $this->model;
    }
}

The authorization check might look like this:

    public function isAllowed()
    {
        $targetTransition = new ReflectionClass($this);
        $attributes = collect($targetTransition->getAttributes(Restricted::class));

        // Exit check because no Attribute has been set
        if ($attributes->isEmpty()) {
            return;
        }

        $restriction = $attributes->first()->newInstance();

        // If a permission string has been set, use it. Otherwise kebab the transition class name
        $action = $restriction->getPermission() ?? Str::kebab($targetTransition->getShortName());
        // If a model has been set, use that policy, otherwise use the target transition class
        $model = $restriction->getModel() ?? $targetTransition->getName();
        
        if ($this->cannot($action, $model)) {
            throw new \Exception("some mighty Exception");
        };
    }

What do you think? Would you be open for a PR?

thanks

[brendt]

Couldn't you solve this with a custom transition class?

Adding permission support seems out of the scope for this package.

[gitmiro]

@brendt

Thanks for the fast reply. Yeah sure, that's anyway the road I've taken regarding this. I just thought that this might fit in the package itself.