How to lazy load Policy method results. What is best practise?

[bojmaliev]

Hello guys!

I love Inertia and I love making applications with Inertia.

Right now I'm working on a project with many Policies and Gates and I'm thinking if there is a better way to do it.

Currently for class based policy methods I'm always appending can attribute to the User. For model based policy methods I'm appending can attribute for every Model.

This is the Inertia's way.

The problem

Currently I have model Ticket with 20+ policy methods and some of them are required to load additional relationships in order to check the policy result.

This results to many loaded models and honestly I don't like it.

Is there any way of making Inertia smarter and lazy load only the policy methods needed for the next page ?

What do you think?

[ajnsn]

Hey @bojmaliev
I often see implementations with Inertia's shared data to maintain the auth user with the overall can-attributes while returning model based can-attributes together with the record response. So in general that's what you are already doing.

The performance/relationships issue you describe is something that should also happen in any application, e.g. when using Laravel with blade compoments you should encounter the same issue. So while I unfortunately could not provide any instant solution for you, I recommend reviewing your policy concept and try to optimize the queries. If you are using Laravel, you could also activate Model::preventLazyLoading to identify N+1 query problems.

I hope this helps a bit to get in the right direction!

[bojmaliev]

This is model-based:

class Ticket extends Model
{
 protected $appends = ['can'];
 public function getCanAttribute(): array
    {
        return [
            Permission::assign => Gate::check(Permission::assign, $this),
            Permission::view => Gate::check(Permission::view, $this),
            Permission::refuse => Gate::check(Permission::refuse, $this),
            Permission::start => Gate::check(Permission::start, $this),
            Permission::finish => Gate::check(Permission::finish, $this),
            Permission::confirm => Gate::check(Permission::confirm, $this),
            Permission::return => Gate::check(Permission::return, $this),
            Permission::cancel => Gate::check(Permission::cancel, $this),
            Permission::createChildren => Gate::check(Permission::createChildren, $this),
            Permission::comment => Gate::check(Permission::comment, $this),
            Permission::flag => Gate::check(Permission::flag, $this),
            Permission::priority => Gate::check(Permission::priority, $this),
        ];
    }
}

And I Have user-based:

class User extends Authenticatable
{

 public function getCanAttribute(): array
    {
        return [
            Permission::configs => [
                Permission::viewAny => $this->can(Permission::viewAny, Config::class),
                Permission::edit => $this->can(Permission::edit, Config::class),
            ],
            Permission::places => [
                Permission::viewAny => $this->can(Permission::viewAny, Place::class),
                Permission::create => $this->can(Permission::create, Place::class),
                Permission::edit => $this->can(Permission::edit, Place::class),
            ],
      ]
}
}

And then in HandleInertiaRequests

 public function share(Request $request)
    {
        $user = $request->user();
        return array_merge(parent::share($request), [
            'authUser' => fn() => $user?->append('can'),
        ]);
    }

This works fine but I know this is not ideal.

I'm afraid if I use this all my methods will become messy. Also how can I append to paginated results?

[ajnsn]

Interesting! But probably very expensive, as you already noticed. You could take a look at Parital reloads but in the end I would not recommend following this shared data approach.

Instead you could take advantage of Laravel's native Authorization policies and then be able to just e.g. auth()->user()->can('update', $model).

Furthermore take a look at Laravel's API resources. They can ease up the transformation layer and can also be used inside Inertia::render. Try to achieve the same as the Authorization example does. It works pretty well.

Hope this helps :)

[bojmaliev]

Thank you for your advice and thanks for having this discussion with me.

The thing I don't like for API resources is that I need to create separate one for each response, but I will give it a try.

Again, If just there was a way to tell Inertia: Hey please lazy load me these 5 policy methods for my next page, I will need them.

[ajnsn]

You're welcome! API Resources are optional. Just follow the Policy path, it's this simple Laravel way of model policies. If you want to keep your existing approach, you could also think about caching them.

[bojmaliev]

I'm already doing everything Laravel recommends, Just I'm not sure what's the best way of providing them to the front-end.
Caching is also a good idea. Thanks