create-nevela 0.5.2 → 0.6.0

package/index.mjs

@@ -75,7 +75,7 @@ const HELP = `  Create a new Nevela app: a Laravel API and a Next.js dashboard.
     nevela dev                 Run the API and the dashboard
     nevela status              Check versions, migrations, users and the dashboard
     nevela resource <Name> --fields="…" [--seed]
-    nevela seed | user | generate | migrate | artisan <command>
+    nevela seed | user | generate | migrate | trash | artisan <command>
 
   ${bold('Options')}
     --pm <pnpm|npm|yarn|bun>   Package manager for the dashboard. Default: the one you ran this with.
@@ -386,6 +386,10 @@ async function inProject(name, args) {
     if (now) {
       console.log(`\n  ${green(`✔ ${now === before ? `This app is on Nevela v${now}, the version it was on.` : `This app is now on Nevela v${now}.`}`)}\n`);
     }
+    // A release is on Packagist a few minutes before every Composer can see it. Finishing
+    // on the older one without a word would look like there was nothing newer.
+    const behind = behindNotice(now, releases);
+    if (behind) console.log(`${behind}\n`);
   }
   process.exit(status);
 }
@@ -448,6 +452,19 @@ function otherCopies() {
   for (const removal of removals) console.log(`      ${bold(removal)}`);
 }
 
+/**
+ * What to say when an upgrade finished on a version older than the newest release, or null
+ * when it didn't. `now` is what the app has, `latest` what Packagist lists.
+ */
+function behindNotice(now, latest) {
+  if (!now || !latest || !isNewer(latest, now)) return null;
+  return [
+    `  ${red('!')} Nevela ${bold(`v${latest}`)} is out, and Composer didn't bring it in.`,
+    `    A release takes a few minutes to reach Composer. Run ${bold('nevela upgrade')} again shortly.`,
+    `    ${dim(`Still on v${now} after that? This says what holds it back: cd apps/api && composer why-not nevela/laravel ${latest}`)}`,
+  ].join('\n');
+}
+
 /** The version of Nevela an app has installed, read from the package, or null. */
 function appVersion(project) {
   try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-nevela",
-  "version": "0.5.2",
+  "version": "0.6.0",
   "description": "Create a new Nevela app: a Laravel API and a Next.js dashboard from one resource description.",
   "type": "module",
   "bin": {

package/project.mjs

@@ -11,7 +11,7 @@ import { isNewer, satisfiesCaret } from './packagist.mjs';
 import { spawnCommand } from './shell.mjs';
 
 /** What `nevela <name>` runs: these go to `php artisan nevela:<name>`. */
-const NEVELA = ['upgrade', 'dev', 'status', 'version', 'resource', 'generate', 'seed', 'user'];
+const NEVELA = ['upgrade', 'dev', 'status', 'version', 'resource', 'generate', 'seed', 'user', 'trash'];
 /** These go to the artisan command of the same name. */
 const ARTISAN = ['migrate', 'tinker', 'test', 'serve'];
 

package/template/laravel/config/nevela.php

@@ -114,6 +114,16 @@ return [
     'per_page' => 25,
     'max_per_page' => 100,
 
+    /*
+    | The trash. A deleted record is kept, hidden from every list and count, and can be
+    | restored from the dashboard's Trash page for this many days. Then it is removed for
+    | good: each night by `nevela:trash`, which needs Laravel's scheduler running, and
+    | whenever someone opens the trash. Null keeps deleted records until someone removes them.
+    */
+    'trash' => [
+        'days' => 30,
+    ],
+
     /*
     | The most rows POST /{slug}/_bulk creates in one request (the dashboard's "Add several"
     | grid). They are saved in one transaction, so this is also how long one can run.

package/template/laravel/src/Concerns/Trashable.php

@@ -0,0 +1,63 @@
+<?php
+
+namespace Nevela\Laravel\Concerns;
+
+use Illuminate\Database\Eloquent\SoftDeletes;
+use Illuminate\Support\Facades\Schema;
+use Nevela\Laravel\Trash\TrashedScope;
+
+/**
+ * A model whose deleted records go to the trash, where they can be restored for a while.
+ *
+ * This is Laravel's own soft delete, with one difference: it only takes effect once the
+ * table has its `deleted_at` column. An app that has upgraded and not yet migrated keeps
+ * working exactly as before, with delete meaning delete, where plain SoftDeletes would
+ * put `deleted_at is null` into every query on a table that has no such column.
+ *
+ * Every generated model uses it. Everything Laravel's soft delete offers is here:
+ * `$model->restore()`, `$model->forceDelete()`, `$model->trashed()`, and on a query
+ * `withTrashed()` and `onlyTrashed()`.
+ *
+ * @mixin \Illuminate\Database\Eloquent\Model
+ */
+trait Trashable
+{
+    use SoftDeletes;
+
+    /** Whether this model's table has somewhere to keep a deleted record. Only "yes" is remembered. */
+    private static bool $hasTrash = false;
+
+    public static function trashes(): bool
+    {
+        if (static::$hasTrash) {
+            return true;
+        }
+        $model = new static;
+
+        // The column can arrive later in the same process (a migration run from a command),
+        // so "no" is asked again and "yes" is kept.
+        return static::$hasTrash = Schema::connection($model->getConnectionName())->hasColumn($model->getTable(), $model->getDeletedAtColumn());
+    }
+
+    /** Ask the database again next time. For a test that adds or drops the column within one process. */
+    public static function forgetTrash(): void
+    {
+        static::$hasTrash = false;
+    }
+
+    /** In place of SoftDeletes' own: the same scope, applied only where there is a trash. */
+    public static function bootSoftDeletes(): void
+    {
+        static::addGlobalScope(new TrashedScope);
+    }
+
+    public static function bootTrashable(): void
+    {
+        // With no column to mark it in, a delete removes the row, as it always did.
+        static::deleting(function (self $model) {
+            if (! static::trashes()) {
+                $model->forceDeleting = true;
+            }
+        });
+    }
+}

package/template/laravel/src/Console/GenerateCommand.php

@@ -3,6 +3,7 @@
 namespace Nevela\Laravel\Console;
 
 use Illuminate\Console\Command;
+use Illuminate\Support\Facades\Schema;
 use InvalidArgumentException;
 use Nevela\Laravel\Generator\ResourceGenerator;
 use Nevela\Laravel\Generator\Writer;
@@ -17,6 +18,41 @@ final class GenerateCommand extends Command
 
     protected $description = 'Regenerate Laravel code and Flare descriptors from nevela/resources/*.json';
 
+    /**
+     * Whether a resource's table needs the migration that gives it a trash.
+     *
+     * Not when its own migration already makes the column, and not when the column is
+     * there without one of ours having been written: then it came from a migration of
+     * the app's own, and ours would take that column away again when rolled back.
+     *
+     * @param  list<string>  $createMigrations  The contents of the table's own migration(s); none for a resource that is new
+     * @param  bool  $written  Whether an add_trash_to_… migration exists for the table already
+     * @param  bool  $columnExists  Whether the table has deleted_at in the database now
+     */
+    public static function needsTrashMigration(array $createMigrations, bool $written, bool $columnExists): bool
+    {
+        if ($createMigrations === []) {
+            return false;
+        }
+        foreach ($createMigrations as $contents) {
+            if (preg_match('/softDeletes|deleted_at/', $contents) === 1) {
+                return false;
+            }
+        }
+
+        return $written || ! $columnExists;
+    }
+
+    /** Whether the table has the column now. No, where there is no database to ask. */
+    private static function hasTrashColumn(string $table): bool
+    {
+        try {
+            return Schema::hasColumn($table, 'deleted_at');
+        } catch (\Throwable) {
+            return false;
+        }
+    }
+
     public function handle(): int
     {
         Nevela::forget();
@@ -87,6 +123,13 @@ final class GenerateCommand extends Command
         $files = [];
         foreach ($queue as $descriptor) {
             array_push($files, ...$generator->forResource($descriptor, null, $all));
+            // A table made before there was a trash gets a migration that gives it one. A new
+            // resource's own migration, written by the line above, already has the column.
+            $made = array_map(fn (string $file) => (string) file_get_contents($file), glob(database_path("migrations/*_create_{$descriptor->table}_table.php")) ?: []);
+            $written = (glob(database_path("migrations/*_add_trash_to_{$descriptor->table}_table.php")) ?: []) !== [];
+            if (self::needsTrashMigration($made, $written, self::hasTrashColumn($descriptor->table))) {
+                $files[] = $generator->trashMigrationFile($descriptor);
+            }
         }
         $files[] = $generator->routes($all);
         $files[] = $generator->registry($all);

package/template/laravel/src/Console/TrashCommand.php

@@ -0,0 +1,33 @@
+<?php
+
+namespace Nevela\Laravel\Console;
+
+use Illuminate\Console\Command;
+use Nevela\Laravel\Trash\Trash;
+
+final class TrashCommand extends Command
+{
+    protected $signature = 'nevela:trash';
+
+    protected $description = 'Remove, for good, the deleted records whose time in the trash has run out';
+
+    public function handle(): int
+    {
+        $days = Trash::days();
+        if ($days === null) {
+            $this->components->info('Deleted records are kept until someone removes them (nevela.trash.days is off), so there is nothing to do.');
+
+            return self::SUCCESS;
+        }
+
+        $removed = Trash::purgeExpired();
+        foreach ($removed as $resource => $count) {
+            $this->components->twoColumnDetail($resource, number_format($count).' removed');
+        }
+        $this->components->info($removed === []
+            ? "Nothing in the trash is older than {$days} days."
+            : 'Removed '.number_format(array_sum($removed))." record(s) deleted more than {$days} days ago.");
+
+        return self::SUCCESS;
+    }
+}

package/template/laravel/src/Generator/ResourceGenerator.php

@@ -226,7 +226,7 @@ final class ResourceGenerator
 
         // What you type => the artisan command it runs.
         // "update" is what upgrade was called before 0.3.0; it still works.
-        \$nevela = ['resource', 'generate', 'seed', 'user', 'upgrade', 'update', 'dev', 'status', 'version'];
+        \$nevela = ['resource', 'generate', 'seed', 'user', 'upgrade', 'update', 'dev', 'status', 'version', 'trash'];
         \$artisan = ['migrate', 'tinker', 'test', 'serve'];
         if (in_array(\$name, ['--version', '-v', '-V'], true)) {
             \$name = 'version';
@@ -255,6 +255,7 @@ final class ResourceGenerator
               php nevela generate              regenerate after editing a descriptor
               php nevela seed Product          fill a resource with records
               php nevela user                  create someone who can sign in
+              php nevela trash                 remove deleted records whose time in the trash is up
               php nevela upgrade               bring this app to the latest Nevela
               php nevela version               which Nevela this is
 
@@ -463,6 +464,9 @@ final class ResourceGenerator
             protected \$table = '{$d->table}';
 
             {$m}
+            // Deleted records go to the trash, where they can be restored for a while.
+            use \Nevela\Laravel\Concerns\Trashable;
+
             protected \$fillable = [{$fillable}];
 
             protected function casts(): array
@@ -535,6 +539,8 @@ final class ResourceGenerator
                     \$table->uuid('id')->primary();
         {$cols}
                     \$table->timestamps();
+                    // When a record was deleted. Until it is removed for good it sits in the trash.
+                    \$table->softDeletes();
                 });
             }
 
@@ -547,6 +553,55 @@ final class ResourceGenerator
         PHP;
     }
 
+    /**
+     * For a table made before there was a trash: the column that gives it one.
+     *
+     * Written once, by `nevela:generate`, for a resource whose own migration doesn't
+     * have the column. Until it is run, deleting a record removes it as before.
+     */
+    public function trashMigration(Descriptor $d): string
+    {
+        return <<<PHP
+        <?php
+
+        use Illuminate\Database\Migrations\Migration;
+        use Illuminate\Database\Schema\Blueprint;
+        use Illuminate\Support\Facades\Schema;
+
+        // Gives {$d->pluralLabel} a trash: a deleted record is kept, hidden, and can be restored
+        // for a while (config/nevela.php, trash.days). Generated once by Nevela.
+        return new class extends Migration
+        {
+            public function up(): void
+            {
+                if (Schema::hasTable('{$d->table}') && ! Schema::hasColumn('{$d->table}', 'deleted_at')) {
+                    Schema::table('{$d->table}', function (Blueprint \$table) {
+                        \$table->softDeletes();
+                    });
+                }
+            }
+
+            public function down(): void
+            {
+                if (Schema::hasColumn('{$d->table}', 'deleted_at')) {
+                    Schema::table('{$d->table}', function (Blueprint \$table) {
+                        \$table->dropSoftDeletes();
+                    });
+                }
+            }
+        };
+
+        PHP;
+    }
+
+    /** The file `trashMigration()` goes in. Not made again once one exists for the table, whatever its date. */
+    public function trashMigrationFile(Descriptor $d, ?string $timestamp = null): GeneratedFile
+    {
+        $timestamp ??= date('Y_m_d_His');
+
+        return new GeneratedFile(GeneratedFile::TARGET_API, "database/migrations/{$timestamp}_add_trash_to_{$d->table}_table.php", $this->trashMigration($d), GeneratedFile::MODE_ONCE, "database/migrations/*_add_trash_to_{$d->table}_table.php");
+    }
+
     /** @param list<Descriptor> $all */
     public function request(Descriptor $d, array $all = []): string
     {
@@ -852,6 +907,18 @@ final class ResourceGenerator
             {
                 return \$user->can('{$d->table}.delete');
             }
+
+            /** Bring a deleted one back from the trash. */
+            public function restore(User \$user, {$d->name} \${$var}): bool
+            {
+                return \$user->can('{$d->table}.delete');
+            }
+
+            /** Remove a deleted one from the trash, for good. */
+            public function forceDelete(User \$user, {$d->name} \${$var}): bool
+            {
+                return \$user->can('{$d->table}.delete');
+            }
         }
 
         PHP;

package/template/laravel/src/Http/ResourceRequest.php

@@ -3,6 +3,8 @@
 namespace Nevela\Laravel\Http;
 
 use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Schema;
 use Illuminate\Support\Facades\Validator as Validation;
 use Illuminate\Validation\Rules\Unique;
 use Illuminate\Validation\Validator;
@@ -51,9 +53,39 @@ abstract class ResourceRequest extends FormRequest
                     $validator->errors()->add((string) $key, 'Unknown field.');
                 }
             }
+            self::explainTrashed($validator, $validator->getData());
         });
     }
 
+    /**
+     * A unique value can be held by a record nobody can see: one in the trash. "Already
+     * taken" would send someone looking through a list it isn't in, so say where it is.
+     *
+     * @param  array<string, mixed>  $data
+     * @return list<array{path: string, message: string}> The messages that were replaced
+     */
+    private static function explainTrashed(Validator $validator, array $data): array
+    {
+        $replaced = [];
+        foreach ($validator->failed() as $field => $rules) {
+            // What Laravel gives for a failed unique rule: the table and the column it looked in.
+            [$table, $column] = array_pad($rules['Unique'] ?? [], 2, null);
+            $value = $data[$field] ?? null;
+            if (! is_string($table) || ! is_string($column) || ! is_scalar($value) || $column === 'NULL') {
+                continue;
+            }
+            if (! Schema::hasColumn($table, 'deleted_at') || ! DB::table($table)->where($column, $value)->whereNotNull('deleted_at')->exists()) {
+                continue;
+            }
+            $message = 'This belongs to a record in the trash. Restore that record, or delete it for good to use the value again.';
+            $validator->errors()->forget($field);
+            $validator->errors()->add($field, $message);
+            $replaced[] = ['path' => (string) $field, 'message' => $message];
+        }
+
+        return $replaced;
+    }
+
     /**
      * Many rows, each checked by the rules for creating one.
      *
@@ -94,6 +126,7 @@ abstract class ResourceRequest extends FormRequest
             }
             $validator = Validation::make($row, $rules);
             if ($validator->fails()) {
+                self::explainTrashed($validator, $row);
                 array_push($issues, ...FlareErrors::issues($validator->errors()->toArray()));
             }
             foreach ($unique as $field) {

package/template/laravel/src/Http/TrashController.php

@@ -0,0 +1,190 @@
+<?php
+
+namespace Nevela\Laravel\Http;
+
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+use Illuminate\Http\Response;
+use Nevela\Laravel\Support\Descriptor;
+use Nevela\Laravel\Trash\Trash;
+use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;
+use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
+
+/**
+ * The trash: deleted records, by resource, to restore or to remove for good.
+ *
+ * One controller for every resource, where everything else about a resource is generated.
+ * The trash asks the same three questions of all of them (what was deleted, bring it back,
+ * get rid of it), and a generated copy per resource would be the same file many times.
+ *
+ * Who may use it is the resource's own policy: `restore` and `forceDelete` where it has
+ * them, and what it says to `delete` where it was written before there was a trash.
+ */
+final class TrashController
+{
+    /**
+     * GET _nevela/trash/_status: which resources have a trash this person may use, and how
+     * long it keeps things. Nothing is counted and nothing is removed: this is asked on
+     * the way to drawing a delete button, to say truthfully what pressing it will do.
+     */
+    public function status(): JsonResponse
+    {
+        $slugs = [];
+        foreach (Trash::resources() as ['descriptor' => $descriptor, 'model' => $model]) {
+            if (Trash::maySee($model)) {
+                $slugs[] = $descriptor->slug;
+            }
+        }
+
+        return response()->json(['days' => Trash::days(), 'resources' => $slugs]);
+    }
+
+    /**
+     * GET _nevela/trash: how long things are kept, and how much of each resource is in it.
+     * Only the resources this person may deal with. Anything past its time goes first.
+     */
+    public function index(): JsonResponse
+    {
+        Trash::purgeExpired();
+
+        $resources = [];
+        foreach (Trash::resources() as ['descriptor' => $descriptor, 'model' => $model]) {
+            if (! Trash::maySee($model)) {
+                continue;
+            }
+            $resources[] = [
+                'name' => $descriptor->name,
+                'label' => $descriptor->label,
+                'pluralLabel' => $descriptor->pluralLabel,
+                'slug' => $descriptor->slug,
+                'icon' => $descriptor->icon,
+                'count' => $model::onlyTrashed()->count(),
+            ];
+        }
+
+        return response()->json(['days' => Trash::days(), 'resources' => $resources]);
+    }
+
+    /** GET _nevela/trash/{slug}?page=&perPage=: one resource's deleted records, the latest deletion first. */
+    public function show(Request $request, string $slug): JsonResponse
+    {
+        ['descriptor' => $descriptor, 'model' => $model] = $this->resource($slug);
+        $input = $request->validate(['page' => ['nullable', 'integer', 'min:1'], 'perPage' => ['nullable', 'integer', 'min:1', 'max:100']]);
+        Trash::purgeExpired($model);
+
+        $instance = new $model;
+        $page = $model::onlyTrashed()
+            ->orderByDesc($instance->getQualifiedDeletedAtColumn())->orderBy($instance->getQualifiedKeyName())
+            ->paginate((int) ($input['perPage'] ?? 25), ['*'], 'page', (int) ($input['page'] ?? 1));
+
+        return response()->json([
+            'data' => $page->getCollection()->map(fn ($record) => [
+                'id' => (string) $record->getKey(),
+                'label' => self::label($descriptor, $record),
+                'deletedAt' => $record->{$record->getDeletedAtColumn()}?->toJSON(),
+                'expiresAt' => Trash::expires($record->{$record->getDeletedAtColumn()})?->toJSON(),
+            ])->all(),
+            'meta' => ['page' => $page->currentPage(), 'perPage' => $page->perPage(), 'total' => $page->total(), 'totalPages' => max(1, $page->lastPage())],
+        ]);
+    }
+
+    /** POST _nevela/trash/{slug}/{id}/restore: back into the list, as it was. */
+    public function restore(string $slug, string $id): JsonResponse
+    {
+        ['descriptor' => $descriptor, 'model' => $model] = $this->resource($slug);
+        $record = $model::onlyTrashed()->find($id) ?? throw new NotFoundHttpException("No deleted {$this->noun($descriptor)} with that id.");
+        if (! Trash::may('restore', $record)) {
+            throw new AccessDeniedHttpException("You don't have access to this.");
+        }
+
+        // A record that must belong to another can't come back while that other is itself deleted.
+        foreach ($descriptor->fields as $field) {
+            if ($field->kind !== 'belongsTo' || ! $field->required) {
+                continue;
+            }
+            $parent = "App\\Models\\{$field->target}";
+            $key = $record->{$field->column()};
+            if ($key !== null && class_exists($parent) && method_exists($parent, 'trashes') && $parent::trashes() && $parent::onlyTrashed()->whereKey($key)->exists()) {
+                $what = strtolower($field->target);
+
+                return response()->json(['error' => "Its {$what} is in the trash too. Restore the {$what} first.", 'code' => 'PARENT_IN_TRASH'], 409);
+            }
+        }
+        $record->restore();
+
+        return response()->json(['id' => (string) $record->getKey(), 'restored' => true]);
+    }
+
+    /** DELETE _nevela/trash/{slug}/{id}: gone for good. */
+    public function destroy(string $slug, string $id): JsonResponse|Response
+    {
+        ['descriptor' => $descriptor, 'model' => $model] = $this->resource($slug);
+        $record = $model::onlyTrashed()->find($id) ?? throw new NotFoundHttpException("No deleted {$this->noun($descriptor)} with that id.");
+        if (! Trash::may('forceDelete', $record)) {
+            throw new AccessDeniedHttpException("You don't have access to this.");
+        }
+        if (! Trash::purge($record)) {
+            return response()->json(['error' => 'Other records in the trash still belong to this one. Delete those for good first.', 'code' => 'STILL_REFERENCED'], 409);
+        }
+
+        return response()->noContent();
+    }
+
+    /**
+     * DELETE _nevela/trash/{slug}?confirm={slug}: everything of one resource, for good.
+     * The slug has to be said again, so that this can't be the result of a mistyped address.
+     */
+    public function empty(Request $request, string $slug): JsonResponse
+    {
+        ['model' => $model] = $this->resource($slug);
+        if ($request->query('confirm') !== $slug) {
+            return response()->json(['error' => "To empty this trash, send confirm={$slug}.", 'code' => 'CONFIRM'], 422);
+        }
+        $removed = 0;
+        $kept = 0;
+        $instance = new $model;
+        $model::onlyTrashed()->orderBy($instance->getQualifiedKeyName())->chunkById(200, function ($records) use (&$removed, &$kept) {
+            foreach ($records as $record) {
+                if (Trash::may('forceDelete', $record) && Trash::purge($record)) {
+                    $removed++;
+                } else {
+                    $kept++;
+                }
+            }
+        });
+
+        return response()->json(['removed' => $removed, 'kept' => $kept]);
+    }
+
+    /** @return array{descriptor: Descriptor, model: class-string<\Illuminate\Database\Eloquent\Model>} */
+    private function resource(string $slug): array
+    {
+        $resource = Trash::resource($slug) ?? throw new NotFoundHttpException('This resource has no trash.');
+        if (! Trash::maySee($resource['model'])) {
+            throw new AccessDeniedHttpException("You don't have access to this.");
+        }
+
+        return $resource;
+    }
+
+    private function noun(Descriptor $descriptor): string
+    {
+        return strtolower($descriptor->label);
+    }
+
+    /** What to call a deleted record: its title, the way a list would, and its id when it has none. */
+    private static function label(Descriptor $descriptor, mixed $record): string
+    {
+        // The field the descriptor names, or the first piece of text it has, as the dashboard does.
+        $field = $descriptor->titleField !== null ? ($descriptor->fields[$descriptor->titleField] ?? null) : null;
+        foreach ($field === null ? $descriptor->fields : [] as $candidate) {
+            if ($candidate->kind === 'string') {
+                $field = $candidate;
+                break;
+            }
+        }
+        $value = $field ? $record->getAttribute($field->column()) : null;
+
+        return is_scalar($value) && (string) $value !== '' ? (string) $value : (string) $record->getKey();
+    }
+}

package/template/laravel/src/Nevela.php

@@ -21,7 +21,7 @@ use Nevela\Laravel\Support\Naming;
 final class Nevela
 {
     /** Written by `pnpm release`; the same number as the repository's git tag. */
-    public const VERSION = '0.5.2';
+    public const VERSION = '0.6.0';
 
     /** @var array<string, Descriptor> */
     private static array $descriptors = [];

package/template/laravel/src/NevelaServiceProvider.php

@@ -4,6 +4,7 @@ namespace Nevela\Laravel;
 
 use Illuminate\Contracts\Debug\ExceptionHandler;
 use Illuminate\Cache\RateLimiting\Limit;
+use Illuminate\Console\Scheduling\Schedule;
 use Illuminate\Foundation\Console\ServeCommand;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Gate;
@@ -18,6 +19,7 @@ use Nevela\Laravel\Console\MakeResourceCommand;
 use Nevela\Laravel\Console\SeedCommand;
 use Nevela\Laravel\Console\SetupCommand;
 use Nevela\Laravel\Console\StatusCommand;
+use Nevela\Laravel\Console\TrashCommand;
 use Nevela\Laravel\Console\UpdateCommand;
 use Nevela\Laravel\Console\UserCommand;
 use Nevela\Laravel\Console\VersionCommand;
@@ -29,6 +31,7 @@ use Nevela\Laravel\Http\Auth\AccountController;
 use Nevela\Laravel\Http\Auth\SecurityController;
 use Nevela\Laravel\Http\Auth\SignInController;
 use Nevela\Laravel\Http\TokenController;
+use Nevela\Laravel\Http\TrashController;
 use Nevela\Laravel\Http\UploadController;
 use Nevela\Laravel\Media\Uploads;
 
@@ -56,7 +59,15 @@ final class NevelaServiceProvider extends ServiceProvider
             $this->commands([
                 MakeResourceCommand::class, GenerateCommand::class, SeedCommand::class, UserCommand::class,
                 UpdateCommand::class, DevCommand::class, StatusCommand::class, VersionCommand::class, SetupCommand::class,
+                TrashCommand::class,
             ]);
+
+            // What has been in the trash too long is removed each night, wherever the app's
+            // scheduler is running (Laravel's one cron line). Where it isn't, the same thing
+            // happens whenever someone opens the trash.
+            $this->callAfterResolving(Schedule::class, function (Schedule $schedule) {
+                $schedule->command(TrashCommand::class)->dailyAt('03:40')->withoutOverlapping();
+            });
         }
 
         $this->callAfterResolving(ExceptionHandler::class, function ($handler) {
@@ -171,6 +182,14 @@ final class NevelaServiceProvider extends ServiceProvider
                 'data' => array_map(fn ($name) => (array) Uploads::profile($name), array_keys((array) config('nevela.uploads.profiles', ['default' => []]))),
             ]))->name('profiles');
 
+            // The trash: deleted records, to restore or to remove for good.
+            Route::get('_nevela/trash', [TrashController::class, 'index'])->name('trash.index');
+            Route::get('_nevela/trash/_status', [TrashController::class, 'status'])->name('trash.status');
+            Route::get('_nevela/trash/{slug}', [TrashController::class, 'show'])->name('trash.show');
+            Route::post('_nevela/trash/{slug}/{id}/restore', [TrashController::class, 'restore'])->name('trash.restore');
+            Route::delete('_nevela/trash/{slug}/{id}', [TrashController::class, 'destroy'])->name('trash.destroy');
+            Route::delete('_nevela/trash/{slug}', [TrashController::class, 'empty'])->name('trash.empty');
+
             // Users and roles, for whoever holds the permissions to manage them.
             Route::middleware(RolesAreSetUp::class)->group(function () {
                 Route::get('_nevela/users', [UsersController::class, 'index'])->name('users.index');