[12.x] Introducing authorizeAfterValidation

src/Illuminate/Validation/ValidatesWhenResolvedTrait.php

@@ -18,7 +18,9 @@ public function validateResolved()
     {
         $this->prepareForValidation();
 
-        if (! $this->passesAuthorization()) {
+        $authorizeAfterValidation = $this->authorizeAfterValidation();
+
+        if (! $authorizeAfterValidation && ! $this->passesAuthorization()) {
             $this->failedAuthorization();
         }
 
@@ -32,6 +34,10 @@ public function validateResolved()
             $this->failedValidation($instance);
         }
 
+        if ($authorizeAfterValidation && ! $this->passesAuthorization()) {
+            $this->failedAuthorization();
+        }
+
         $this->passedValidation();
     }
 
@@ -105,4 +111,14 @@ protected function failedAuthorization()
     {
         throw new UnauthorizedException;
     }
+
+    /**
+     * Determine if the request should verify the authorization only after validation.
+     *
+     * @return bool
+     */
+    protected function authorizeAfterValidation()
+    {
+        return false;
+    }
 }

tests/Foundation/FoundationFormRequestTest.php

@@ -110,6 +110,16 @@ public function testValidateThrowsExceptionFromAuthorizationResponse()
         $this->createRequest([], FoundationTestFormRequestForbiddenWithResponseStub::class)->validateResolved();
     }
 
+    public function testValidateThrowsNoAuthorizationExceptionIfValidationFails()
+    {
+        $this->expectException(ValidationException::class);
+        $this->expectExceptionMessage('error');
+
+        $request = $this->createRequest([], FoundationTestFormRequestAuthorizeAfterValidation::class);
+
+        $request->validateResolved();
+    }
+
     public function testValidateDoesntThrowExceptionFromResponseAllowed()
     {
         $this->createRequest([], FoundationTestFormRequestPassesWithResponseStub::class)->validateResolved();
@@ -437,6 +447,24 @@ public function passedValidation()
     }
 }
 
+class FoundationTestFormRequestAuthorizeAfterValidation extends FormRequest
+{
+    public function authorize()
+    {
+        return Response::deny('foo');
+    }
+
+    public function rules()
+    {
+        return ['name' => 'required'];
+    }
+
+    protected function authorizeAfterValidation()
+    {
+        return true;
+    }
+}
+
 class FoundationTestFormRequestForbiddenWithResponseStub extends FormRequest
 {
     public function authorize()