Check for permission without a subject

[shadoWalker89]

Hi,

Laravel does not require a subject for permission checks, you can just do

// Define the permission
$gate->define('generate-statistics', function($user){
return $user->isAdmin();
});

// Check the permission
$user->can('generate-statistics');

I see that your package does require a subject wich will not allow doing what i described above.

[mblarsen]

Will I have no intention of mapping Laravel's functionality 1:1 I do see the use case for this.

To register a function to resolve the permission you'd write like this:

acl.rule('generate-statistics', user => user.isAdmin())

There is a bit of a conflict with the current implementation.

The second argument to rule() is the subject and the subject itself can be a function (in case of classes and constructor functions). So param shift is hard. I see three solutions:

1. Pass a 'global rule' subject
2. Limit class names to begin with uppercase.
3. Allow only nameless handler functions

1. Pass a 'global rule' subject

acl.rule('generate-statistics', Acl.GlobalRule, user => user.isAdmin())

pro: No API changes
con: Not the cleanest API, plus users of dependent libs like vue-browser-acl would need to use this lib directly.

2. Limit class names to begin with uppercase

E.g. if the function name is Post it is intended as subject but if function name is post, it will be treated as a handler.

pro: simple API
con: not clear API at the same time, plus some does not use uppercase in constructor functions.

3. Allow only nameless handler functions

The third options is to assume that all handler functions are nameless. That way if you pass a nameless function as the second param (and there is no third argument) we'll know that we are dealing with a subjectless rule.

UPDATE: Also this method will now allow you to pass additional params to the handler.

acl.can(user, 'generate-statistics', somethingAdditional) <---- will not work
acl.can(user, 'generate-statistics', GlobalRule, somethingAdditional) <---- will work

---

I'm leaning towards the third option as you'll usually use fat-arrow syntax or a nameless unbound function.

[shadoWalker89]

Ok thanks

[mblarsen]

The above is not implemented. Pushing a solution now.

[mblarsen]

@shadoWalker89 please see this section https://github.com/mblarsen/browser-acl/tree/feat-global-rules#additional-parameters-and-global-rules --- does this fit your use case?

[shadoWalker89]

@mblarsen yes
Thank you

[mblarsen]

It has been published as version 0.5.0 on npm