Showing Relationship Resource data in Dropdown when user doesn't have permission to view the relationship resource

[benittobeny34]

example:
I have a party nova resource the fields are
`
public function fields(Request $request)
{
return [
ID::make()->sortable()->hideFromDetail()->hideFromIndex(),

        Text::make('Name')
            ->sortable()
            ->rules('required', 'max:255'),

        Text::make('Phone Number')
            ->sortable()->hideFromIndex(),

        Textarea::make('Address')
            ->sortable()->hideFromIndex(),

        BelongsTo::make('Department')->sortable(),

        BelongsTo::make('Head')->sortable(),

        Date::make('Created At')
            ->sortable()
            ->exceptOnForms()
            ->format('DD.MM.YYYY'),
    ];
}

`

here user doesn't have permission to view head and department resource those policy viewany method returning false, but user have permission to view, create, edit and delete for Party resource.
when opening party page it doesn't show up the department and head fields in the parties master.

[crynobone]

When querying the database we don't load all the records into memory and verify if the user has access to each one of the records via policy, this is memory intensive process and often or not will exceed request timeout if you have a fairly large amount of records.

To combat this we have relatableQuery and even indexQuery to limit the access directly when querying the database. You can read it in the documentation: https://nova.laravel.com/docs/4.0/resources/authorization.html#relatable-filtering

[benittobeny34]

Thanks for quick reply.. my problem is the result is not appearing in the query. it only shows the normal fields, relationship fields is not appearing in the query because of view permission is restricted to all the resource.

For better understanding

parties master
id, name, department_id, head_id, created_at

department and heads are separate nova resources. user can't view any of the departments and heads.
but user can view parties master and do all the crud operations. when load the parties master it will only show (id, name and created_at field) in all parties resource pages.

[crynobone]

It best if you submit a reproducing repository similar to https://github.com/nova-issues with full details.

I still don't see that there's any bug here just from above explanation.

[benittobeny34]

i am not sure is this a bug or intended behaviour. Is there any way to show the relationship fields in the parties master. when making viewany permission to true, The relationship masters appears in the menu sidebar. but we don't want that. we need only in parties master to view the relationship fields or add new party by selecting those fields.

[crynobone]

Enable viewAny and use set displayInNavigation property to false. See the documentation for further details

[benittobeny34]

Thanks it works.
Set viewAny to true and determine the navigation visibility using availableForNavigation static method in resource.