In the documentation you have mentioned:

JSON:API consistency

Maintain your API consistent accordingly with https://jsonapi.org

But it seems like it isn't.

I love the way you have structured this package it is close to Laravel Nova.

I've just started using this package two days ago and I was reading docs carefully and all over again to figure it out why the /users endpoint can be accessed by an unauthenticated user!?

I've set auth:sanctum under the middleware in the restify.php config file and I've checked other endpoints and they do returns the "Unauthenticated" sanctum message as I expected.

Now, if I change the method to POST - sanctum works!

So, I've created a new repository Service just to discover that the same thing happens. So, each index action is publicly accessible and ignores the auth:sanctum middleware for some reason.

Bonus: it should be --all instead of --app, right? Sub-bonus: Edit this page on GitHub returns 404

I have the following setup

// Repository
public static function matches(): array
{
    return [
        ...
        'has_direct_deposits' => HasDirectDepositsMatch::make()
                ->setType('boolean'),
        ...
    ];
}

// HavingDeductionRatesMatch
<?php

use Binaryk\LaravelRestify\Filters\MatchFilter;
use Illuminate\Http\Request;

class HasDirectDepositsMatch extends MatchFilter
{
    public function filter(Request $request, $query, $value)
    {
        dump('x', $request->all());
        if ($request->boolean('has_direct_deposits')) {
            $query->has('directDeposits');
        } else {
            $query->doesntHave('directDeposits');
        }
    }
}

// Repository Helper
public static function route(
    string|Model $path = null,
    Action $action = null,
    array $query = [],
): string {
    if ($path instanceof Model) {
        $path = $path->getKey();
    }

    if ($action) {
        $query['action'] = $action->uriKey();
    }

    $route = implode('/', array_filter([
        Restify::path(),
        static::uriKey(),
        $path,
        $action ? 'actions' : null,
    ]));

    if (empty($query)) {
        return $route;
    }

    return $route.'?'.http_build_query($query);
}

The query is generated using http_build_query method and converts bools to ints

Test

$this->getJson(EmployeeRepository::route(query: ['has_direct_deposits' => true]));
// Route is /api/restify/employees?has_direct_deposits=1
// Works as expected, the match is triggered

// Dump
^ "x"
^ array:1 [
  "has_direct_deposits" => "1"
]

$this->getJson(EmployeeRepository::route(query: ['has_direct_deposits' => false]));
// Route is /api/restify/employees?has_direct_deposits=0
// The match is not being triggered by Restify

// Nothing is dumped

$this->getJson(EmployeeRepository::route(query: ['has_direct_deposits' => 'false']));
// Route is /api/restify/employees?has_direct_deposits=false
// Works as expected, the match is triggered

// Dump
^ "x"
^ array:1 [
  "has_direct_deposits" => "false"
]

Commit https://github.com/BinarCode/laravel-restify/commit/a616a501eaf522c491eb124e45a62b7b2b890e33#diff-f55db4bc294bbb90108ccfcbdd11881f4707473ad9384b382e2a6b653e118471 removed exception_handler configuration, but this docs reference https://restify.binarcode.com/quickstart#exception-handling is left

edit: this too https://restify.binarcode.com/api/exception-handler#disable-restify-exception-handler

We need a way to set the type for class based matches.

<?php

namespace App\Restify\Matchers;

use Binaryk\LaravelRestify\Repositories\Matchable;
use Illuminate\Database\Eloquent\Builder;
use Illuminate\Http\Request;

class SentButNotDownloadedMatch implements Matchable
{
    public $type = 'boolean';

    public function handle(Request $request, Builder $query)
    {
        if ($request->boolean('sent_but_not_downloaded')) {
            $query->whereNotNull('sent_at')
                ->whereNull('downloaded_at');
        }
    }
}

Currently this does nothing

In case someone is going to guess a bunch of e-mail adresses you don't want to tell them the e-mail adress does exists but the combination is incorrect.

https://domain.test/api/restify/products/2 <- Working https://domain.test/api/restify/products <- not working when i am trying to access with id than it's working but when trying without with id like ( api/restify/products) then response is 401 forbidden

{ "message": "Unauthorized to view repository products. Check \"allowRestify\" policy.", "exception": "Symfony\\Component\\HttpKernel\\Exception\\HttpException", "file": "/Users/proxgrewal/Documents/Galaxy/vendor/laravel/framework/src/Illuminate/Foundation/Application.php", "line": 1148, "trace": [ { "file": "/Users/proxgrewal/Documents/Galaxy/vendor/laravel/framework/src/Illuminate/Foundation/helpers.php", "line": 44, "function": "abort", "class": "Illuminate\\Foundation\\Application", "type": "->" }, { "file": "/Users/proxgrewal/Documents/Galaxy/vendor/binaryk/laravel-restify/src/Http/Requests/Concerns/InteractWithRepositories.php", "line": 59, "function": "abort" }, { "file": "/Users/proxgrewal/Documents/Galaxy/vendor/binaryk/laravel-restify/src/Http/Controllers/RepositoryIndexController.php", "line": 12, "function": "repository", "class": "Binaryk\\LaravelRestify\\Http\\Requests\\RestifyRequest", "type": "->" }, { "file": "/Users/proxgrewal/Documents/Galaxy/vendor/laravel/framework/src/Illuminate/Routing/Controller.php", "line": 54, "function": "__invoke", "class": "Binaryk\\LaravelRestify\\Http\\Controllers\\RepositoryIndexController", "type": "->" }, { "file": "/Users/proxgrewal/Documents/Galaxy/vendor/laravel/framework/src/Illuminate/Routing/ControllerDispatcher.php", "line": 45, "function": "callAction", "class": "Illuminate\\Routing\\Controller", "type": "->" }, { "file": "/Users/proxgrewal/Documents/Galaxy/vendor/laravel/framework/src/Illuminate/Routing/Route.php", "line": 261, "function": "dispatch", "class": "Illuminate\\Routing\\ControllerDispatcher", "type": "->" }, { "file": "/Users/proxgrewal/Documents/Galaxy/vendor/laravel/framework/src/Illuminate/Routing/Route.php", "line": 204, "function": "runController", "class": "Illuminate\\Routing\\Route", "type": "->" }, { "file": "/Users/proxgrewal/Documents/Galaxy/vendor/laravel/framework/src/Illuminate/Routing/Router.php", "line": 725, "function": "run", "class": "Illuminate\\Routing\\Route", "type": "->" }, { "file": "/Users/proxgrewal/Documents/Galaxy/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php", "line": 141, "function": "Illuminate\\Routing\\{closure}", "class": "Illuminate\\Routing\\Router", "type": "->" }, { "file": "/Users/proxgrewal/Documents/Galaxy/vendor/binaryk/laravel-restify/src/Http/Middleware/AuthorizeRestify.php", "line": 22, "function": "Illuminate\\Pipeline\\{closure}", "class": "Illuminate\\Pipeline\\Pipeline", "type": "->" }, { "file": "/Users/proxgrewal/Documents/Galaxy/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php", "line": 180, "function": "handle", "class": "Binaryk\\LaravelRestify\\Http\\Middleware\\AuthorizeRestify", "type": "->" }, { "file": "/Users/proxgrewal/Documents/Galaxy/vendor/binaryk/laravel-restify/src/Http/Middleware/DispatchRestifyStartingEvent.php", "line": 29, "function": "Illuminate\\Pipeline\\{closure}", "class": "Illuminate\\Pipeline\\Pipeline", "type": "->" }, { "file": "/Users/proxgrewal/Documents/Galaxy/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php", "line": 180, "function": "handle", "class": "Binaryk\\LaravelRestify\\Http\\Middleware\\DispatchRestifyStartingEvent", "type": "->" }, { "file": "/Users/proxgrewal/Documents/Galaxy/vendor/binaryk/laravel-restify/src/Http/Middleware/EnsureJsonApiHeaderMiddleware.php", "line": 20, "function": "Illuminate\\Pipeline\\{closure}", "class": "Illuminate\\Pipeline\\Pipeline", "type": "->" }, { "file": "/Users/proxgrewal/Documents/Galaxy/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php", "line": 180, "function": "handle", "class": "Binaryk\\LaravelRestify\\Http\\Middleware\\EnsureJsonApiHeaderMiddleware", "type": "->" }, { "file": "/Users/proxgrewal/Documents/Galaxy/vendor/laravel/framework/src/Illuminate/Routing/Middleware/SubstituteBindings.php", "line": 50, "function": "Illuminate\\Pipeline\\{closure}", "class": "Illuminate\\Pipeline\\Pipeline", "type": "->" }, { "file": "/Users/proxgrewal/Documents/Galaxy/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php", "line": 180, "function": "handle", "class": "Illuminate\\Routing\\Middleware\\SubstituteBindings", "type": "->" }, { "file": "/Users/proxgrewal/Documents/Galaxy/vendor/laravel/framework/src/Illuminate/Routing/Middleware/ThrottleRequests.php", "line": 126, "function": "Illuminate\\Pipeline\\{closure}", "class": "Illuminate\\Pipeline\\Pipeline", "type": "->" }, { "file": "/Users/proxgrewal/Documents/Galaxy/vendor/laravel/framework/src/Illuminate/Routing/Middleware/ThrottleRequests.php", "line": 102, "function": "handleRequest", "class": "Illuminate\\Routing\\Middleware\\ThrottleRequests", "type": "->" }, { "file": "/Users/proxgrewal/Documents/Galaxy/vendor/laravel/framework/src/Illuminate/Routing/Middleware/ThrottleRequests.php", "line": 54, "function": "handleRequestUsingNamedLimiter", "class": "Illuminate\\Routing\\Middleware\\ThrottleRequests", "type": "->" }, { "file": "/Users/proxgrewal/Documents/Galaxy/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php", "line": 180, "function": "handle", "class": "Illuminate\\Routing\\Middleware\\ThrottleRequests", "type": "->" }, { "file": "/Users/proxgrewal/Documents/Galaxy/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php", "line": 116, "function": "Illuminate\\Pipeline\\{closure}", "class": "Illuminate\\Pipeline\\Pipeline", "type": "->" }, { "file": "/Users/proxgrewal/Documents/Galaxy/vendor/laravel/framework/src/Illuminate/Routing/Router.php", "line": 726, "function": "then", "class": "Illuminate\\Pipeline\\Pipeline", "type": "->" }, { "file": "/Users/proxgrewal/Documents/Galaxy/vendor/laravel/framework/src/Illuminate/Routing/Router.php", "line": 703, "function": "runRouteWithinStack", "class": "Illuminate\\Routing\\Router", "type": "->" }, { "file": "/Users/proxgrewal/Documents/Galaxy/vendor/laravel/framework/src/Illuminate/Routing/Router.php", "line": 667, "function": "runRoute", "class": "Illuminate\\Routing\\Router", "type": "->" }, { "file": "/Users/proxgrewal/Documents/Galaxy/vendor/laravel/framework/src/Illuminate/Routing/Router.php", "line": 656, "function": "dispatchToRoute", "class": "Illuminate\\Routing\\Router", "type": "->" }, { "file": "/Users/proxgrewal/Documents/Galaxy/vendor/laravel/framework/src/Illuminate/Foundation/Http/Kernel.php", "line": 167, "function": "dispatch", "class": "Illuminate\\Routing\\Router", "type": "->" }, { "file": "/Users/proxgrewal/Documents/Galaxy/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php", "line": 141, "function": "Illuminate\\Foundation\\Http\\{closure}", "class": "Illuminate\\Foundation\\Http\\Kernel", "type": "->" }, { "file": "/Users/proxgrewal/Documents/Galaxy/vendor/binaryk/laravel-restify/src/Http/Middleware/RestifyInjector.php", "line": 15, "function": "Illuminate\\Pipeline\\{closure}", "class": "Illuminate\\Pipeline\\Pipeline", "type": "->" }, { "file": "/Users/proxgrewal/Documents/Galaxy/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php", "line": 180, "function": "handle", "class": "Binaryk\\LaravelRestify\\Http\\Middleware\\RestifyInjector", "type": "->" }, { "file": "/Users/proxgrewal/Documents/Galaxy/vendor/livewire/livewire/src/DisableBrowserCache.php", "line": 19, "function": "Illuminate\\Pipeline\\{closure}", "class": "Illuminate\\Pipeline\\Pipeline", "type": "->" }, { "file": "/Users/proxgrewal/Documents/Galaxy/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php", "line": 180, "function": "handle", "class": "Livewire\\DisableBrowserCache", "type": "->" }, { "file": "/Users/proxgrewal/Documents/Galaxy/vendor/laravel/nova/src/Http/Middleware/ServeNova.php", "line": 23, "function": "Illuminate\\Pipeline\\{closure}", "class": "Illuminate\\Pipeline\\Pipeline", "type": "->" }, { "file": "/Users/proxgrewal/Documents/Galaxy/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php", "line": 180, "function": "handle", "class": "Laravel\\Nova\\Http\\Middleware\\ServeNova", "type": "->" }, { "file": "/Users/proxgrewal/Documents/Galaxy/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php", "line": 21, "function": "Illuminate\\Pipeline\\{closure}", "class": "Illuminate\\Pipeline\\Pipeline", "type": "->" }, { "file": "/Users/proxgrewal/Documents/Galaxy/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/ConvertEmptyStringsToNull.php", "line": 31, "function": "handle", "class": "Illuminate\\Foundation\\Http\\Middleware\\TransformsRequest", "type": "->" }, { "file": "/Users/proxgrewal/Documents/Galaxy/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php", "line": 180, "function": "handle", "class": "Illuminate\\Foundation\\Http\\Middleware\\ConvertEmptyStringsToNull", "type": "->" }, { "file": "/Users/proxgrewal/Documents/Galaxy/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php", "line": 21, "function": "Illuminate\\Pipeline\\{closure}", "class": "Illuminate\\Pipeline\\Pipeline", "type": "->" }, { "file": "/Users/proxgrewal/Documents/Galaxy/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/TrimStrings.php", "line": 40, "function": "handle", "class": "Illuminate\\Foundation\\Http\\Middleware\\TransformsRequest", "type": "->" }, { "file": "/Users/proxgrewal/Documents/Galaxy/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php", "line": 180, "function": "handle", "class": "Illuminate\\Foundation\\Http\\Middleware\\TrimStrings", "type": "->" }, { "file": "/Users/proxgrewal/Documents/Galaxy/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/ValidatePostSize.php", "line": 27, "function": "Illuminate\\Pipeline\\{closure}", "class": "Illuminate\\Pipeline\\Pipeline", "type": "->" }, { "file": "/Users/proxgrewal/Documents/Galaxy/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php", "line": 180, "function": "handle", "class": "Illuminate\\Foundation\\Http\\Middleware\\ValidatePostSize", "type": "->" }, { "file": "/Users/proxgrewal/Documents/Galaxy/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/PreventRequestsDuringMaintenance.php", "line": 86, "function": "Illuminate\\Pipeline\\{closure}", "class": "Illuminate\\Pipeline\\Pipeline", "type": "->" }, { "file": "/Users/proxgrewal/Documents/Galaxy/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php", "line": 180, "function": "handle", "class": "Illuminate\\Foundation\\Http\\Middleware\\PreventRequestsDuringMaintenance", "type": "->" }, { "file": "/Users/proxgrewal/Documents/Galaxy/vendor/laravel/framework/src/Illuminate/Http/Middleware/HandleCors.php", "line": 62, "function": "Illuminate\\Pipeline\\{closure}", "class": "Illuminate\\Pipeline\\Pipeline", "type": "->" }, { "file": "/Users/proxgrewal/Documents/Galaxy/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php", "line": 180, "function": "handle", "class": "Illuminate\\Http\\Middleware\\HandleCors", "type": "->" }, { "file": "/Users/proxgrewal/Documents/Galaxy/vendor/laravel/framework/src/Illuminate/Http/Middleware/TrustProxies.php", "line": 39, "function": "Illuminate\\Pipeline\\{closure}", "class": "Illuminate\\Pipeline\\Pipeline", "type": "->" }, { "file": "/Users/proxgrewal/Documents/Galaxy/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php", "line": 180, "function": "handle", "class": "Illuminate\\Http\\Middleware\\TrustProxies", "type": "->" }, { "file": "/Users/proxgrewal/Documents/Galaxy/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php", "line": 116, "function": "Illuminate\\Pipeline\\{closure}", "class": "Illuminate\\Pipeline\\Pipeline", "type": "->" }, { "file": "/Users/proxgrewal/Documents/Galaxy/vendor/laravel/framework/src/Illuminate/Foundation/Http/Kernel.php", "line": 142, "function": "then", "class": "Illuminate\\Pipeline\\Pipeline", "type": "->" }, { "file": "/Users/proxgrewal/Documents/Galaxy/vendor/laravel/framework/src/Illuminate/Foundation/Http/Kernel.php", "line": 111, "function": "sendRequestThroughRouter", "class": "Illuminate\\Foundation\\Http\\Kernel", "type": "->" }, { "file": "/Users/proxgrewal/Documents/Galaxy/public/index.php", "line": 52, "function": "handle", "class": "Illuminate\\Foundation\\Http\\Kernel", "type": "->" }, { "file": "/Users/proxgrewal/.composer/vendor/laravel/valet/server.php", "line": 234, "function": "require" } ] }

Fix when using ElasticSearch: Elastic\Elasticsearch\Exception\ClientResponseException: 400 Bad Request: {"error":{"root_cause":[{"type":"parsing_exception","reason":"[query_string] unknown token [VALUE_NULL] after [query]","line":1,"col":35}],"type":"parsing_exception","reason":"[query_string] unknown token [VALUE_NULL] after [query]","line":1,"col":35},"status":400}

Laravel version 8.83.14 Restify version 6.11

Currently I have a model called Folder which doesn't have $fillable nor $guarded defined. I created a new RepositoryFolder class and defined some rules. Now, I can store a new Model with any attributes defined in rules, which ignores $fillable.

Accordingly to the documentation I was expected a MassAssign Exception.

Useful when doing

public static function matches(): array
{
    return [
        'invoice_id' => MatchFilter::make()
            ->setType('array')
            ->setTitle('Job Number')
            ->setRelatedRepositoryKey(InvoiceRepository::uriKey()),
    ];
}

Fixes https://github.com/BinarCode/laravel-restify/issues/453

The problem was with the value for the query param... show_inactive=0 would result in (bool) 0 => false; altho show_inactive param was in query

Hello,

i have created a media relation

`<?php

namespace App\Restify\Actions\User;

use App\Models\User; use Binaryk\LaravelRestify\Actions\Action; use Binaryk\LaravelRestify\Http\Requests\RestifyRequest;

class AttachUserAvatarRestifyAction extends Action { public function handle(RestifyRequest $request, User $user) { if ($request->hasFile('avatar')) {

        if ($user->avatar) {
            $user->avatar->delete();
        }
        
        $user->addMediaFromRequest('avatar')->toMediaCollection('avatars');

        return $user->avatar?->getUrl();
    }
}

} `

and on UserRepository field('avatar', fn () => $this->model()->avatar?->getUrl())->rules(['image'])->action(new AttachUserAvatarRestifyAction)

So all is good but i think the action trigger after the value of this field returns the old data returned.

Thanks

Existing

https://github.com/BinarCode/laravel-restify/blob/f87b81b40f357608f9af2f7ee5a76dcf240b62d6/docs-v2/content/en/api/fields.md#L308

Issue

According to the docs for the media library, you need to use one of the "finishing methods" to store the media. Just calling addMediaFromRequest doesn't store the file.

Suggested

        $post->addMediaFromRequest('file')
            ->toMediaCollection();

Schema

User has many Post Post has many Note Note belong to User

Policy

Allow show for note when the note belongs to user.

class NotePolicy
{
    public function show(User $user, Note $note)
    {
       return $note->user_id == $user->id;
    }
}

Database

Post | id | |---| | 1 |

User | id | |---| | 1 | | 2 |

Note | id | user_id | |---|---| | 1 | 2 | | 2 | 1 |

Request

GET /posts?related=note Whenever a user fetches a post it would load the notes but only the ones belonging to the user because of the NotePolicy.

Response

Actual

{
   .....
   "relationships":{
      "notes":{
         "1":{
            "id":"2",
            "type":"notes"
         }
      }
   }
   .....
}

Expected

{
   .....
   "relationships":{
      "notes":[
         {
            "id":"2",
            "type":"notes"
         }
      ]
   }
   .....
}

Root cause

1. Resolve eager field uses allowToShow to nullify notes where the user is not allowed to access https://github.com/BinarCode/laravel-restify/blob/7.x/src/Fields/EagerField.php#L69
2. Resolve relationship uses filter on the collection to remove nulls https://github.com/BinarCode/laravel-restify/blob/7.x/src/Repositories/Repository.php#L530

Post loaded from db

{
   "id":1,
   "notes":[
      {
         "id":"1",
         "type":"notes"
      },
      {
         "id":"2",
         "type":"notes"
      }
   ]
}

Post notes are filtered via allowToShow (step 1)

{
   "id":1,
   "notes":[
     null,
      {
         "id":"2",
         "type":"notes"
      }
   ]
}

Post notes after removing nulls via filter (step 2)

{
   "id":1,
   "notes":{
      1 => {
         "id":"2",
         "type":"notes"
      }
   }
}

Suggested fix

Replace https://github.com/BinarCode/laravel-restify/blob/18d120ae886c2300307321c015501a2bcaccf7f8/src/Repositories/Repository.php#L543 with

return $items->filter()->values();

https://github.com/BinarCode/laravel-restify/blob/d0cff087b7212d66fdfabce479bd3de9f9e40f7f/src/Http/Controllers/Auth/VerifyController.php#L16

/** * @var User $user */
$user = config('restify.auth.user_model')::query()->findOrFail($id);