[10.x] Adds FormRequest@getRules() method

[cosmastech]

What

A way to override how the rules for a form request are retrieved without having to touch the createDefaultValidator() function.

Why?

Maybe you don't want to name your child class' method rules(). I don't know why that would be a big deal, but maybe you don't.

For my team, we are reimagining our API design so that multiple user roles can access common endpoints (/transactions, /media, etc). However, the list transactions endpoint for one user type will have a totally different set of filters than those of another user type. (For instance, admin can search across all user's transactions but filter by sending bank, whereas that option wouldn't be visible for the average user).

class ListTransactionsRequest extends FormRequest
{
    public function rules(): array
    {
        if ($this->user()->role == 'admin') {
            return [
                'sender_bank_id' => ['nullable', 'int'],
                'user_status' => ['nullable', Rule::in(['deliquent', 'active', 'expired'])],
                // ...
            ];
        }
        else if ($this->user()->role == 'payer') {
            return [
                'date' => ['date:Y-m-d'],
                // ...
            ];
        }
        else if ($this->user()->role == 'user') {
            // ...
        }
    }
}

We have hundreds of requests in our application, so this pattern is tricky and to be avoided. For us, it's a lot easier to do something like this:

class ListTransactionsRequest extends FormRequest
{
    protected function getRules(): array
    {
        return match($this->user()->role) {
            'payer' => $this->rulesForPayer(),
            'admin' => $this->rulesForAdmin(),
            // ...
        }
    }

    private function ruleForPayer()
    {
        return [
            'date' => ['date:Y-m-d'],
            // ...
        ];
    }
}

Potential Side Effects

Most common users, this should have no impact. The only place where it might be a problem is if a user has a child class (extending from FormRequest) which has its own getRules() method on it prior to this change.

[cosmastech]

@mateusjunges why the thumbs down? curious if there's maybe a better way to solve this (in our application) other than what I'm thinking of?

[rojtjo]

I might be missing something here but can't you just rename the getRules method in your example to rules to achieve the same?

class ListTransactionsRequest extends FormRequest
{
    protected function rules(): array
    {
        return match($this->user()->role) {
            'payer' => $this->rulesForPayer(),
            'admin' => $this->rulesForAdmin(),
            // ...
        }
    }

    // ...
}

[cosmastech]

I might be missing something here but can't you just rename the getRules method in your example to rules to achieve the same?

class ListTransactionsRequest extends FormRequest
{
    protected function rules(): array
    {
        return match($this->user()->role) {
            'payer' => $this->rulesForPayer(),
            'admin' => $this->rulesForAdmin(),
            // ...
        }
    }

    // ...
}

Absolutely! However, we were hoping to make use of interfaces to handle this. I suppose that would be another approach we could take.

We were looking to make these changes gradually to existing endpoints. If we do it this way, we would have to change the completed 40 requests and modify all of them to route the rules() to difference functions.

Ultimately, worst case, we override createDefaultValidator() in our BaseRequest class, but was hoping to avoid that as it means we need to make sure we keep our version up to date with any changes that may come down the pike in Laravel.

[mateusjunges]

@cosmastech I gave a thumbs down for the reason described by @rojtjo. I don't think this method is needed if you can use the existing rules method to achieve the same thing.

We were looking to make these changes gradually to existing endpoints. If we do it this way, we would have to change the completed 40 requests and modify all of them to route the rules() to difference functions.

I also don't understand this. Why do you have to change all 40 request classses at once? Why can't you change one and keep the others unchanged?

[cosmastech]

@cosmastech I gave a thumbs down for the reason described by @rojtjo. I don't think this method is needed if you can use the existing rules method to achieve the same thing.

Within our project, all requests extend from a BaseRequest class (which itself extends from FormRequest).

What I was hoping to do is something like this:

class BaseRequest extends FormRequest
{
    // ...
    protected function createDefaultValidator(ValidationFactory $factory)
    {
        $methodName = match(true) {
            $this instanceof AuthorizesAdminRequest && $this->user()->role === 'admin' => 'adminRules',
            $this instanceof AuthorizesPayerRequest && $this->user()->role === 'payer' => 'payerRules',
            // ...
            default => 'authorize',
        };

        $rules = method_exists($this, $methodName) ? $this->container->call([$this, $methodName]) : [];
        // everything below here is copied directly from the parent class' method
        $validator = $factory->make(
            $this->validationData(),
            $rules,
            $this->messages(),
            $this->attributes()
        )->stopOnFirstFailure($this->stopOnFirstFailure);

        if ($this->isPrecognitive()) {
            $validator->setRules(
                $this->filterPrecognitiveRules($validator->getRulesWithoutPlaceholders())
            );
        }

        return $validator;
    }
}

If we already have a ListTransactionsRequest with rules() that was designed to work with users, but not necessarily admins or payers, we can leave the request alone and just implement an interface on the class:

interface AuthorizesAdminRequest
{
    public function adminRules();
}

And all we have to do to the existing request would be to tack on implements and then add adminRules():

class ListTransactionsRequest extends BaseRequest implements AuthorizesAdminRequest
{
    // no other changes besides this:
    public function adminRules()
    {
        return [
            'filter_only_applies_to_admins' => ['rules-go-here'],
            // ...
        ];
    }
}

We're fine if it doesn't get added, but would be a lot easier.

[mateusjunges]

I might be missing something, but I still don't understand why you can't use the rules method.

[driesvints]

Please undo all unrelated coding style changes.

[driesvints]

The sequence change for these calls seem to impact some people: #50083