Declaration of App\Http\Requests\UserUpdateRequest::user() should be compatible with Illuminate\Http\Request::user($guard = NULL)

Question

I am trying to back and implement FormRequest objects for validation. I have successfully setup the form requests for all of my models except for the User model. I am getting the following error Declaration of App\Http\Requests\UserUpdateRequest::user() should be compatible with Illuminate\Http\Request::user($guard = NULL). Researching this error it seems like it may be an issue with the way that I'm handling the authorization through Policies. Note that the UserStoreRequest works but the UserUpdateRequest returns the error.

UserStoreRequest

<?php

namespace App\Http\Requests;

use App\User;
use Illuminate\Foundation\Http\FormRequest;
use Illuminate\Support\Facades\Gate;

class UserStoreRequest extends FormRequest
{
    /**
     * Determine if the user is authorized to make this request.
     *
     * @return bool
     */
    public function authorize()
    {
        // Authorize action - create-user
        return Gate::allows('create', User::class);
    }

    /**
     * Get the validation rules that apply to the request.
     *
     * @return array
     */
    public function rules()
    {
        return [
            'name'      => 'required|string',
            'email'     => 'required|email|unique:users',
            'password'  => 'required|string|min:8|confirmed',
            'markets'   => 'required|array',
            'roles'     => 'required|array',
        ];
    }

    /**
     * Save the user.
     *
     * @return \App\User
     */
    public function save()
    {
        // Create the user
        $user = new User($this->validated());

        // Set the password
        $user->password = Hash::make($this->validated()['password']);
        $user->setRememberToken(Str::random(60));

        // Save the user
        $user->save();

        // Set users markets
        $user->markets()->sync($this->validated()['markets']);

        // Update the users role if included in the request
        if ($this->validated()['roles']) {
            foreach ($this->validated()['roles'] as $role) {
                $user->roles()->sync($role);

                if ($user->hasRole('admin')) {
                    $user->markets()->sync(Market::all());
                }
            }
        }

        return $user;
    }

    /**
     * Get the error messages for the defined validation rules.
     *
     * @return array
     */
    public function messages()
    {
        return [
            'name.required'      => 'The name is required.',
            'email.required'     => 'The email is required.',
            'email.unique'       => 'The email must be unique.',
            'password.required'  => 'The password is required.',
            'password.confirmed' => 'The passwords do not match.',
            'password.min'       => 'The password must be at least 8 characters.',
            'markets.required'   => 'A market is required.',
            'roles.required'     => 'A role is required.',
        ];
    }
}

UserUpdateRequest

<?php

namespace App\Http\Requests;

use Illuminate\Foundation\Http\FormRequest;
use Illuminate\Support\Facades\Gate;

class UserUpdateRequest extends FormRequest
{
    /**
     * Determine if the user is authorized to make this request.
     *
     * @return bool
     */
    public function authorize()
    {
        // Authorize action - update-user
        return Gate::allows('update', $this->user);
    }

    /**
     * Get the validation rules that apply to the request.
     *
     * @return array
     */
    public function rules()
    {
        return [
            'name'     => 'required|string',
        ];
    }

    /**
     * Get the user from the route.
     *
     * @return \App\User
     */
    public function user()
    {
        return $this->route('user');
    }

    /**
     * Save the email role.
     *
     * @return \App\Role
     */
    public function save()
    {
        // Update the user
        $this->user->update($this->validated());

        // // Check to see if password is being updated
        // if ($this->validated()['password']) {
        //     $this->user->password = Hash::make($this->validated()['password']);

        //     $this->user->setRememberToken(Str::random(60));
        // }

        // // Set users markets
        // $this->user->markets()->sync($this->validated()['markets']);

        // // Set users roles
        // // // Update the users role if included in the request
        // if ($this->validated()['roles']) {
        //     foreach ($this->validated()['roles'] as $role) {
        //         $this->user->roles()->sync($role);

        //         if ($this->user->hasRole('admin')) {
        //             $this->user->markets()->sync(Market::all());
        //         }
        //     }
        // }

        // // Save the user
        // $this->user->save();

        return $this->user;
    }

    /**
     * Get the error messages for the defined validation rules.
     *
     * @return array
     */
    public function messages()
    {
        return [
            'name.required'      => 'The name is required.',
            'email.required'     => 'The email is required.',
            'email.unique'       => 'The email must be unique.',
            'markets.required'   => 'A market is required.',
            'roles.required'     => 'A role is required.',
        ];
    }
}

As you can see I have commented out most of the code for the UpdateRequest for troubleshooting. It seems that the issue is with the authorize() method. Below is the code from the UserPolicy

UserPolicy

/**
 * Determine whether the user can create models.
 *
 * @param \App\User $user
 *
 * @return mixed
 */
public function create(User $user)
{
    return $user->hasPermission('create-user');
}

/**
 * Determine whether the user can update the model.
 *
 * @param \App\User $user
 * @param \App\User $model
 *
 * @return mixed
 */
public function update(User $user, User $model)
{
    return $user->hasPermission('update-user');
}

UserController

/**
 * Store a newly created resource in storage.
 *
 * @param \Illuminate\Http\UserStoreRequest $request
 *
 * @return \Illuminate\Http\Response
 */
public function store(UserStoreRequest $request)
{
    return redirect($request->save()->path());
}

/**
 * Update the specified resource in storage.
 *
 * @param \Illuminate\Http\UserUpdateRequest $request
 * @param \App\User                          $user
 *
 * @return \Illuminate\Http\Response
 */
public function update(UserUpdateRequest $request, User $user)
{
    return redirect($request->save()->path());
}

I'm using a permission based authorization for this system. The user has the hasPermission() method on it to verify if the user has the required permission to perform the action. I fear that I've confused myself on this setup and that I am not validating correctly. Everything has worked up until trying to implement this on the User model.

hasPermission()

/**
 * Check to see if the model has a permission assigned.
 *
 * @param string $permission
 *
 * @return bool
 */
public function hasPermission($permission)
{
    if (is_string($permission)) {
        if (is_null(Permission::whereName($permission)->first())) {
            return false;
        } else {
            return $this->hasRole(Permission::where('name', $permission)->first()->roles);
        }
    }

    return $this->hasRole($permission->roles);
}

hasRole()

/**
 * Check to see if model has a role assigned.
 *
 * @param string $role
 *
 * @return bool
 */
public function hasRole($role)
{
    if (is_string($role)) {
        return $this->roles->contains('name', $role);
    }

    return (bool) $role->intersect($this->roles)->count();
}

Update

I have tried renaming the user() method in UserUpdateRequest to frank() to resolve any issues overriding the Request user. This clears up the error listed above, but then the response is returned unauthorized. The logged in user has permissions set to allow updating users. This is called in the authorize() method using Gate::allows. I'm just not sure if it's checking the logged in user or the model user.

I investigated further and found that there is a new error after changing the method to frank(). I am getting Call to a member function update() on null. I should be returning the user pulled from the route from the frank method but it seems to be returning null.

Updated UserUpdateRequest

<?php

namespace App\Http\Requests;

use Illuminate\Foundation\Http\FormRequest;
use Illuminate\Support\Facades\Gate;

class UserUpdateRequest extends FormRequest
{
    /**
     * Determine if the user is authorized to make this request.
     *
     * @return bool
     */
    public function authorize()
    {
        // Authorize action - update-user
        return Gate::allows('update', $this->frank);
    }

    /**
     * Get the validation rules that apply to the request.
     *
     * @return array
     */
    public function rules()
    {
        return [
            'name'     => 'required|string',
        ];
    }

    /**
     * Get the user from the route.
     *
     * @return \App\User
     */
    public function frank()
    {
        return $this->route('user');
    }

    /**
     * Save the email role.
     *
     * @return \App\Role
     */
    public function save()
    {
        // Update the user
        $this->frank->update($this->validated());

        // // Check to see if password is being updated
        // if ($this->validated()['password']) {
        //     $this->user->password = Hash::make($this->validated()['password']);

        //     $this->user->setRememberToken(Str::random(60));
        // }

        // // Set users markets
        // $this->user->markets()->sync($this->validated()['markets']);

        // // Set users roles
        // // // Update the users role if included in the request
        // if ($this->validated()['roles']) {
        //     foreach ($this->validated()['roles'] as $role) {
        //         $this->user->roles()->sync($role);

        //         if ($this->user->hasRole('admin')) {
        //             $this->user->markets()->sync(Market::all());
        //         }
        //     }
        // }

        // // Save the user
        // $this->user->save();

        return $this->frank;
    }

    /**
     * Get the error messages for the defined validation rules.
     *
     * @return array
     */
    public function messages()
    {
        return [
            'name.required'      => 'The name is required.',
            'email.required'     => 'The email is required.',
            'email.unique'       => 'The email must be unique.',
            'markets.required'   => 'A market is required.',
            'roles.required'     => 'A role is required.',
        ];
    }
}

Answer 1

The issue is the user() method you defined on your UserUpdateRequest class.

UserUpdateRequest extends Illuminate\Foundation\Http\FormRequest, which in turn extends Illuminate\Http\Request. Illuminate\Http\Request already has a user() method defined, so the user() method in your UserUpdateRequest class is attempting to override this definition.

Since your UserUpdateRequest::user() method doesn't match the Illuminate\Http\Request::user($guard = null) signature, you're getting that error.

You can either:

1. Remove the user() method from your UserUpdateRequest class, or
2. Rename your user() method on your UserUpdateRequest class, or
3. Add the $guard = null parameter to your user() method on your UserUpdateRequest class, so that it matches the signature of the base user() method.