fix(laravel): fall back to resource class when object is null in Reso…

…urceAccessChecker | Q | A | ------------- | --- | Branch? | 4.3 | Tickets | Closes #7945 | License | MIT | Doc PR | ∅ Gate::allows cannot resolve a policy from a null argument, causing 403 on operations with deserialize:false or output:false even when the policy returns true. Apply the same fallback already used for Paginator.
api-platform · soyuka · May 5, 2026 · May 4, 2026 · May 4, 2026 · May 4, 2026
commit 3f68dbfe22a2bf5f33413435fd23d1333051b020
diff --git a/src/Laravel/Security/ResourceAccessChecker.php b/src/Laravel/Security/ResourceAccessChecker.php
@@ -21,11 +21,11 @@ class ResourceAccessChecker implements ResourceAccessCheckerInterface
 {
     public function isGranted(string $resourceClass, string $expression, array $extraVariables = []): bool
     {
+        $object = $extraVariables['object'] ?? null;
+
         return Gate::allows(
             $expression,
-            $extraVariables['object'] instanceof Paginator ?
-                $resourceClass :
-                $extraVariables['object']
+            ($object instanceof Paginator || null === $object) ? $resourceClass : $object
         );
     }
 }
diff --git a/src/Laravel/Tests/Unit/Security/ResourceAccessCheckerTest.php b/src/Laravel/Tests/Unit/Security/ResourceAccessCheckerTest.php
@@ -0,0 +1,63 @@
+<?php
+
+/*
+ * This file is part of the API Platform project.
+ *
+ * (c) Kévin Dunglas <[email protected]>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+declare(strict_types=1);
+
+namespace ApiPlatform\Laravel\Tests\Unit\Security;
+
+use ApiPlatform\Laravel\Eloquent\Paginator;
+use ApiPlatform\Laravel\Security\ResourceAccessChecker;
+use Illuminate\Pagination\LengthAwarePaginator;
+use Illuminate\Support\Facades\Gate;
+use Orchestra\Testbench\Concerns\WithWorkbench;
+use Orchestra\Testbench\TestCase;
+use Workbench\App\Models\Book;
+
+class ResourceAccessCheckerTest extends TestCase
+{
+    use WithWorkbench;
+
+    public function testNullObjectFallsBackToResourceClass(): void
+    {
+        Gate::shouldReceive('allows')
+            ->once()
+            ->with('import', Book::class)
+            ->andReturn(true);
+
+        $checker = new ResourceAccessChecker();
+        $this->assertTrue($checker->isGranted(Book::class, 'import', ['object' => null]));
+    }
+
+    public function testPaginatorObjectFallsBackToResourceClass(): void
+    {
+        Gate::shouldReceive('allows')
+            ->once()
+            ->with('viewAny', Book::class)
+            ->andReturn(true);
+
+        $paginator = new Paginator(new LengthAwarePaginator([], 0, 1));
+        $checker = new ResourceAccessChecker();
+        $this->assertTrue($checker->isGranted(Book::class, 'viewAny', ['object' => $paginator]));
+    }
+
+    public function testActualObjectIsForwarded(): void
+    {
+        $book = new Book();
+
+        Gate::shouldReceive('allows')
+            ->once()
+            ->with('view', $book)
+            ->andReturn(true);
+
+        $checker = new ResourceAccessChecker();
+        $this->assertTrue($checker->isGranted(Book::class, 'view', ['object' => $book]));
+    }
+}