Gating with custom message #90
Conversation
|
Warning Rate limit exceeded@GautierDele has exceeded the limit for the number of commits or files that can be reviewed per hour. Please wait 12 minutes and 5 seconds before requesting another review. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. 📒 Files selected for processing (1)
WalkthroughAdded a documentation section explaining policy-based messages in gates, how to enable them via rest.gates.message.enabled, an example PHP policy returning Illuminate\Auth\Access\Response, and an example of resulting JSON with message on denial. No code or API changes. Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Pre-merge checks and finishing touches✅ Passed checks (3 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (3)
content/4.digging-deeper/3.gates.md (3)
42-46: Clarify wording + note breaking payload shape changeTighten grammar and make the compatibility warning explicit.
-## Policy message in gates - -You are able to get policies message if you want to be more explicit about why the policy is not passing, you first need to set the -config `rest.gates.message.enabled` to true. Be aware that this will change the gates format +## Policy messages in gates + +To surface policy messages explaining authorization failures, first set the config `rest.gates.message.enabled` to `true`. +Enabling this changes the `gates` payload shape returned by the `search` endpoint and may require frontend updates.
47-63: Policy example: improve phrasing + i18n; add security tipSuggest clearer phrasing and a translatable message. Also add a caution about leaking sensitive details; recommend
denyAsNotFoundwhen appropriate.-In your policy you need to return a policy message: +In your policy, return an authorization `Response`: @@ - : Response::deny('You do not own this post.'); + : Response::deny(__('You do not own this post.'));Consider adding after the code block:
Tip: If revealing the reason could leak sensitive information (e.g., resource existence), prefer `Response::denyAsNotFound()`.
74-77: Document key naming convention for gate entriesClarify whether gate keys are snake_case (
authorized_to_update) or follow another convention, and how they’re derived (policy method name vs. ability name). This helps frontend consumers generate selectors consistently.
content/4.digging-deeper/3.gates.md
Outdated
| and this will result in the change of the `search` gating format: | ||
|
|
||
| ```json | ||
| { | ||
| "data": [ | ||
| { | ||
| "id": 1, | ||
| "name": "Lou West", | ||
| "gates": { | ||
| "authorized_to_update": { | ||
| "allowed": false, | ||
| "message": "You do not own this post." | ||
| } | ||
| } | ||
| } | ||
| ] | ||
| } | ||
| ``` |
There was a problem hiding this comment.
Show before/after schema to prevent client breakage
Make the payload change concrete with a minimal “Before” example and label the current one as “After”.
-and this will result in the change of the `search` gating format:
+This changes the `search` gates payload.
+
+Before (default):
+```json
+{
+ "data": [
+ {
+ "gates": {
+ "authorized_to_update": true
+ }
+ }
+ ]
+}
+```
+
+After (with messages enabled):🤖 Prompt for AI Agents
In content/4.digging-deeper/3.gates.md around lines 65 to 82, the example only
shows the new payload and the reviewer asked for an explicit "Before" and
"After" to prevent client breakage; add a minimal labeled "Before" JSON example
demonstrating the previous simple boolean gate shape, then label the existing
example as "After (with messages enabled)" showing the new object-with-message
shape, and ensure both examples are wrapped in code blocks and placed
consecutively so readers can clearly compare the schema change.
GautierDele
deleted the
feature/automatic-gating-with-custom-message
branch
Summary by CodeRabbit