Support wildcard as argument for allowing all attributes/columns

[marknuyens]

I believe it would be a nice addition if you weren't bound to the attributes/columns that you need to specify, if you would like to include all columns to be allowed. This could result in a single additional argument check for an string asterix, for example.

Anyway, hope this is something others may find useful as well.

Thanks.

[vincent-lu]

Would really love having this. In my case I'd prefer to have * to indicate "all (columns)". Does this have something to do with Laravel not knowing what columns are availabe in a table?

[marknuyens]

I don’t believe so; currently, I am accepting the requested query parameter (e.g. “filter”) as the value to allow for this feature in the meantime. Like so:

$this->allowedFilters(array_keys(request(‘filter’) ?? []));

It feels a bit hacky and more importantly, repetitive.

One argument I could think of for not supporting this behavior is security related, where users could specify unanticipated input. The current solution (i.e. by specifying allowed columns), would prevent this.

[vincent-lu]

Yeah I thought about that but end up adding a function like this in my models where I know it's a run-of-a-mill type model:

public static function getAllFields(): array
{
    $model = new static();

    return array_merge(['id'], $model->getFillable());
}

then in the controller I just call

->allowedFields(Product::getAllFields())

I get the security argument, but it really depends on use case; for example in my situation all access are protected by auth gate and only company stuff can access, and the model in question doesn't have particularly sensitive information. If one can use protected $guarded = [] in models, I don't think why a wildcard * is less kosher as long as the dev understands.

[marknuyens]

I was actually considering a similar approach, but using different properties on the model. For example:

$filterable = […]; $sortable=[…]; Etc…

And then pretty much use your way of obtaining them. 😎