title: HttpException in Handler.php line 107: This action is unauthorized
body: <p>I'm learning Laravel 5. I have finished the document's <a href="https://laravel.com/docs/5.2/quickstart-intermediate" rel="nofollow">Quickstart - intermediate</a>. I want to apply the authorize check for Task's actions to the User's. I want to check whether the target user is the current logged in user in order to use user's edit action. However, browser keeps telling me when I try to access <code>http://myfirst.app/users/2/edit</code>:</p>
  
  <pre><code>FatalThrowableError in UsersPolicy.php line 20:
  Type error: Argument 1 passed to App\Policies\UsersPolicy::edit() must be an instance of Illuminate\Http\Request, instance of App\User given
  </code></pre>
  
  <p>Routes.php</p>
  
  <pre><code>Route::get('/users/{user}', 'UsersController@view');
  Route::get('/users/{user}/edit', 'UsersController@edit');
  Route::patch('/users/{user}', 'UsersController@update');
  </code></pre>
  
  <p>AuthServiceProvider.php</p>
  
  <pre><code>protected $policies = [
      'App\Model' =&gt; 'App\Policies\ModelPolicy',
      'App\Task' =&gt; 'App\Policies\TaskPolicy',
      'App\User' =&gt; 'App\Policies\UsersPolicy',
  ];
  </code></pre>
  
  <p>UsersPolicy.php</p>
  
  <pre><code>namespace App\Policies;
  
  use App\User;
  use Illuminate\Http\Request;
  use Illuminate\Auth\Access\HandlesAuthorization;
  
  class UsersPolicy
  {
      use HandlesAuthorization;
  
      public function edit(Request  $request, User $user)
      {
          return $request-&gt;user()-&gt;id === $user-&gt;id;
      }
  
      public function update(Request  $request, User $user)
      {
          return $request-&gt;user()-&gt;id === $user-&gt;id;
      }
  }
  </code></pre>
  
  <p>UsersController.php</p>
  
  <pre><code>namespace App\Http\Controllers;
  
  use App\User;
  use Illuminate\Http\Request;
  use App\Http\Controllers\Controller;
  
  class UsersController extends Controller
  {
  
      protected $user;
  
      public function __construct() {
          $this-&gt;middleware('auth');
      }
  
      public function view(Request $request, User $user)
      {    
          if($request-&gt;user()-&gt;id == $user-&gt;id){
              return view('users.view', ['user' =&gt; $user]);
          }
          return redirect('/tasks');
      }
  
      public function edit(Request $request, User $user)
      {
          $this-&gt;authorize('edit', $user);
          return view('users.edit', compact('user'));
      }
  
      public function update(Request $request, User $user)
      {
          $this-&gt;authorize('update', $user);        
          $user-&gt;update($request-&gt;all());    
          return redirect('/users/'.$user-&gt;id);
      }
  }
  </code></pre>
  
  <p>In the <a href="https://laravel.com/docs/5.2/quickstart-intermediate#route-model-binding" rel="nofollow">Document's</a> TaskController's delete function, <code>$user</code> isn't passed into <code>$this-&gt;authorized('destroy', $task)</code> in order to allow TaskPolicy's destroy function to use <code>$user</code>:</p>
  
  <p>TaskController.php</p>
  
  <pre><code>public function destroy(Task $task)
  {
      $this-&gt;authorize('destroy', $task);
      $task-&gt;delete();
      return redirect('/tasks');
  
  }
  </code></pre>
  
  <p>TaskPolicy.php</p>
  
  <pre><code>public function destroy(User $user, Task $task)
  {
      return $user-&gt;id === $task-&gt;user_id;
  }
  </code></pre>
  
  <p>Anyway, I followed the exception and added $request to UsersController's edit function's parameter</p>
  
  <pre><code>$this-&gt;authorize('edit', $request, $user);
  </code></pre>
  
  <p>And I get</p>
  
  <pre><code>HttpException in Handler.php line 107:
  This action is unauthorized.
  </code></pre>
  
  <p>What should I do?</p>