Authorizers should receive multiple PHP types for polymorphic entities

[fisharebest]

Not sure if this is a bug, or if we're doing something wrong.

In our config/json-api-default.php, we have a "polymorphic type" roles:

    'resources'     => [
        'users' => App\User::class,
        'roles' => [App\Role::class, Spatie\Permission\Models\Role::class],
    ],

Now, the function Routing\Route::getType() type-hints a string return type:

https://github.com/cloudcreativity/laravel-json-api/blob/v1.1.0/src/Routing/Route.php#L146

However, the return value comes from the config file, and is an array.

This throws a fatal PHP error.

/edit - FYI we found this when upgrading from 1.0.0-beta.5 to 1.1.0.

[lindyhopchris]

Yes, definitely a bug... got introduced right at the end of the pre-1.0.0 versions. I'll take a look at fixing.

[lindyhopchris]

So this is problematic for 1.x because authorizers are expecting a single type. So we need to find a solution for this that works for 1.x, then add to the 2.0 milestone to sort this out properly (which will be helped by adding PHP 7 type-hinting everywhere for 2.0).

Think the solution for 1.x is to:

• Add a getTypes() method to the route that is type-hinted to return an array of types - i.e. should always have at least one type in it.
• Modify getType() to use getTypes() - it should return the first type if there's more than one in the array as a temporary solution.
• Deprecated getType() for 2.0 as really getTypes() should always be used as a route could always relate to one to many PHP classes.

This will mean for 1.x the type that is passed to the authorizer will always be the first PHP class in the list for polymorph types, which will have to do as a solution.

For 2.0:

• Modify the authorizer interface so it takes a list of PHP classes instead of a single string. This makes things more complicated for the authorizer but is more accurate - and at least allows authorizers to decide themselves what they want to do about polymorph scenarios.
• Change our default authorizer so it loops through the classes and authorizers each of them. This is most accurate default implementation, because in theory the route could be reading/creating any of those classes, so would expect all to be ok.
• Update the resolver interface to make it clear that multiple types can be returned.

[lindyhopchris]

Fixed for 1.x and will be released in 1.2.0.

Moving to the 2.0 milestone for the authorizer changes.

[lindyhopchris]

Authorizer changes are no longer required - the new laravel-json-api/laravel package has a better authorization implementation, as documented here:
https://laraveljsonapi.io/docs/1.0/requests/authorization.html