Laravel index policy

Question

I using Laravel 5.4 and I am trying to write a policy for my index view. I am trying to use a Method Without a Model, I am receiving the following error:

HttpException in Handler.php line 133:

This action is unauthorized.

Here is my Controller:

<?php

namespace App\Http\Controllers;

use Illuminate\Http\Request;
use App\County;
use Session;
use App\Http\Controllers\Controller;

class CountyController extends Controller
{
    /**
     * Create a new controller instance.
     *
     * @return void
     */
    public function __construct()
    {
        $this->middleware('auth');
    }

    /**
     * Display a listing of the resource.
     *
     * @return \Illuminate\Http\Response
     */
    public function index()
    {
        $counties = County::orderBy('id', 'desc')->paginate(5);
        $this->authorize('index');

        return view('county.index', array(
                'counties' => $counties
            ));
    }

Here is my AuthServicePovider:

<?php

namespace App\Providers;

use Illuminate\Support\Facades\Gate;
use Illuminate\Foundation\Support\Providers\AuthServiceProvider as ServiceProvider;
use App\Role;
use App\County;

use App\Policies\CountyPolicy;

class AuthServiceProvider extends ServiceProvider
{
    /**
     * The policy mappings for the application.
     *
     * @var array
     */
    protected $policies = [
        County::class => CountyPolicy::class,
    ];

    /**
     * Register any authentication / authorization services.
     *
     * @return void
     */
    public function boot()
    {
        $this->registerPolicies();

        Gate::define('is-Admin', function ($user) {
            if($user->roles()->where('name','Admin')->first()){
                return true;
            }
            return false;
        });
    }
}

Here is my Policy:

<?php

namespace App\Policies;

use App\User;
use App\Role;
use App\County;
use Illuminate\Auth\Access\HandlesAuthorization;

class CountyPolicy
{
    use HandlesAuthorization;

    /**
     * Determine whether the user can view the county.
     *
     * @param  \App\User  $user
     * @param  \App\County  $county
     * @return mixed
     */
    public function index(User $user)
    {
        $userRoles = $user->getRoleNames();
        $acceptedRoles = ['Sudo','Admin'];
        $testArr = array_intersect($acceptedRoles, $userRoles);

        dd($testArr);

        if(!empty($testArr)){
            return true;
        }
        return false;
        //
    }

    /**
     * Determine whether the user can view the county.
     *
     * @param  \App\User  $user
     * @param  \App\County  $county
     * @return mixed
     */
    public function view(User $user, County $county)
    {
        $userRoles = $user->getRoleNames();
        $acceptedRoles = ['Sudo','Admin','Client'];
        $testArr = array_intersect($acceptedRoles, $userRoles);

        if(!empty($testArr)){
            return true;
        }
        return false;
        //
    }

    /**
     * Determine whether the user can create counties.
     *
     * @param  \App\User  $user
     * @return mixed
     */
    public function create(User $user)
    {
        //
    }

    /**
     * Determine whether the user can update the county.
     *
     * @param  \App\User  $user
     * @param  \App\County  $county
     * @return mixed
     */
    public function update(User $user, County $county)
    {
        //
    }

    /**
     * Determine whether the user can delete the county.
     *
     * @param  \App\User  $user
     * @param  \App\County  $county
     * @return mixed
     */
    public function delete(User $user, County $county)
    {
        //
    }
}

I never get to dd($testArr) in the index policy. Also the view policy is working perfectly.

How do I write a policy for my index view?

Answer 1

keeping everything the same but changing:

$this->authorize('index');

to

$this->authorize('index', County::class);

fixed the problem. Apparently the model class needs to be passed on actions that don't require a model. This is only described under the middleware section of Laravel's docs, not the controller helpers... A little confusing.