Skip to content

[5.x] Feature: Strict authorization in CanAuthorizeAccess #18879

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
webard wants to merge 1 commit into from
Closed

[5.x] Feature: Strict authorization in CanAuthorizeAccess #18879

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 6 additions & 1 deletion packages/panels/src/Pages/Concerns/CanAuthorizeAccess.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,9 @@

namespace Filament\Pages\Concerns;

use Filament\Facades\Filament;
use LogicException;

trait CanAuthorizeAccess
{
public function mountCanAuthorizeAccess(): void
Expand All @@ -11,6 +14,8 @@ public function mountCanAuthorizeAccess(): void

public static function canAccess(): bool
{
return true;
return Filament::isAuthorizationStrict()
? throw new LogicException(sprintf('Strict authorization mode is enabled, but [canAccess()] method in [%s] class is not defined.', static::class))
Copy link

Copilot AI Jan 6, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The error message states that "canAccess() method... is not defined" which is technically incorrect - the method IS defined in the CanAuthorizeAccess trait. Consider rewording to be more accurate, such as "Strict authorization mode is enabled, but the default canAccess() implementation is being used in class [%s]. Please override canAccess() to define custom authorization logic." This would better communicate to developers what action they need to take.

Suggested change
? throw new LogicException(sprintf('Strict authorization mode is enabled, but [canAccess()] method in [%s] class is not defined.', static::class))
? throw new LogicException(sprintf('Strict authorization mode is enabled, but the default canAccess() implementation is being used in class [%s]. Please override canAccess() to define custom authorization logic.', static::class))

Copilot uses AI. Check for mistakes.
: true;
Comment on lines +17 to +19
Copy link

Copilot AI Jan 6, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This change will break existing pages that don't override the canAccess() method when strict authorization is enabled. For example, the Dashboard class (packages/panels/src/Pages/Dashboard.php) and custom pages like Settings in tests don't override canAccess(). When strictAuthorization() is enabled, accessing these pages will throw a LogicException instead of allowing access. This is a significant breaking change that should be carefully considered. If the intent is to require all pages to define canAccess() when strict mode is enabled, this needs clear documentation and migration guidance.

Copilot uses AI. Check for mistakes.
Comment on lines +17 to +19
Copy link

Copilot AI Jan 6, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The use of 'throw' in a ternary operator expression is unconventional and may reduce code readability. While valid in PHP, consider using a traditional if-else structure for better clarity and maintainability. This pattern is inconsistent with the approach used in helpers.php (lines 43-53) where a traditional if statement is used for similar strict authorization checks.

Suggested change
return Filament::isAuthorizationStrict()
? throw new LogicException(sprintf('Strict authorization mode is enabled, but [canAccess()] method in [%s] class is not defined.', static::class))
: true;
if (Filament::isAuthorizationStrict()) {
throw new LogicException(sprintf('Strict authorization mode is enabled, but [canAccess()] method in [%s] class is not defined.', static::class));
}
return true;

Copilot uses AI. Check for mistakes.
}
}