When someone has the general wilcard permission '*' all gates are skipped. Is that intended?

[Safuji]

And if its intended is there anyway to disable it? Didnt find anything in the docs

[drbyte]

The package checks against the gates you have configured in your app and in your defined permissions/roles, and only allows access when there is a match.

Please explain what you mean by "all gates are skipped".
It will be easier to assist you in debugging your app if you provide functional code which demonstrates the problem you are encountering.

[Safuji]

i have this role:

Role::updateOrCreate(['name' => Roles::DEV])->syncPermissions([
      '*',
]);

and when i give this to a user all the app just bypasses all policies.
I dont have any custom Gate::before logic or anything and even if i create a Gate::before it just gets skipped.

When i change my role to this everything just works normally

Role::updateOrCreate(['name' => Roles::DEV])->syncPermissions([
    'company.*',
    'management.*'
]);

Do you know any possible reason for this behavior?

[drbyte]

What is your intended meaning for '*'? (vs 'company.*' etc) ... like why are you assigning '*' to someone?
(I'm not pointing fingers, just trying to understand intentions, so we steer correctly.)

If there's a bug, I want to create a suitable test to prove the bug is present and then confirms that it is fixed. But I want to be sure I understand the use-case for what you're doing.
Earlier I created a simple test that created a '*' permission with and without a specific guard, and then assigned it to a user, and then tested whether the user could '*', and the test passed, only when the guard matched what the permission was created with.

[Safuji]

'*' is supposed to be just a wildcard to give a role all permissions.
If a user has this permission the policies i declared in AuthServiceProvider are skipped in my controller where i call my Policy like this through $this->authorize:

 public function show(Company $company = null): Response
    {
        $company ??= auth()->user()->company;

        $this->authorize('view', $company);