Day 8 - Laravel Request validation

Introduce

由於我们想防范使用我们API的使用者传入恶意的参数或传入我们预期中型态的参数，我们需要做好Request validation的防护

建立Request，把Request独立出来不要在Controller当中做Validation

$ sail artisan make:request CreatePostRequest

指定Call create post API的时候进行Validation，我们只要在Controller自动注入CreatePostRequest

namespace App\Http\Controllers;

use Illuminate\Http\Request;
use App\Services\PostService;
use App\Http\Requests\CreatePostRequest;
use Illuminate\Http\JsonResponse;

class PostController extends Controller
{
    protected $service;

    public function __construct(PostService $service)
    {
        $this->service = $service;
    }

    /**
     * 建立文章
     * @param CreatePostRequest $request
     * @return JsonResponse
     */
    public function create(CreatePostRequest $request): JsonResponse
    {
        $result = $this->service->create($request->all());
        return response()->json($result);
    }
}

调整CreatePostRequest
- authorize()里面调整为true
- rules()当中验证传入的Request

<?php

namespace App\Http\Requests;

use Illuminate\Foundation\Http\FormRequest;

class CreatePostRequest extends FormRequest
{
    /**
     * Determine if the user is authorized to make this request.
     *
     * @return bool
     */
    public function authorize()
    {
        return true;
    }

    /**
     * Get the validation rules that apply to the request.
     *
     * @return array
     */
    public function rules()
    {
        return [
            'title' => 'required|string|unique:posts',
            'content' => 'required|string',
        ];
    }
}

当我们传入空的body时，Status code会直接回传422，并显示哪些栏位为必填，或须为字串；另外如果传入的Title已经建立过，将会跳出已经该Title已经建立过的错误讯息
接下来列出几个比较常见的Validation供参考

required可以替换为:

filled: 此参数可传可以不传，传入时必须不为空值．
present: 此参数必填，但可以为空值．

其它：

max or min: 限制最大或最小的长度

return [
    'title' => 'required|string|unique:posts|max:10|min:2',
];

exists: 该栏位参数必须已经存在在资料库

return [
    'user_id' => 'required|integer|exists:user_id',
];

rule: 白名单，传入字串必须为阵列当中其中一个，范例：排序必须为升幂或降幂

return [
    'sort' => [
        'required',
        'string',
        Rule::in(['asc', 'desc'])
    ],
];

return [
    'sort' => [
        'required|string|in:asc,desc',
    ],
];

after: 结束时间必须在开始时间後面

return [
    'start_at' => [
        'required',
        'date'
    ],
    'end_at' => [
        'required',
        'date',
        'after:start_at'
    ],
]