🔐 Implement authorization checks for removing relations #108
Conversation
Codecov Report
@@ Coverage Diff @@
## master #108 +/- ##
=========================================
Coverage ? 86.06%
Complexity ? 674
=========================================
Files ? 77
Lines ? 1995
Branches ? 0
=========================================
Hits ? 1717
Misses ? 278
Partials ? 0
Continue to review full report at Codecov.
|
| */ | ||
| protected function connectBelongsToRelation(Relations\BelongsTo $relation, $id) | ||
| { | ||
| $current = $relation->first(); | ||
|
|
||
| if ($current) { |
There was a problem hiding this comment.
Does this mean we always call authorizeToRemove when there’s an existing relation? Seems a bit overkill if you are just updating it.
There was a problem hiding this comment.
What do you mean with just updating it?
$old = [
'related_id' => '1',
]
$input = [
'related_id' => '1',
]
I do however believe that when you're not actually changing the relation, it should not need to authorize changing the fields. (e.g. only check dirty/changed fields)
There was a problem hiding this comment.
If you would update it with 'related_id' => '2' it would trigger the authorizeToRemove that feels unnecessary. Definitely agree on skipping authorisation when it's not dirty.
No description provided.