[5.5] prevent policies from being too greedy

[browner12]

this was originally sent to 5.4 (#19106) and Taylor asked me to switch to 5.5

Description:

Policies are too greedy, and will not defer to the gates if they do not have a method that matches the requested ability.

Steps To Reproduce:

Let's assume a App\Blog, and App\Policies\Blog.

namespace App\Policies;

class BlogPolicy
{
    /**
     * @return bool
     */
    public function update
    {
        return false;
    }
}

and the following AuthServiceProvider:

namespace App\Providers;

use Illuminate\Contracts\Auth\Access\Gate;
use Illuminate\Foundation\Support\Providers\AuthServiceProvider as ServiceProvider;

class AuthServiceProvider extends ServiceProvider
{
    /**
     * The policy mappings for the application.
     *
     * @var array
     */
    protected $policies = [
        \App\Blog::class => \App\Policies\BlogPolicy::class,
    ];

    /**
     * Register any authentication / authorization services.
     *
     * @param \Illuminate\Contracts\Auth\Access\Gate $gate
     */
    public function boot(Gate $gate)
    {
        //register policies
        $this->registerPolicies();

        //define additional ability
        $gate->define('update-blog', function ($user, $blog) {
            return true;
        });
    }
}

Currently if you tried to use this ability, you would get an AuthorizationException, because the method didn't exist and the Gate would return false.

namespace App\Http\Controllers;

use App\Blog;

class BlogController extends Controller
{
    /**
     * @return
     */
    public function update(Blog $blog)
    {
        $this->authorize('update-blog', $blog);
    }

This is because the Gate would see an App\Blog passed as the first argument, and try to resolve the callback from App\Policies\BlogPolicy.

Solution

This PR makes sure the ability/method is callable on the policy, otherwise falls through to let the gate check for a matching ability, and then finally defaults to return false.

All tests are passing, including an additional one for this situation.