深入理解Laravel策略：解决403错误与授权机制的正确实践

class PlumberController extends ApiController {
    public function __construct() {
        // 这行代码会尝试为控制器中的所有资源方法自动授权
        // 但如果模型解析或参数传递不正确，可能导致策略不被调用
        $this->authorizeResource(\Project\Entities\Plumber::class);
    }

    // ... 其他资源方法 ...
}

<?php

namespace Project\Providers;

use Project\Entities\Plumber;
use Illuminate\Support\Facades\Gate;
use Illuminate\Foundation\Support\Providers\AuthServiceProvider as ServiceProvider;
use Project\Policies\PlumberPolicy;

class AuthServiceProvider extends ServiceProvider
{
    /**
     * The policy mappings for the application.
     *
     * @var array
     */
    protected $policies = [
        Plumber::class => PlumberPolicy::class // 确保模型与策略正确关联
    ];

    /**
     * Register any authentication / authorization services.
     *
     * @return void
     */
    public function boot()
    {
        $this->registerPolicies();
    }
}

<?php

namespace Project\Policies;

use Project\Entities\User;
use Project\Entities\Plumber;
use Illuminate\Auth\Access\HandlesAuthorization;

class PlumberPolicy
{
    use HandlesAuthorization;

    /**
     * Determine whether the user can view any Plumbers. (对应index方法)
     *
     * @param  \Project\Entities\User  $user
     * @return mixed
     */
    public function viewAny(User $user) // 集合操作，只接收User对象
    {
        return true; // 示例，实际应根据业务逻辑判断
    }

    /**
     * Determine whether the user can view the Plumber. (对应show方法)
     *
     * @param  \Project\Entities\User  $user
     * @param  \Project\Entities\Plumber  $plumber
     * @return mixed
     */
    public function view(User $user, Plumber $plumber) // 单个资源操作，接收User和Plumber对象
    {
        return true;
    }

    /**
     * Determine whether the user can create Plumbers. (对应store方法)
     *
     * @param  \Project\Entities\User  $user
     * @return mixed
     */
    public function create(User $user) // 集合操作，只接收User对象
    {
        return true;
    }

    /**
     * Determine whether the user can update the Plumber. (对应update方法)
     *
     * @param  \Project\Entities\User  $user
     * @param  \Project\Entities\Plumber  $plumber
     * @return mixed
     */
    public function update(User $user, Plumber $plumber) // 单个资源操作
    {
        return true;
    }

    /**
     * Determine whether the user can delete the Plumber. (对应destroy方法)
     *
     * @param  \Project\Entities\User  $user
     * @param  \Project\Entities\Plumber  $plumber
     * @return mixed
     */
    public function delete(User $user, Plumber $plumber) // 单个资源操作
    {
        return true;
    }
}

<?php

namespace Project\Http\Controllers;

use Illuminate\Http\Request;
use Project\Entities\Plumber; // 引入Plumber模型
use Project\Repositories\PlumberRepository; // 假设有一个仓库来获取模型实例

class PlumberController extends ApiController
{
    protected $repository;

    public function __construct(PlumberRepository $repository)
    {
        // 移除 authorizeResource()，改为在每个方法中显式授权
        $this->repository = $repository;
    }

    /**
     * Display a listing of the resource. (对应Policy中的viewAny)
     *
     * @param Request $request
     * @return \Illuminate\Http\Response
     */
    public function index(Request $request)
    {
        // 授权查看所有Plumber（集合操作），传递模型类名
        $this->authorize('viewAny', Plumber::class);

        // ... 获取并返回Plumber列表 ...
        return parent::index($request);
    }

    /**
     * Store a newly created resource in storage. (对应Policy中的create)
     *
     * @param Request $request
     * @return \Illuminate\Http\Response
     */
    public function store(Request $request)
    {
        // 授权创建Plumber（集合操作），传递模型类名
        $this->authorize('create', Plumber::class);

        // ... 创建Plumber逻辑 ...
        return parent::store($request);
    }

    /**
     * Display the specified resource. (对应Policy中的view)
     *
     * @param Request $request
     * @param int $id
     * @return \Illuminate\Http\Response
     */
    public function show(Request $request, $id)
    {
        // 获取Plumber实例
        $plumber = $this->repository->getByID($id);

        // 授权查看特定Plumber（单个资源操作），传递模型实例
        $this->authorize('view', $plumber);

        return parent::show($request, $id);
    }

    /**
     * Update the specified resource in storage. (对应Policy中的update)
     *
     * @param Request $request
     * @param int $id
     * @return \Illuminate\Http\Response
     */
    public function update(Request $request, $id)
    {
        // 获取Plumber实例
        $plumber = $this->repository->getByID($id);

        // 授权更新特定Plumber（单个资源操作），传递模型实例
        $this->authorize('update', $plumber);

        // ... 更新Plumber逻辑 ...
        return parent::update($request, $id);
    }

    /**
     * Remove the specified resource from storage. (对应Policy中的delete)
     *
     * @param Request $request
     * @param int $id
     * @return \Illuminate\Http\Response
     */
    public function destroy(Request $request, $id)
    {
        // 获取Plumber实例
        $plumber = $this->repository->getByID($id);

        // 授权删除特定Plumber（单个资源操作），传递模型实例
        $this->authorize('delete', $plumber);

        // ... 删除Plumber逻辑 ...
        return parent::destroy($request, $id);
    }
}