Delete Button appears on after "Select All" checkbox is selected, even in Resources where the Policy does not allow to delete

[rzuloaga]

• Laravel Version: 4.29.5
• Nova Version: 10.31.0
• PHP Version: 8.2.12
• Database Driver & Version: MySQL 5.7
• Operating System and Version: MacOS Ventura 13.2.1
• Browser type and version: Google Chrome 119
• Reproduction Repository:

Description:

I have many resources that Laravel policies don't allow me to delete (i.e. delete() in that Resource's Model policy is set to return false), and under the previous version of Nova we were using (v.3) it did not allow us to delete that resource.

At the same time, nowadays the resource is not allowed to be deleted in an individual basis: if we mark the checkbox of only one resource on the list, the delete button does not appear:

But now, if I press the checkbox of "Select All", suddenly the delete button appears in the top of my list. And it shouldn't, because the resource is not allowed to be deleted.

It's mostly a visual bug, because if I press the button nothing happens. Well, a DELETE REST request is sent, but no deletion actually occurs in the database, as Laravel policies serve as a stopguard.

Tracking Nova source code, I see this in nova\resources\js\views\Index.vue(589):

Looks like it allows the delete button to appear if the checkbox called as "Select All" is marked.

Detailed steps to reproduce the issue on a fresh Nova installation:

• Create a resource
• Set its Laravel policy to NOT allow deletion
• Go to the Resource Index view and mark the "Select All" on the checkbox dropdown on top of the list.

The delete button (a trash bin) should appear on the top right corner of the list.

[crynobone]

You can only request to delete all, however only right before the deletion process we verify if the user has authorization once the model has been hydrated. If we do this during the selection on thousands if not millions of records it would require huge resources on your server each time a user does select all.