prevent policies from being too greedy

- return `false` on `resolvePolicyCallback` if the ability/method is
not callable
- if no policy callback is found, allow the gate to try and resolve the
ability before defaulting to `false`.
- add test to make sure policies defer to the gate if method does not
exist on policy
- minor rename to other test to explicitly state the policy defaults to
false if the method does not exists **AND** the gate does not exist.

src/Illuminate/Auth/Access/Gate.php

@@ -332,7 +332,9 @@ protected function resolveAuthCallback($user, $ability, array $arguments)
     {
         if (isset($arguments[0])) {
             if (! is_null($policy = $this->getPolicyFor($arguments[0]))) {
-                return $this->resolvePolicyCallback($user, $ability, $arguments, $policy);
+                if ($policyCallback = $this->resolvePolicyCallback($user, $ability, $arguments, $policy)) {
+                    return $policyCallback;
+                }
             }
         }
 
@@ -390,10 +392,15 @@ public function resolvePolicy($class)
      * @param  string  $ability
      * @param  array  $arguments
      * @param  mixed  $policy
-     * @return callable
+     * @return bool|callable
      */
     protected function resolvePolicyCallback($user, $ability, array $arguments, $policy)
     {
+        // Check the method exists on the policy before we try to resolve it.
+        if (! is_callable([$policy, $this->formatAbilityToMethod($ability)])) {
+            return false;
+        }
+
         return function () use ($user, $ability, $arguments, $policy) {
             // This callback will be responsible for calling the policy's before method and
             // running this policy method if necessary. This is used to when objects are

tests/Auth/AuthAccessGateTest.php

@@ -178,7 +178,7 @@ public function test_policy_converts_dash_to_camel()
         $this->assertTrue($gate->check('update-dash', new AccessGateTestDummy));
     }
 
-    public function test_policy_default_to_false_if_method_does_not_exist()
+    public function test_policy_default_to_false_if_method_does_not_exist_and_gate_does_not_exist()
     {
         $gate = $this->getBasicGate();
 
@@ -218,6 +218,19 @@ public function test_policies_always_override_closures_with_same_name()
         $this->assertTrue($gate->check('update', new AccessGateTestDummy));
     }
 
+    public function test_policies_defer_to_gates_if_method_does_not_exist()
+    {
+        $gate = $this->getBasicGate();
+
+        $gate->define('nonexistent_method', function ($user) {
+            return true;
+        });
+
+        $gate->policy(AccessGateTestDummy::class, AccessGateTestPolicy::class);
+
+        $this->assertTrue($gate->check('nonexistent_method', new AccessGateTestDummy));
+    }
+
     public function test_for_user_method_attaches_a_new_user_to_a_new_gate_instance()
     {
         $gate = $this->getBasicGate();