[8.x] Allows authorizeResource method to receive arrays of models and…

… parameters (#40516)

* Allows authorise resource to receive arrays of models and parameters

* lint

* more lint

* Update AuthorizesRequests.php

Co-authored-by: Taylor Otwell <taylor@laravel.com>

src/Illuminate/Foundation/Auth/Access/AuthorizesRequests.php

@@ -74,14 +74,18 @@ protected function normalizeGuessedAbilityName($ability)
     /**
      * Authorize a resource action based on the incoming request.
      *
-     * @param  string  $model
-     * @param  string|null  $parameter
+     * @param  string|array  $model
+     * @param  string|array|null  $parameter
      * @param  array  $options
      * @param  \Illuminate\Http\Request|null  $request
      * @return void
      */
     public function authorizeResource($model, $parameter = null, array $options = [], $request = null)
     {
+        $model = is_array($model) ? implode(',', $model) : $model;
+
+        $parameter = is_array($parameter) ? implode(',', $parameter) : $parameter;
+
         $parameter = $parameter ?: Str::snake(class_basename($model));
 
         $middleware = [];

tests/Auth/AuthorizesResourcesTest.php

@@ -17,41 +17,65 @@ public function testCreateMethod()
         $controller = new AuthorizesResourcesController;
 
         $this->assertHasMiddleware($controller, 'create', 'can:create,App\User');
+
+        $controller = new AuthorizesResourcesWithArrayController;
+
+        $this->assertHasMiddleware($controller, 'create', 'can:create,App\User,App\Post');
     }
 
     public function testStoreMethod()
     {
         $controller = new AuthorizesResourcesController;
 
         $this->assertHasMiddleware($controller, 'store', 'can:create,App\User');
+
+        $controller = new AuthorizesResourcesWithArrayController;
+
+        $this->assertHasMiddleware($controller, 'store', 'can:create,App\User,App\Post');
     }
 
     public function testShowMethod()
     {
         $controller = new AuthorizesResourcesController;
 
         $this->assertHasMiddleware($controller, 'show', 'can:view,user');
+
+        $controller = new AuthorizesResourcesWithArrayController;
+
+        $this->assertHasMiddleware($controller, 'show', 'can:view,user,post');
     }
 
     public function testEditMethod()
     {
         $controller = new AuthorizesResourcesController;
 
         $this->assertHasMiddleware($controller, 'edit', 'can:update,user');
+
+        $controller = new AuthorizesResourcesWithArrayController;
+
+        $this->assertHasMiddleware($controller, 'edit', 'can:update,user,post');
     }
 
     public function testUpdateMethod()
     {
         $controller = new AuthorizesResourcesController;
 
         $this->assertHasMiddleware($controller, 'update', 'can:update,user');
+
+        $controller = new AuthorizesResourcesWithArrayController;
+
+        $this->assertHasMiddleware($controller, 'update', 'can:update,user,post');
     }
 
     public function testDestroyMethod()
     {
         $controller = new AuthorizesResourcesController;
 
         $this->assertHasMiddleware($controller, 'destroy', 'can:delete,user');
+
+        $controller = new AuthorizesResourcesWithArrayController;
+
+        $this->assertHasMiddleware($controller, 'destroy', 'can:delete,user,post');
     }
 
     /**
@@ -67,7 +91,7 @@ protected function assertHasMiddleware($controller, $method, $middleware)
         $router = new Router(new Dispatcher);
 
         $router->aliasMiddleware('can', AuthorizesResourcesMiddleware::class);
-        $router->get($method)->uses(AuthorizesResourcesController::class.'@'.$method);
+        $router->get($method)->uses(get_class($controller).'@'.$method);
 
         $this->assertSame(
             'caught '.$middleware,
@@ -122,10 +146,57 @@ public function destroy()
     }
 }
 
+class AuthorizesResourcesWithArrayController extends Controller
+{
+    use AuthorizesRequests;
+
+    public function __construct()
+    {
+        $this->authorizeResource(['App\User', 'App\Post'], ['user', 'post']);
+    }
+
+    public function index()
+    {
+        //
+    }
+
+    public function create()
+    {
+        //
+    }
+
+    public function store()
+    {
+        //
+    }
+
+    public function show()
+    {
+        //
+    }
+
+    public function edit()
+    {
+        //
+    }
+
+    public function update()
+    {
+        //
+    }
+
+    public function destroy()
+    {
+        //
+    }
+}
+
 class AuthorizesResourcesMiddleware
 {
-    public function handle($request, Closure $next, $method, $parameter)
+    public function handle($request, Closure $next, $method, $parameter, ...$models)
     {
-        return "caught can:{$method},{$parameter}";
+        $params = array_merge([$parameter], $models);
+
+        return "caught can:{$method},".implode(',', $params);
     }
 }