create-nevela 0.7.1 → 0.9.1

package/template/laravel/src/Generator/ResourceGenerator.php

@@ -2,9 +2,11 @@
 
 namespace Nevela\Laravel\Generator;
 
+use Nevela\Laravel\Support\Action;
 use Nevela\Laravel\Support\Descriptor;
 use Nevela\Laravel\Support\Field;
 use Nevela\Laravel\Support\Naming;
+use Nevela\Laravel\Support\PublicAccess;
 
 /**
  * Turns descriptors into files. Pure: no Laravel, no filesystem — Writer does the I/O.
@@ -27,19 +29,64 @@ final class ResourceGenerator
     {
         $timestamp ??= date('Y_m_d_His');
         $api = GeneratedFile::TARGET_API;
+        // An adopted table is already there, made by a migration of the app's own.
+        $migration = $d->adopted ? [] : [
+            new GeneratedFile($api, "database/migrations/{$timestamp}_create_{$d->table}_table.php", $this->migration($d, $all), GeneratedFile::MODE_ONCE, "database/migrations/*_create_{$d->table}_table.php"),
+        ];
 
         return [
             new GeneratedFile($api, "app/Models/{$d->name}.php", $this->model($d, $all)),
-            new GeneratedFile($api, "database/migrations/{$timestamp}_create_{$d->table}_table.php", $this->migration($d, $all), GeneratedFile::MODE_ONCE, "database/migrations/*_create_{$d->table}_table.php"),
+            ...$migration,
             new GeneratedFile($api, "app/Http/Requests/Nevela/{$d->name}Request.php", $this->request($d, $all)),
-            new GeneratedFile($api, "app/Http/Resources/Nevela/{$d->name}Resource.php", $this->resource($d)),
+            new GeneratedFile($api, "app/Http/Resources/Nevela/{$d->name}Resource.php", $this->resource($d, $all)),
             new GeneratedFile($api, "app/Http/Controllers/Api/{$d->name}Controller.php", $this->controller($d, $all)),
             new GeneratedFile($api, "app/Policies/{$d->name}Policy.php", $this->policy($d), GeneratedFile::MODE_ONCE),
             new GeneratedFile(GeneratedFile::TARGET_WEB, 'resources/'.Naming::kebab($d->name).'.resource.ts', $this->typescript($d, $all)),
             ...$this->pages($d),
+            ...array_values(array_map(fn (Action $action) => new GeneratedFile($api, "app/Nevela/Actions/{$d->name}/{$action->className()}.php", $this->action($d, $action), GeneratedFile::MODE_ONCE), $d->actions)),
         ];
     }
 
+    /**
+     * The class an action is written in: what happens when its button is pressed. Written
+     * once and then the app's own, like a policy. Until someone fills it in it says so.
+     */
+    public function action(Descriptor $d, Action $action): string
+    {
+        $var = $d->variable();
+        $class = $action->className();
+        $path = "app/Nevela/Actions/{$d->name}/{$class}.php";
+        $asks = $action->fields === [] ? 'It asks for nothing, so $input is empty.' : 'What the person filled in, checked: '.implode(', ', array_keys($action->fields)).'.';
+        [$imports, $signature, $what] = $action->on === 'record'
+            ? ["\nuse App\\Models\\{$d->name};\n", "{$d->name} \${$var}, array \$input", "on one {$this->lower($d->label)}"]
+            : ['', 'array $input', "on {$this->lower($d->pluralLabel)} as a whole"];
+        $permission = "{$d->table}.{$action->key()}";
+
+        return <<<PHP
+        <?php
+
+        namespace App\Nevela\Actions\\{$d->name};
+        {$imports}
+        /**
+         * {$action->label}, {$what}. Generated once — this file is yours.
+         *
+         * Nevela has done the rest by the time handle() runs: the route, the "{$permission}"
+         * permission, the check that the action applies, and the validation of what was asked
+         * for. It runs inside a database transaction, so throwing undoes what it changed, and
+         * the person is told it didn't work. What it returns is the message they see.
+         */
+        class {$class}
+        {
+            /** @param array<string, mixed> \$input {$asks} */
+            public function handle({$signature}): ?string
+            {
+                throw new \LogicException('{$action->label} does nothing yet. Write it in {$path}.');
+            }
+        }
+
+        PHP;
+    }
+
     /**
      * The resources that point at this one, each with the field that does it and the name
      * the relation gets here: a Category's Products are `products`. A second field from
@@ -90,6 +137,23 @@ final class ResourceGenerator
         return Naming::snake(Naming::plural($name));
     }
 
+    /**
+     * Whether a resource's ids are integers. A relation's column, its validation and what
+     * the API sends for it all follow the resource it points at, not the one it is on.
+     *
+     * @param  list<Descriptor>  $all
+     */
+    private function hasIntIds(string $name, Descriptor $d, array $all): bool
+    {
+        foreach ([$d, ...$all] as $candidate) {
+            if ($candidate->name === $name) {
+                return $candidate->idType === 'int';
+            }
+        }
+
+        return false;
+    }
+
     /**
      * The dashboard pages for a resource, in Flare's layout: list, new, detail and edit,
      * each with its loading skeleton. They only name the descriptor — Flare's components
@@ -226,7 +290,7 @@ final class ResourceGenerator
 
         // What you type => the artisan command it runs.
         // "update" is what upgrade was called before 0.3.0; it still works.
-        \$nevela = ['resource', 'generate', 'seed', 'user', 'upgrade', 'update', 'dev', 'status', 'version', 'trash'];
+        \$nevela = ['resource', 'adopt', 'blog', 'generate', 'seed', 'user', 'upgrade', 'update', 'dev', 'status', 'version', 'trash', 'digest', 'disposable'];
         \$artisan = ['migrate', 'tinker', 'test', 'serve'];
         if (in_array(\$name, ['--version', '-v', '-V'], true)) {
             \$name = 'version';
@@ -252,10 +316,13 @@ final class ResourceGenerator
               php nevela status                check versions, migrations, users and the dashboard
               php nevela resource Product --fields="name:string, price:money" --seed
                                                add a resource, create its table, fill it
+              php nevela adopt posts           make a resource of a table you already have
+              php nevela blog                  give the site a blog: posts in the dashboard, /blog to read them
               php nevela generate              regenerate after editing a descriptor
               php nevela seed Product          fill a resource with records
               php nevela user                  create someone who can sign in
               php nevela trash                 remove deleted records whose time in the trash is up
+              php nevela disposable            fetch the current list of throwaway email domains
               php nevela upgrade               bring this app to the latest Nevela
               php nevela version               which Nevela this is
 
@@ -303,6 +370,25 @@ final class ResourceGenerator
         $body = $names === []
             ? 'export const resources = [] as const;'
             : implode("\n", $imports)."\n\nexport { {$list} };\nexport const resources = [{$list}] as const;";
+        // What Flare's descriptor has no place for, by resource name: the actions a resource has.
+        $extras = [];
+        foreach ($all as $d) {
+            if ($d->actions !== []) {
+                $extras[$d->name]['actions'] = array_map(fn (Action $a) => ['permission' => "{$d->table}.{$a->key()}"] + $a->toArray(), $d->actions);
+            }
+            // The field its records are published by, and where on the site they are a blog.
+            if ($d->publish !== null) {
+                $extras[$d->name]['publish'] = $d->publish;
+            }
+            if ($d->blog !== null) {
+                $extras[$d->name]['blog'] = $d->blog;
+            }
+            // What its public form checks, and the address it has proved.
+            if ($d->public?->protect !== null || $d->public?->confirm !== null) {
+                $extras[$d->name]['form'] = array_filter(['protect' => $d->public->toArray()['create']['protect'] ?? null, 'confirm' => $d->public->confirm], fn ($v) => $v !== null);
+            }
+        }
+        $body .= "\n\n/** What a resource has beyond its fields. Read through lib/extras.ts. */\nexport const extras: Record<string, unknown> = ".($extras === [] ? '{}' : json_encode($extras, JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE)).';';
         $m = self::M;
         $e = self::E;
 
@@ -387,7 +473,9 @@ final class ResourceGenerator
             $lines[] = "Route::get('{$d->slug}/_stats', [{$controller}, 'stats'])->name('{$d->slug}.stats');";
             $lines[] = "Route::get('{$d->slug}/_insights', [{$controller}, 'insights'])->name('{$d->slug}.insights');";
             $lines[] = "Route::post('{$d->slug}/_bulk', [{$controller}, 'bulk'])->name('{$d->slug}.bulk');";
-            $lines[] = "Route::apiResource('{$d->slug}', {$controller});";
+            // An integer id is digits and nothing else: anything else in its place is no record's address.
+            $where = $d->idType === 'int' ? "->where(['{$d->routeParameter()}' => '[0-9]{1,18}'])" : '';
+            $lines[] = "Route::apiResource('{$d->slug}', {$controller}){$where};";
         }
         $body = implode("\n", $lines);
         $m = self::M;
@@ -407,6 +495,69 @@ final class ResourceGenerator
         PHP);
     }
 
+    /**
+     * The routes anyone can call: only for resources with a "public" section, and only
+     * what each one's section opens. Loaded by Nevela under {prefix}/public with the api
+     * middleware and no sign-in.
+     *
+     * @param  list<Descriptor>  $all
+     */
+    public function publicRoutes(array $all): GeneratedFile
+    {
+        usort($all, fn (Descriptor $a, Descriptor $b) => strcmp($a->slug, $b->slug));
+        $controller = '\\Nevela\\Laravel\\Http\\PublicController::class';
+        $lines = [];
+        foreach ($all as $d) {
+            $public = $d->public;
+            if ($public === null) {
+                continue;
+            }
+            $more = implode('', array_map(fn (string $name) => ", '{$name}'", $public->middleware));
+            $for = "->defaults('resource', '{$d->name}')";
+            // The third part names the count. Without it Laravel keeps one per visitor for every
+            // throttled route there is, and reading a few pages would use up a form's allowance.
+            // (nevela.throttle is Laravel's throttle, counting the visitor and not the web app's server: see PublicThrottle.)
+            $throttle = fn (string $limit, string $what) => "'nevela.throttle:{$limit},{$d->slug}.{$what}:'";
+            if ($public->read !== null) {
+                $lines[] = "Route::get('{$d->slug}', [{$controller}, 'index']){$for}->middleware([{$throttle($public->readThrottle, 'read')}{$more}])->name('{$d->slug}.index');";
+                $lines[] = "Route::get('{$d->slug}/{id}', [{$controller}, 'show']){$for}->middleware([{$throttle($public->readThrottle, 'read')}{$more}])->name('{$d->slug}.show');";
+            }
+            if ($public->create !== null) {
+                $lines[] = "Route::post('{$d->slug}', [{$controller}, 'store']){$for}->middleware([{$throttle($public->createThrottle, 'create')}{$more}])->name('{$d->slug}.store');";
+                foreach ($public->create as $field) {
+                    if ($d->fields[$field]->kind === 'file') {
+                        $lines[] = "Route::put('_nevela/uploads/{$d->name}/{$field}', [{$controller}, 'upload']){$for}->defaults('field', '{$field}')->middleware([{$throttle($public->createThrottle, 'upload')}{$more}])->name('{$d->slug}.upload.{$field}');";
+                    }
+                }
+                // What a protected form asks for before it is shown, and after each attempt.
+                if ($public->protected()) {
+                    $lines[] = "Route::get('_nevela/form/{$d->slug}', [{$controller}, 'form']){$for}->middleware([{$throttle(PublicAccess::READ_THROTTLE, 'form')}])->name('{$d->slug}.form');";
+                }
+                // The link that proves an address.
+                if ($public->confirm !== null) {
+                    $lines[] = "Route::post('_nevela/confirm/{$d->slug}/{id}/{key}', [{$controller}, 'confirm']){$for}->middleware([{$throttle(PublicAccess::READ_THROTTLE, 'confirm')}])->name('{$d->slug}.confirm');";
+                }
+            }
+        }
+        $body = $lines === [] ? '// No resource has a "public" section, so nothing is open.' : implode("\n", $lines);
+        $m = self::M;
+        $e = self::E;
+
+        return new GeneratedFile(GeneratedFile::TARGET_API, 'routes/nevela-public.php', <<<PHP
+        <?php
+
+        use Illuminate\Support\Facades\Route;
+
+        // What anyone can call without signing in: {prefix}/public/… (default: /api/public).
+        // Written from each resource's "public" section by `php artisan nevela:generate`.
+        // A resource without one has no route here, and so nothing of it is open.
+        {$m}
+        {$body}
+        {$e}
+
+        PHP);
+    }
+
     /** @param list<Descriptor> $all */
     public function model(Descriptor $d, array $all = []): string
     {
@@ -448,6 +599,48 @@ final class ResourceGenerator
             }
         }
         $castBlock = $casts ? implode("\n", $casts) : '';
+        // Written with the model, outside its generated block: which records are public is the app's to say.
+        $published = $d->publish === null ? null : $d->fields[$d->publish]->column();
+        $scope = match (true) {
+            $d->public?->read === null => '',
+            // A resource with a publish date has said it already: the ones whose time has come.
+            $published !== null => <<<PHP
+
+
+            /**
+             * Which {$this->lower($d->pluralLabel)} anyone may read, signed in or not: the published ones. The
+             * public list and the public page of one both go through here. A draft has no
+             * {$published}, and a scheduled one has a time still to come, which this lets
+             * through when it does, with nobody saving anything.
+             */
+            public function scopePublicQuery(\Illuminate\Database\Eloquent\Builder \$query): void
+            {
+                \$query->whereNotNull('{$published}')->where('{$published}', '<=', now());
+            }
+        PHP,
+            default => <<<PHP
+
+
+            /**
+             * Which {$this->lower($d->pluralLabel)} anyone may read, signed in or not. The public list and
+             * the public page of one both go through here. It lets nothing through until you
+             * say what may be: for instance
+             *
+             *     \$query->whereNotNull('published_at')->where('published_at', '<=', now());
+             */
+            public function scopePublicQuery(\Illuminate\Database\Eloquent\Builder \$query): void
+            {
+                \$query->whereRaw('1 = 0');
+            }
+        PHP,
+        };
+        // An integer id is Eloquent's own default: the database numbers the records.
+        [$import, $trait] = $d->idType === 'int' ? ['', ''] : ["use Illuminate\\Database\\Eloquent\\Concerns\\HasUuids;\n", "    use HasUuids;\n\n"];
+        $confirmable = $d->public?->confirm === null ? '' : <<<'PHP'
+
+            // Its public form asks for an address to be proved: Subscriber::confirmed() is who has.
+            use \Nevela\Laravel\Concerns\Confirmable;
+        PHP;
         $m = self::M;
         $e = self::E;
 
@@ -456,18 +649,15 @@ final class ResourceGenerator
 
         namespace App\Models;
 
-        use Illuminate\Database\Eloquent\Concerns\HasUuids;
-        use Illuminate\Database\Eloquent\Model;
+        {$import}use Illuminate\Database\Eloquent\Model;
 
         class {$d->name} extends Model
         {
-            use HasUuids;
-
-            protected \$table = '{$d->table}';
+        {$trait}    protected \$table = '{$d->table}';
 
             {$m}
             // Deleted records go to the trash, where they can be restored for a while.
-            use \Nevela\Laravel\Concerns\Trashable;
+            use \Nevela\Laravel\Concerns\Trashable;{$confirmable}
 
             protected \$fillable = [{$fillable}];
 
@@ -479,7 +669,7 @@ final class ResourceGenerator
             }{$relationBlock}
             {$e}
 
-            // Your own relationships, scopes and accessors go here — outside the generated block.
+            // Your own relationships, scopes and accessors go here — outside the generated block.{$scope}
         }
 
         PHP;
@@ -493,7 +683,8 @@ final class ResourceGenerator
             $c = $f->column();
             if ($f->kind === 'belongsTo') {
                 // A required parent can't be deleted while it has children; an optional one lets go of them.
-                $columns[] = "            \$table->foreignUuid('{$c}')"
+                $foreign = $this->hasIntIds((string) $f->target, $d, $all) ? 'foreignId' : 'foreignUuid';
+                $columns[] = "            \$table->{$foreign}('{$c}')"
                     .($f->required ? '' : '->nullable()')
                     .($f->unique ? '->unique()' : '->index()')
                     ."->constrained('{$this->tableOf((string) $f->target, $d, $all)}')"
@@ -503,6 +694,8 @@ final class ResourceGenerator
             }
             $line = match (true) {
                 $f->kind === 'file' => "\$table->string('{$c}', 512)",
+                // More than a text column holds on MySQL, or HTML, whose tags count against it too.
+                $f->kind === 'text' && ($f->isRich() || $f->maxLength > 65535) => "\$table->longText('{$c}')",
                 $f->kind === 'text' => "\$table->text('{$c}')",
                 $f->kind === 'int' => "\$table->integer('{$c}')",
                 $f->kind === 'float' && $f->format === 'money' => "\$table->decimal('{$c}', 12, 2)",
@@ -510,12 +703,17 @@ final class ResourceGenerator
                 $f->kind === 'boolean' => "\$table->boolean('{$c}')->default(false)",
                 $f->kind === 'date' => "\$table->date('{$c}')",
                 $f->kind === 'datetime' => "\$table->dateTime('{$c}')",
+                $f->maxLength !== null => "\$table->string('{$c}', {$f->maxLength})",
                 $f->format === 'url' => "\$table->string('{$c}', 2048)",
                 default => "\$table->string('{$c}')",
             };
             if (! $f->required) {
                 $line .= '->nullable()';
             }
+            if ($f->default !== null && $f->kind !== 'text') {
+                // (A text column can't have one on MySQL; the request supplies it there.)
+                $line = str_replace('->default(false)', '', $line).'->default('.var_export($f->default, true).')';
+            }
             if ($f->unique) {
                 $line .= '->unique()';
             } elseif ($f->kind === 'enum') {
@@ -523,7 +721,12 @@ final class ResourceGenerator
             }
             $columns[] = "            {$line};";
         }
+        if ($d->public?->confirm !== null) {
+            $columns[] = '            // When the address was proved, by the link emailed to it. Empty until then.';
+            $columns[] = "            \$table->timestamp('confirmed_at')->nullable()->index();";
+        }
         $cols = implode("\n", $columns);
+        $id = $d->idType === 'int' ? '$table->id();' : "\$table->uuid('id')->primary();";
 
         return <<<PHP
         <?php
@@ -538,7 +741,7 @@ final class ResourceGenerator
             public function up(): void
             {
                 Schema::create('{$d->table}', function (Blueprint \$table) {
-                    \$table->uuid('id')->primary();
+                    {$id}
         {$cols}
                     \$table->timestamps();
                     // When a record was deleted. Until it is removed for good it sits in the trash.
@@ -596,6 +799,58 @@ final class ResourceGenerator
         PHP;
     }
 
+    /**
+     * For a table made before its form asked for addresses to be proved: the column that
+     * records it. The records already there are taken as proved. They were on the list
+     * before anyone was asked, and asking now would empty it.
+     */
+    public function confirmMigration(Descriptor $d): string
+    {
+        return <<<PHP
+        <?php
+
+        use Illuminate\Database\Migrations\Migration;
+        use Illuminate\Database\Schema\Blueprint;
+        use Illuminate\Support\Facades\DB;
+        use Illuminate\Support\Facades\Schema;
+
+        // {$d->pluralLabel} now prove their address: a record made through the public form is
+        // unconfirmed until the link emailed to it is followed. Generated once by Nevela.
+        return new class extends Migration
+        {
+            public function up(): void
+            {
+                if (Schema::hasTable('{$d->table}') && ! Schema::hasColumn('{$d->table}', 'confirmed_at')) {
+                    Schema::table('{$d->table}', function (Blueprint \$table) {
+                        \$table->timestamp('confirmed_at')->nullable()->index();
+                    });
+                    // Whoever is on the list already stays on it.
+                    DB::table('{$d->table}')->update(['confirmed_at' => now()]);
+                }
+            }
+
+            public function down(): void
+            {
+                if (Schema::hasColumn('{$d->table}', 'confirmed_at')) {
+                    Schema::table('{$d->table}', function (Blueprint \$table) {
+                        \$table->dropIndex(['confirmed_at']);
+                        \$table->dropColumn('confirmed_at');
+                    });
+                }
+            }
+        };
+
+        PHP;
+    }
+
+    /** The file `confirmMigration()` goes in. Written once for a table, whatever its date. */
+    public function confirmMigrationFile(Descriptor $d, ?string $timestamp = null): GeneratedFile
+    {
+        $timestamp ??= date('Y_m_d_His');
+
+        return new GeneratedFile(GeneratedFile::TARGET_API, "database/migrations/{$timestamp}_add_confirmation_to_{$d->table}_table.php", $this->confirmMigration($d), GeneratedFile::MODE_ONCE, "database/migrations/*_add_confirmation_to_{$d->table}_table.php");
+    }
+
     /** The file `trashMigration()` goes in. Not made again once one exists for the table, whatever its date. */
     public function trashMigrationFile(Descriptor $d, ?string $timestamp = null): GeneratedFile
     {
@@ -617,6 +872,40 @@ final class ResourceGenerator
         }
         $ruleLines = implode("\n", $rules);
         $columnMap = implode(', ', $columns);
+        $defaults = implode(', ', array_map(fn (Field $f) => "'{$f->name}' => ".var_export($f->default, true), array_filter($d->fields, fn (Field $f) => $f->default !== null)));
+        $defaultsBlock = $defaults === '' ? '' : <<<PHP
+
+
+            /** What a field is when a create leaves it out. */
+            protected function defaults(): array
+            {
+                return [{$defaults}];
+            }
+        PHP;
+        $made = implode(', ', array_map(
+            fn (Field $f) => "'{$f->name}' => ['from' => '{$f->from}', 'table' => '{$d->table}', 'column' => '{$f->column()}']",
+            array_filter($d->fields, fn (Field $f) => $f->from !== null),
+        ));
+        $madeBlock = $made === '' ? '' : <<<PHP
+
+
+            /** Fields made from another when a create leaves them empty. They are never remade afterwards. */
+            protected function made(): array
+            {
+                return [{$made}];
+            }
+        PHP;
+        // Only where there is one: a resource without rich text has the request it always had.
+        $rich = implode(', ', array_map(fn (Field $f) => "'{$f->name}'", array_filter($d->fields, fn (Field $f) => $f->isRich())));
+        $richBlock = $rich === '' ? '' : <<<PHP
+
+
+            /** Fields that hold HTML. It is cleaned before it is checked, so the length is that of what is kept. */
+            protected function rich(): array
+            {
+                return [{$rich}];
+            }
+        PHP;
         $m = self::M;
         $e = self::E;
 
@@ -658,7 +947,7 @@ final class ResourceGenerator
             protected function columns(): array
             {
                 return [{$columnMap}];
-            }
+            }{$richBlock}{$defaultsBlock}{$madeBlock}
             {$e}
         }
 
@@ -671,17 +960,25 @@ final class ResourceGenerator
      */
     private function rules(Descriptor $d, Field $f, array $all = []): array
     {
-        $rules = [$f->required ? "'required'" : "'nullable'"];
+        // A slug that is made from another field may be left empty: the request fills it in.
+        $rules = [$f->required && $f->from === null ? "'required'" : "'nullable'"];
+        // With a default, leaving it out is saying "the usual". Sent, it is checked like any other.
+        if ($f->default !== null) {
+            array_unshift($rules, "'sometimes'");
+        }
+        // A length of the field's own takes the place of the usual one.
+        $max = fn (int $usual) => "'max:".($f->maxLength ?? $usual)."'";
         $type = match (true) {
-            $f->kind === 'belongsTo' => ["'uuid'", "Rule::exists('{$this->tableOf((string) $f->target, $d, $all)}', 'id')"],
+            // An integer id is up to 18 digits, which is as many as always fit in the column.
+            $f->kind === 'belongsTo' => [...($this->hasIntIds((string) $f->target, $d, $all) ? ["'integer'", "'digits_between:1,18'"] : ["'uuid'"]), "Rule::exists('{$this->tableOf((string) $f->target, $d, $all)}', 'id')"],
             $f->kind === 'file' => ["'string'", "'max:512'", "new \\Nevela\\Laravel\\Rules\\UploadKey('{$d->name}', '{$f->name}')"],
-            $f->format === 'email' => ["'email'", "'max:255'"],
-            $f->format === 'url' => ["'url'", "'max:2048'"],
-            $f->format === 'tel' => ["'string'", "'max:32'"],
-            $f->format === 'slug' => ["'string'", "'alpha_dash'", "'max:255'"],
+            $f->format === 'email' => ["'email'", $max(255)],
+            $f->format === 'url' => ["'url'", $max(2048)],
+            $f->format === 'tel' => ["'string'", $max(32)],
+            $f->format === 'slug' => ["'string'", "'alpha_dash'", $max(255)],
             $f->format === 'color' => ["'string'", "'regex:/^#[0-9a-fA-F]{6}$/'"],
-            $f->kind === 'string' => ["'string'", "'max:255'"],
-            $f->kind === 'text' => ["'string'", "'max:65535'"],
+            $f->kind === 'string' => ["'string'", $max(255)],
+            $f->kind === 'text' => ["'string'", $max(65535)],
             $f->kind === 'int' && $f->format === 'percent' => ["'integer'", "'between:0,100'"],
             $f->kind === 'int' => ["'integer'"],
             $f->kind === 'float' && $f->format === 'percent' => ["'numeric'", "'between:0,100'"],
@@ -699,22 +996,35 @@ final class ResourceGenerator
         return $rules;
     }
 
-    public function resource(Descriptor $d): string
+    /** @param list<Descriptor> $all */
+    public function resource(Descriptor $d, array $all = []): string
     {
         $lines = [];
         foreach ($d->fields as $f) {
-            $value = match ($f->kind) {
-                'date' => "\$this->{$f->column()}?->format('Y-m-d')",
-                'datetime' => "\$this->{$f->column()}?->toJSON()",
+            $value = match (true) {
+                $f->kind === 'date' => "\$this->{$f->column()}?->format('Y-m-d')",
+                $f->kind === 'datetime' => "\$this->{$f->column()}?->toJSON()",
+                // Cleaned again on the way out: HTML can reach a table without passing a request.
+                $f->isRich() => "\\Nevela\\Laravel\\Nevela::html(\$this->{$f->column()})",
+                // An id is a string in the API whatever it is in the database.
+                $f->kind === 'belongsTo' && $this->hasIntIds((string) $f->target, $d, $all) => "\$this->{$f->column()} === null ? null : (string) \$this->{$f->column()}",
                 default => "\$this->{$f->column()}",
             };
             $lines[] = "            '{$f->name}' => {$value},";
             if ($f->kind === 'file') {
                 // The key is what a record stores; this is what a page needs to show it.
-                $lines[] = "            '{$f->name}File' => \\Nevela\\Laravel\\Nevela::file(\$this->{$f->column()}),";
+                $lines[] = $f->private
+                    // A private file is fetched through its record, so its details say which record.
+                    ? "            '{$f->name}File' => \\Nevela\\Laravel\\Nevela::privateFile(\$this->{$f->column()}, '{$d->slug}', \$this->getKey(), '{$f->name}'),"
+                    : "            '{$f->name}File' => \\Nevela\\Laravel\\Nevela::file(\$this->{$f->column()}),";
             }
         }
+        if ($d->public?->confirm !== null) {
+            // Not a field: when the address was proved, for the dashboard to say "Not confirmed" until it is.
+            $lines[] = "            'confirmedAt' => \$this->confirmed_at?->toJSON(),";
+        }
         $body = implode("\n", $lines);
+        $id = $d->idType === 'int' ? '(string) $this->id' : '$this->id';
         $m = self::M;
         $e = self::E;
 
@@ -734,7 +1044,7 @@ final class ResourceGenerator
             public function toArray(Request \$request): array
             {
                 return [
-                    'id' => \$this->id,
+                    'id' => {$id},
                     {$m}
         {$body}
                     {$e}
@@ -949,16 +1259,30 @@ final class ResourceGenerator
         $fields = [];
         foreach ($d->fields as $f) {
             $options = array_filter([
-                'required' => $f->required ? null : 'false',
+                // (A slug made from another field is optional in the form: left empty, Laravel makes it.)
+                'required' => $f->required && $f->from === null ? null : 'false',
                 'unique' => $f->unique ? 'true' : null,
                 'label' => $f->label ? $j($f->label) : null,
                 'format' => in_array($f->format, ['money', 'percent', 'rating'], true) ? $j($f->format) : null,
+                'maxLength' => $f->maxLength !== null ? (string) $f->maxLength : null,
+                'default' => $f->default !== null ? $j($f->default) : null,
                 // What the migration does when the parent goes: an optional link is cleared.
                 'onDelete' => $f->kind === 'belongsTo' && ! $f->required ? '"set null"' : null,
-                // A picture is worth a column in the table; other files are not.
-                'list' => $f->isImage() ? 'true' : null,
+                // A picture is worth a column in the table; other files are not, and a private one has no thumbnail to show.
+                'list' => $f->isImage() && ! $f->private ? 'true' : null,
             ]);
-            $opts = $options ? '{ '.implode(', ', array_map(fn ($k, $v) => "{$k}: {$v}", array_keys($options), $options)).' }' : '';
+            $parts = array_map(fn ($k, $v) => "{$k}: {$v}", array_keys($options), $options);
+            if ($f->private) {
+                $parts[] = '...({ private: true } as {})';
+            }
+            if ($f->from !== null) {
+                $parts[] = '...({ from: '.$j($f->from).' } as {})';
+            }
+            if ($f->isRich()) {
+                // Flare has no word for it, so it is said in passing: the dashboard reads `rich` off the field.
+                $parts[] = '...({ rich: true } as {})';
+            }
+            $opts = $parts ? '{ '.implode(', ', $parts).' }' : '';
             $call = match (true) {
                 $f->kind === 'belongsTo' => "field.belongsTo({$j($f->target)}".($opts ? ", {$opts}" : '').')',
                 $f->kind === 'file' => "field.file({$j($f->accept)}".($opts ? ", {$opts}" : '').')',

package/template/laravel/src/Http/Access/DeletedAccountsController.php

@@ -11,6 +11,7 @@ use Nevela\Laravel\Access\ClosedAccounts;
 use Nevela\Laravel\Auth\Account;
 use Nevela\Laravel\Auth\AuthMail;
 use Nevela\Laravel\Http\Auth\Answers;
+use Nevela\Laravel\Support\Key;
 use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
 
 /**
@@ -144,7 +145,7 @@ final class DeletedAccountsController
 
     private function find(string $id): mixed
     {
-        return ClosedAccounts::closed()->find($id) ?? throw new NotFoundHttpException('No such deleted account.');
+        return (Key::fits(Account::model(), $id) ? ClosedAccounts::closed()->find($id) : null) ?? throw new NotFoundHttpException('No such deleted account.');
     }
 
     /** An upgraded app keeps no deleted accounts until it has run its migrations. */

package/template/laravel/src/Http/Access/RolesController.php

@@ -13,6 +13,7 @@ use Nevela\Laravel\Access\ClosedAccounts;
 use Nevela\Laravel\Access\Permissions;
 use Nevela\Laravel\Http\Auth\Answers;
 use Nevela\Laravel\Models\Role;
+use Nevela\Laravel\Support\Key;
 use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;
 use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
 
@@ -124,7 +125,7 @@ final class RolesController
 
     private function find(string $id): Role
     {
-        return Role::query()->find($id) ?? throw new NotFoundHttpException('No such role.');
+        return (Key::fits(Role::class, $id) ? Role::query()->find($id) : null) ?? throw new NotFoundHttpException('No such role.');
     }
 
     private function users(Role $role): int

package/template/laravel/src/Http/Access/UsersController.php

@@ -19,6 +19,7 @@ use Nevela\Laravel\Auth\AuthMail;
 use Nevela\Laravel\Http\Auth\Answers;
 use Nevela\Laravel\Media\Uploads;
 use Nevela\Laravel\Models\Role;
+use Nevela\Laravel\Support\Key;
 use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
 
 /**
@@ -248,7 +249,7 @@ final class UsersController
 
     private function find(string $id): mixed
     {
-        return ClosedAccounts::open()->find($id) ?? throw new NotFoundHttpException('No such user.');
+        return (Key::fits(Account::model(), $id) ? ClosedAccounts::open()->find($id) : null) ?? throw new NotFoundHttpException('No such user.');
     }
 
     /**