If we pass an Expression to our database assertion, because it contains no public properties, when it is JSON encoded it will always return '{}', which is unhelpful to us in debugging.

this PR is far from an ideal solution, as the entire expression will be returned to the output, but it's better than the empty object it currently returns.

for example:

$this->assertDatabaseHas('users', [
    'name' => 'Andy',
    'skills' => $this->castAsJson(['laravel', 'vue', 'tailwind']),
];

If this is not found in the database it would currently output:

Failed asserting that a row in the table [dealers] matches the attributes {
    "name": "Andy",
    "skills": {},
}.

With this PR, it will instead output:

Failed asserting that a row in the table [dealers] matches the attributes {
    "name": "Andy",
    "skills": "CAST('[\"laravel\",\"vue\",\"tailwind\"]' AS JSON)",
}.

Again, not ideal, but at least the data is there for us to compare against.

You could also send any response you wanted in your own exception handler.

Description:

I just want to suggest improvement in ModelNotFoundException class, because when the app is in production any one can send http request for non exist record and the app will response this:

{
"message": "No query results for model [App\\Models\\User] 1"
}

So the (developer or hacker) can understand how your app was developed and structure of your models ... and this is bad. it's best to keep my app secure.

This message is good when app is in local env and this message the normal user can't understand that namespace ...

Steps To Reproduce:

api.php

Route::get('/user/{user}', static function (\App\Models\User $user) {
return 'good';
});

use POSTMAN or INSOMNIA

and send http request for non exists user for example: user/9999

No plans to change this. Unclear how knowing your namespace structure is a security risk.

<!-- DO NOT THROW THIS AWAY --> <!-- Fill out the FULL versions with patch versions -->

• Laravel Version: 8.6.0
• PHP Version: 7.3.21
• Database Driver & Version: sqlite, sqlite 3.33.0

Description:

$custom_pivot->increment('columname', value); does not update database with incremented value

Steps To Reproduce:

The product model:

<?php

namespace App\Models;

use Illuminate\Database\Eloquent\Factories\HasFactory;
use Illuminate\Database\Eloquent\Model;

class Product extends Model
{
    use HasFactory;

    /**
     * The attributes that are mass assignable.
     *
     * @var array
     */
    protected $fillable = [
        'name',
        'description',
        'price',
        'stock',
        'width',
        'height',
        'available'
    ];
    public function users()
    {
        return $this->belongsToMany('App\Models\User', 'App\Models\Shoppingcartorder')->withPivot('amount')->withTimestamps();
    }
}

The User Model: (jetstream user model)

<?php

namespace App\Models;

use Illuminate\Contracts\Auth\MustVerifyEmail;
use Illuminate\Database\Eloquent\Factories\HasFactory;
use Illuminate\Foundation\Auth\User as Authenticatable;
use Illuminate\Notifications\Notifiable;
use Laravel\Fortify\TwoFactorAuthenticatable;
use Laravel\Jetstream\HasProfilePhoto;
use Laravel\Sanctum\HasApiTokens;

class User extends Authenticatable
{
    use HasApiTokens;
    use HasFactory;
    use HasProfilePhoto;
    use Notifiable;
    use TwoFactorAuthenticatable;

    /**
     * The attributes that are mass assignable.
     *
     * @var array
     */
    protected $fillable = [
        'name',
        'email',
        'password',
    ];

    /**
     * The attributes that should be hidden for arrays.
     *
     * @var array
     */
    protected $hidden = [
        'password',
        'remember_token',
        'two_factor_recovery_codes',
        'two_factor_secret',
    ];

    /**
     * The attributes that should be cast to native types.
     *
     * @var array
     */
    protected $casts = [
        'email_verified_at' => 'datetime',
    ];

    protected $with = [
        'products',
    ];

    /**
     * The accessors to append to the model's array form.
     *
     * @var array
     */
    protected $appends = [
        'profile_photo_url',
    ];

    public function products()
    {
        return $this->belongsToMany('App\Models\Product','App\Models\Shoppingcartorder')->withPivot('amount')->withTimestamps();
    }
}

The pivot

<?php

namespace App\Models;

use Illuminate\Database\Eloquent\Relations\Pivot;

class Shoppingcartorder extends Pivot
{
       /**
     * The attributes that are mass assignable.
     *
     * @var array
     */
    protected $fillable = [
        'product_id',
        'user_id',
        'amount',
    ];
}

The function I was trying to use in my pivot's controller

public function incrementAmount(Product $product, Int $amount = 0)
    {
        $pivot = $product->users()->where('user_id', Auth::id())->first()->pivot;
        $pivot->increment('amount', $amount);
        //$pivot->save();
    }

Either with or without save() This function DOES increment the pivot model. dd() shows amount as X + $amount. But the database is unaffected.

So I rewrote the incrementing function myself, and this works. I checked out the incrementing() function in Model to see why the behavior is different but it does a bunch of abstractions and calls that just confuse me.

public function incrementAmount(Product $product, Int $amount = 0)
    {
        $pivot = $product->users()->where('user_id', Auth::id())->first()->pivot;
        $pivot->amount = $pivot->amount + $amount;
        $pivot->save();
    }

If this is intended behavior, sorry for the time wasted. This is incredibly confusing.

I see the problem. Fixed in next patch.

So I kept the onError method and also added support for passing a Closure to throw per @deleugpn suggestion. I kept both because I figured sometimes you may want to onError but not throw anything.

Implementation updated: https://github.com/laravel/framework/pull/34558#issuecomment-699911645

Because:

• There is a repeated pattern where you want to perform a particular action if the response has failed, such as logging an error, but still have the exception throw afterwards.

Before...

$response = $client->withHeaders($headers)->post($url, $payload);

if ($response->failed()) {
    Log::error('Twitter API failed posting Tweet', [
        'url' => $url,
        'payload' => $payload,
        'headers' => $headers,
        'response' => $response->body(),
    ]);

    $response->throw();
}

return $response->json();

After...

return $client->withHeaders($headers)
    ->post($url, $payload)
    ->throwWith(fn ($response) =>
        Log::error('Twitter API failed posting Tweet', [
            'url' => $url,
            'payload' => $payload,
            'headers' => $headers,
            'response' => $response->body(),
        ])
    )->json();

This commit:

• Adds the throwWith method to the response.
• Updates the throw method to utilise the new throwWith method, just with an empty closure.

Notes:

• I'm not convinced this is the best name for this method.
• I'm also wondering if the method should be a tap method of some kind. tapWhenThrowing or something along those lines.

I find the optional() example when a Closure is provided as a second argument quite confusing. The callback is only executed if the user is not null. For that reason, returning a DummyUser seems silly. Returning a DummyUser would make sense if optional's callback was used to determine the fallback value. But the fallback value is always null when a Closure is provided.

A more realistic example is:

return optional(User::find($id), function ($user) {
    return $user->name
});

which is equivalent to the previous example:

return optional(User::find($id))->name;

and makes a lot more sense from a practical viewpoint.

<!-- We are not accepting new presets.

Please only send a pull request to branches which are currently supported: https://laravel.com/docs/releases#support-policy

If you are unsure which branch your pull request should be sent to, please read: https://laravel.com/docs/contributions#which-branch

Pull requests without a descriptive title, thorough description, or tests will be closed.

In addition, please describe the benefit to end users; the reasons it does not break any existing features; how it makes building web applications easier, etc. -->

I don't want to make assumptions about how people's NPM / Yarn is setup.

Display user name nicer when Features::profilePhotos() is not enabled.

Styling matches inactive navigation items.

Upon hover or clicking, styling matches active state of other navigation items.

After researching https://github.com/laravel/framework/issues/34548 I've come to the conclusion that pivot tables always require both a created_at and updated_at column because of their behavior of inheriting parent timestamp column names. This isn't immediately clear because for regular Eloquent models you can disable them by setting static::CREATED_AT and/or static::UPDATED_AT to null. So it's best to clarify the specific behavior here.

It could also be that we just don't support setting these constants to null in the first place and that both a created_at and updated_at column are always required? If so, then I think we should explicitly state that somewhere in the docs.

This pull request adds disable attribute to save button while profile picture is uploading.

This makes factory creation and factories instantiation root namespace aware. I just steal this from Illuminate/Console/GeneratorCommand.php to be consistent with the generation and use and with other parts of the framework where is not hard coded App\ for example php artisan make:model that uses the root namespace.

I really prefer people do not rename the App namespace. I'm also a bit worried to the change in behavior on the Factory class on a minor release.

This adds a more usable X-Message-ID header to a sent message containing the response id from the third-party.

The X-Message-ID can be retrieved and used to keep track of upcoming triggered web-hook events from the same third-party.

Fully backwards compatible, however the existing headers could be removed in the next major version. These are:

• X-Mailgun-Message-ID
• X-SES-Message-ID

This PR introduces a created() method similar to the old registered() method. It not only allows running code after the user has been created and logged in but also allows the user to return a custom response from this method that will override the default registration response.

The PR is targeted to master because updating contracts is a breaking change, which could be removed by using method_exists and not adding the method to the contract. Let me know if that's a preferred implementation.

I personally don't love tons of method hooks like this. I would suggest just moving the Registered event down a line so that it fires after login and people can put custom logic in an event listener that listens to that event.

Does it work if you assign an auto-incrementing primary key to your pivot model table?

<!-- DO NOT THROW THIS AWAY --> <!-- Fill out the FULL versions with patch versions -->

• Laravel Version: 8.6.0
• PHP Version: 7.4.10
• Database Driver & Version: InnoDB 5.7.30

Description:

when call SomeEloquentModel::query()->paginate(null, null); mysql exception is thrown SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'fromac_symbolslimit 15 offset 0' at line 1 (SQL: select fromac_symbolslimit 15 offset 0) or similar The point is select from without asterisk.

Steps To Reproduce:

1. Create any eloquent model, for example, User
2. Call in any controller User::query()->paginate(null, null)

Add :key buildings for list (for) rendering

This PR updates a couple issues with list renderings not having a :key binding

https://vuejs.org/v2/guide/list.html

it also changes a couple redundant length comparison checks

This shouldn't generally be necessary on guest routes.

Existence of Model's create method and caveats of two different update functions (on Model and Builder) made clearer without needing to refer to the API specs and source.

Wording here needs some work. I'll take a look.

Its very important information.

I think this is just kind of standard knowledge? How else would you validate in Laravel?

Update on the builder (using where) instead of on the model (using find) bypasses the model convenience features such as guarded attributes, etc. The proposed change indirectly brings this fact to light, and can help avoid inadverdent security lapses.

I think this should be added to the body text somewhere - not as a note.

bash init.sh work on windows too.

Use case examples.

<?php

$request->whenEquals('foo', 'bar', fn ($value) => /* foo value is filled and equals to bar */);

I also added a method to compare the parameter values based on the method of the Str::is() class. E.g.

<?php

$request->isEquals('foo', 'bar'); // Returns true if foo parameter value is equals to bar...

Request is macroable so you can macro this into your project.

Please, see issue #84

Not necessarily related only to two factor confirmation.

• Laravel Version: 6.x+

Description:

The actingAs testing method overrides the default guard, this results in tests that pass when they should not.

Steps To Reproduce:

We had an endpoint which displays different content when the user is logged in or not so we could not use the auth middleware which sets the guard upon user checking.

example controller:

public function example(Request $request)
{
    $user = request()->user() // it should be request()->user('other-guard');
    if ($user) {
        return view('authenticated-content', ['user' => $user]);
    }

    return view('guest-content');
}

corresponding test:

public function example_test()
{
    $user = factory...; // the usual
    $this->actingAs($user. 'other-guard');

    $response = $this->get('endpoint');

    $response->assertViewHas('user', $user);
}

This test will pass because of this line while in the real world it will just show the guest content to the authenticated user.

We can't remove this line as that would be pretty breaking. If you want your code to always pull from a specific guard you can pass the guard to the $request->user() method.

• According to PSR12 Standards, the parameter list must be "()"

Unnecessary.

Jetstream delivers a powerful team system as standard. However, I believe that user-generated teams are needed in fewer cases and that you are more likely to rely on user or group rights.

So I would suggest that you build in user and group rights (you should be able to assign users to multiple groups).

Important for the rights would be for me that there is the possibility to set a right to "never" and otherwise, if you are in multiple groups, the highest value is taken.

Feel free to build this into your own application.

Jetstream appears to be well suited to provide an organisation/teams model, and assign permissions to a user based on the organisation they are in, and then subsequently the team they are in.

Is this something that could be considered, to be added?

No plans on adding this currently.

This PR adds the ability to delete a pending job from a queue. Right now, if a user has to delete a pending job, the implementation would depend on the queue driver and there's no easy way to do so with the framework.

I think if the framework directly supports this in the various drivers, it would be easier for packages like Horizon to delete pending jobs from the dashboard and also make it very convenient for Laravel users to do so in development / specific production environment cases.

Also how would you know if the job is still pending and is cancellable? I think in your cart abandoned example the delayed job itself can check if it still needs to execute and delete itself if it doesn't.

Same with the analytics example. The user cancelling could store a record in the database that the queued job checks at the beginning of its handle method, etc.

All of these situations feel solvable without the complexity and questions around this PR.

How do I get the ID of the job if I do Job::dispatch()->delay(now()->addHours(2))?

Fixes #73

This would be a breaking change since subscriptions added during the current request where the subscriptions were already loaded once would not be returned by this call anymore.

You can work-around the multiple query issue by just accessing the relation directly yourself in your own code:

$user->subscriptions->where('name', $name)->first()

Related: https://github.com/laravel/framework/pull/34547

This PR adds the absent validation rule, the opposite of the present validation rule.

This can be useful when you're using validation and passing the validated parameters to a model create call for instance, but you want to ensure a given field is only passed for a specific role.

For instance:

$validated = $request->validate([
    'name' => 'required',
    'public' => $user->isRole('admin') ? 'boolean' : 'absent',
]);

Book::create($validated);

PR for laravel/laravel for the validation rule translation can be found here: https://github.com/laravel/laravel/pull/5428

Targeted to master as someone can have a absent validation rule via macros.

We got a similar PR the other day and I just wonder if this really is necessary in the validation layer. You could do something like:

$validated = $request->validate([
    'name' => 'required',
    'public' => 'boolean',
]);

Book::create(
    $user->isRole('admin')
            ? Arr::except($validated, ['public'])
            : $validated
);

Which doesn't require us to add a new validation rule just for ignoring something.

Per @driesvints response on these issues, the default model for Cashier is App\User and needs to be set in the env file to work with Laravel 8.

https://github.com/laravel/cashier-stripe/issues/997

https://github.com/laravel/cashier-stripe/issues/995

We have fixed current branch of Cashier to look for App\Models\User

The default Redis Facade name conflicts with the class of the phpredis PHP extension (ref https://github.com/laravel/framework/issues/32007#issuecomment-600441581). I encountered this issue updating Homestead recently and I felt this note could save somebody else some time.

The exception message we throw already tells you this is the case.

Will close in light of comment above.

I have tried to mimic some events dispatching in one of my tests, but I wanted to use the same test for different roles (as I am using Jetstream) to test the permissions and if certain permissions are able to dispatch some events, and I needed to flush the faked events so they do not interact with each other, but I have seen it is not supported here.

It can be used like this, passing the tests:

Event::fake();

broadcast(new SomeEvent);

Event::assertDispatched(SomeEvent::class);

Event::flush(SomeEvent::class);

Event::assertNotDispatched(SomeEvent::class);

However, the real use case is to test multiple users dispatching the events and clearing the dispatches between each one, without writing different tests.

This PR adds the absent validation rule, the opposite of the present validation rule.

This can be useful when you're using validation and passing the validated parameters to a model create call for instance, but you want to ensure a given field is only passed for a specific role.

For instance:

$validated = $request->validate([
    'name' => 'required',
    'public' => $user->isRole('admin') ? 'boolean' : 'absent',
]);

Book::create($validated);

This has some other unrelated commits with it. What would the validation message for such a rule be?

May be best to use the unique rule builder so you can just pass the model instance directly and have the table name extracted.

Sometimes we need to use both a model and its related models in a test.

Actually, if both of them have to be created in the test, we can do

$posts = PostFactory::times(3)->for(UserFactory::new())->create();
$user = $posts->first()->user;

// do some work using $user and $posts

or

$user = UserFactory::new()->has(PostFactory::times(3))->create();
$posts = $user->posts;

If the user already exists, we need to explicitly define the attribute :

// previously defined $user, could be with $user = UserFactory::new()->create();
$posts = PostFactory::times(3)->create(['user_id' => $user]);

This PR add the ability to define the relation in a more convenient way

$user = UserFactory::new()->create();
$posts = PostFactory::times(3)->of($user)->create();

In case the relation cannot be guessed directly from the model, we can define it explicitly :

$posts = PostFactory::times(3)->of($user, 'author')->create();

This PR also adds a dynamic call for of method :

$posts = PostFactory::times(3)->ofUser($user)->create();

// or $posts = PostFactory::times(3)->ofAuthor($user)->create();

All of this also works for MorphTo relations :

$comments = CommentFactory::times(3)->of($post, 'commentable')->create();
// or $comments = CommentFactory::times(3)->ofCommentable($post)->create();

If the user already exists you don't need to manually define the attribute:

$user->posts()->save(Post::factory()->make());

Added static property to ComponentAttributeBag that defines additional attributes to implode rather than overwrite. Origin of this idea is in laravel/ideas#2345, and documentation update yesterday laravel/docs#6415.

class attribute is still hard coded, so nothing changes there (and it can't accidentally be broken).

My use case is to create blade components that will work with multiple Stimulus controllers and targets.

If this is merged I can submit a pull request this afternoon to to the documentation.

Use attributes

{{-- Whitelist attributes to implode --}}
ComponentBagAttribute::implodedAttributes(['data-target']);

{{-- Defining component input.blade.php --}}
<input type="text" {{ $attributes->merge(['data-target' => 'autocomplete.input']) }} >

{{--Using component with more than one Stimulus controller--}}
<x-input data-target="item-form.item" />

{{-- Outputs this HTML --}}
<input type="text" data-target="item-form.item autocomplete.input" />

What if you want this behavior on some data-targets but not others? Defining this on a global level is not a good idea I don't think. I think you would want to specify this on a per-use level, like:

<input type="text" {{ $attributes->merge(['data-target' => $attributes->appendable('default-value'), 'class' => 'foo]) }} >

Redoing this on the other stack.

This PR documents the Storage::path() method and explains how the path is returned whether local or s3 driver is used. I assumed this should be documented, as there are some components that require absolute path when accessing files (attaching files in notifications), and I feel storage_path('app/'.$path) is a bit clumsy.

Port of https://github.com/laravel/cashier-paddle/pull/69 for Cashier Stripe. Credits to @yoeriboven.

Tests are failing because of rate limiting. Passing locally.

This PR documents email notification attachments as well as raw data attachments.