create-nevela 0.8.0 → 0.9.2

package/template/laravel/src/Generator/ResourceGenerator.php

@@ -6,6 +6,7 @@ use Nevela\Laravel\Support\Action;
 use Nevela\Laravel\Support\Descriptor;
 use Nevela\Laravel\Support\Field;
 use Nevela\Laravel\Support\Naming;
+use Nevela\Laravel\Support\PublicAccess;
 
 /**
  * Turns descriptors into files. Pure: no Laravel, no filesystem — Writer does the I/O.
@@ -289,7 +290,7 @@ final class ResourceGenerator
 
         // What you type => the artisan command it runs.
         // "update" is what upgrade was called before 0.3.0; it still works.
-        \$nevela = ['resource', 'adopt', 'generate', 'seed', 'user', 'upgrade', 'update', 'dev', 'status', 'version', 'trash'];
+        \$nevela = ['resource', 'adopt', 'blog', 'generate', 'seed', 'user', 'upgrade', 'update', 'dev', 'status', 'version', 'trash', 'digest', 'disposable'];
         \$artisan = ['migrate', 'tinker', 'test', 'serve'];
         if (in_array(\$name, ['--version', '-v', '-V'], true)) {
             \$name = 'version';
@@ -316,10 +317,12 @@ final class ResourceGenerator
               php nevela resource Product --fields="name:string, price:money" --seed
                                                add a resource, create its table, fill it
               php nevela adopt posts           make a resource of a table you already have
+              php nevela blog                  give the site a blog: posts in the dashboard, /blog to read them
               php nevela generate              regenerate after editing a descriptor
               php nevela seed Product          fill a resource with records
               php nevela user                  create someone who can sign in
               php nevela trash                 remove deleted records whose time in the trash is up
+              php nevela disposable            fetch the current list of throwaway email domains
               php nevela upgrade               bring this app to the latest Nevela
               php nevela version               which Nevela this is
 
@@ -373,6 +376,17 @@ final class ResourceGenerator
             if ($d->actions !== []) {
                 $extras[$d->name]['actions'] = array_map(fn (Action $a) => ['permission' => "{$d->table}.{$a->key()}"] + $a->toArray(), $d->actions);
             }
+            // The field its records are published by, and where on the site they are a blog.
+            if ($d->publish !== null) {
+                $extras[$d->name]['publish'] = $d->publish;
+            }
+            if ($d->blog !== null) {
+                $extras[$d->name]['blog'] = $d->blog;
+            }
+            // What its public form checks, and the address it has proved.
+            if ($d->public?->protect !== null || $d->public?->confirm !== null) {
+                $extras[$d->name]['form'] = array_filter(['protect' => $d->public->toArray()['create']['protect'] ?? null, 'confirm' => $d->public->confirm], fn ($v) => $v !== null);
+            }
         }
         $body .= "\n\n/** What a resource has beyond its fields. Read through lib/extras.ts. */\nexport const extras: Record<string, unknown> = ".($extras === [] ? '{}' : json_encode($extras, JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE)).';';
         $m = self::M;
@@ -513,8 +527,18 @@ final class ResourceGenerator
                 foreach ($public->create as $field) {
                     if ($d->fields[$field]->kind === 'file') {
                         $lines[] = "Route::put('_nevela/uploads/{$d->name}/{$field}', [{$controller}, 'upload']){$for}->defaults('field', '{$field}')->middleware([{$throttle($public->createThrottle, 'upload')}{$more}])->name('{$d->slug}.upload.{$field}');";
+                        // The same, beside the form's own address: a page knows the form by its slug, not by the resource's name.
+                        $lines[] = "Route::put('{$d->slug}/_uploads/{$field}', [{$controller}, 'upload']){$for}->defaults('field', '{$field}')->middleware([{$throttle($public->createThrottle, 'upload')}{$more}])->name('{$d->slug}.upload.{$field}.here');";
                     }
                 }
+                // What a protected form asks for before it is shown, and after each attempt.
+                if ($public->protected()) {
+                    $lines[] = "Route::get('_nevela/form/{$d->slug}', [{$controller}, 'form']){$for}->middleware([{$throttle(PublicAccess::READ_THROTTLE, 'form')}])->name('{$d->slug}.form');";
+                }
+                // The link that proves an address.
+                if ($public->confirm !== null) {
+                    $lines[] = "Route::post('_nevela/confirm/{$d->slug}/{id}/{key}', [{$controller}, 'confirm']){$for}->middleware([{$throttle(PublicAccess::READ_THROTTLE, 'confirm')}])->name('{$d->slug}.confirm');";
+                }
             }
         }
         $body = $lines === [] ? '// No resource has a "public" section, so nothing is open.' : implode("\n", $lines);
@@ -578,7 +602,25 @@ final class ResourceGenerator
         }
         $castBlock = $casts ? implode("\n", $casts) : '';
         // Written with the model, outside its generated block: which records are public is the app's to say.
-        $scope = $d->public?->read === null ? '' : <<<PHP
+        $published = $d->publish === null ? null : $d->fields[$d->publish]->column();
+        $scope = match (true) {
+            $d->public?->read === null => '',
+            // A resource with a publish date has said it already: the ones whose time has come.
+            $published !== null => <<<PHP
+
+
+            /**
+             * Which {$this->lower($d->pluralLabel)} anyone may read, signed in or not: the published ones. The
+             * public list and the public page of one both go through here. A draft has no
+             * {$published}, and a scheduled one has a time still to come, which this lets
+             * through when it does, with nobody saving anything.
+             */
+            public function scopePublicQuery(\Illuminate\Database\Eloquent\Builder \$query): void
+            {
+                \$query->whereNotNull('{$published}')->where('{$published}', '<=', now());
+            }
+        PHP,
+            default => <<<PHP
 
 
             /**
@@ -592,9 +634,15 @@ final class ResourceGenerator
             {
                 \$query->whereRaw('1 = 0');
             }
-        PHP;
+        PHP,
+        };
         // An integer id is Eloquent's own default: the database numbers the records.
         [$import, $trait] = $d->idType === 'int' ? ['', ''] : ["use Illuminate\\Database\\Eloquent\\Concerns\\HasUuids;\n", "    use HasUuids;\n\n"];
+        $confirmable = $d->public?->confirm === null ? '' : <<<'PHP'
+
+            // Its public form asks for an address to be proved: Subscriber::confirmed() is who has.
+            use \Nevela\Laravel\Concerns\Confirmable;
+        PHP;
         $m = self::M;
         $e = self::E;
 
@@ -611,7 +659,7 @@ final class ResourceGenerator
 
             {$m}
             // Deleted records go to the trash, where they can be restored for a while.
-            use \Nevela\Laravel\Concerns\Trashable;
+            use \Nevela\Laravel\Concerns\Trashable;{$confirmable}
 
             protected \$fillable = [{$fillable}];
 
@@ -675,6 +723,10 @@ final class ResourceGenerator
             }
             $columns[] = "            {$line};";
         }
+        if ($d->public?->confirm !== null) {
+            $columns[] = '            // When the address was proved, by the link emailed to it. Empty until then.';
+            $columns[] = "            \$table->timestamp('confirmed_at')->nullable()->index();";
+        }
         $cols = implode("\n", $columns);
         $id = $d->idType === 'int' ? '$table->id();' : "\$table->uuid('id')->primary();";
 
@@ -749,6 +801,58 @@ final class ResourceGenerator
         PHP;
     }
 
+    /**
+     * For a table made before its form asked for addresses to be proved: the column that
+     * records it. The records already there are taken as proved. They were on the list
+     * before anyone was asked, and asking now would empty it.
+     */
+    public function confirmMigration(Descriptor $d): string
+    {
+        return <<<PHP
+        <?php
+
+        use Illuminate\Database\Migrations\Migration;
+        use Illuminate\Database\Schema\Blueprint;
+        use Illuminate\Support\Facades\DB;
+        use Illuminate\Support\Facades\Schema;
+
+        // {$d->pluralLabel} now prove their address: a record made through the public form is
+        // unconfirmed until the link emailed to it is followed. Generated once by Nevela.
+        return new class extends Migration
+        {
+            public function up(): void
+            {
+                if (Schema::hasTable('{$d->table}') && ! Schema::hasColumn('{$d->table}', 'confirmed_at')) {
+                    Schema::table('{$d->table}', function (Blueprint \$table) {
+                        \$table->timestamp('confirmed_at')->nullable()->index();
+                    });
+                    // Whoever is on the list already stays on it.
+                    DB::table('{$d->table}')->update(['confirmed_at' => now()]);
+                }
+            }
+
+            public function down(): void
+            {
+                if (Schema::hasColumn('{$d->table}', 'confirmed_at')) {
+                    Schema::table('{$d->table}', function (Blueprint \$table) {
+                        \$table->dropIndex(['confirmed_at']);
+                        \$table->dropColumn('confirmed_at');
+                    });
+                }
+            }
+        };
+
+        PHP;
+    }
+
+    /** The file `confirmMigration()` goes in. Written once for a table, whatever its date. */
+    public function confirmMigrationFile(Descriptor $d, ?string $timestamp = null): GeneratedFile
+    {
+        $timestamp ??= date('Y_m_d_His');
+
+        return new GeneratedFile(GeneratedFile::TARGET_API, "database/migrations/{$timestamp}_add_confirmation_to_{$d->table}_table.php", $this->confirmMigration($d), GeneratedFile::MODE_ONCE, "database/migrations/*_add_confirmation_to_{$d->table}_table.php");
+    }
+
     /** The file `trashMigration()` goes in. Not made again once one exists for the table, whatever its date. */
     public function trashMigrationFile(Descriptor $d, ?string $timestamp = null): GeneratedFile
     {
@@ -780,6 +884,19 @@ final class ResourceGenerator
                 return [{$defaults}];
             }
         PHP;
+        $made = implode(', ', array_map(
+            fn (Field $f) => "'{$f->name}' => ['from' => '{$f->from}', 'table' => '{$d->table}', 'column' => '{$f->column()}']",
+            array_filter($d->fields, fn (Field $f) => $f->from !== null),
+        ));
+        $madeBlock = $made === '' ? '' : <<<PHP
+
+
+            /** Fields made from another when a create leaves them empty. They are never remade afterwards. */
+            protected function made(): array
+            {
+                return [{$made}];
+            }
+        PHP;
         // Only where there is one: a resource without rich text has the request it always had.
         $rich = implode(', ', array_map(fn (Field $f) => "'{$f->name}'", array_filter($d->fields, fn (Field $f) => $f->isRich())));
         $richBlock = $rich === '' ? '' : <<<PHP
@@ -832,7 +949,7 @@ final class ResourceGenerator
             protected function columns(): array
             {
                 return [{$columnMap}];
-            }{$richBlock}{$defaultsBlock}
+            }{$richBlock}{$defaultsBlock}{$madeBlock}
             {$e}
         }
 
@@ -845,7 +962,8 @@ final class ResourceGenerator
      */
     private function rules(Descriptor $d, Field $f, array $all = []): array
     {
-        $rules = [$f->required ? "'required'" : "'nullable'"];
+        // A slug that is made from another field may be left empty: the request fills it in.
+        $rules = [$f->required && $f->from === null ? "'required'" : "'nullable'"];
         // With a default, leaving it out is saying "the usual". Sent, it is checked like any other.
         if ($f->default !== null) {
             array_unshift($rules, "'sometimes'");
@@ -903,6 +1021,10 @@ final class ResourceGenerator
                     : "            '{$f->name}File' => \\Nevela\\Laravel\\Nevela::file(\$this->{$f->column()}),";
             }
         }
+        if ($d->public?->confirm !== null) {
+            // Not a field: when the address was proved, for the dashboard to say "Not confirmed" until it is.
+            $lines[] = "            'confirmedAt' => \$this->confirmed_at?->toJSON(),";
+        }
         $body = implode("\n", $lines);
         $id = $d->idType === 'int' ? '(string) $this->id' : '$this->id';
         $m = self::M;
@@ -1139,7 +1261,8 @@ final class ResourceGenerator
         $fields = [];
         foreach ($d->fields as $f) {
             $options = array_filter([
-                'required' => $f->required ? null : 'false',
+                // (A slug made from another field is optional in the form: left empty, Laravel makes it.)
+                'required' => $f->required && $f->from === null ? null : 'false',
                 'unique' => $f->unique ? 'true' : null,
                 'label' => $f->label ? $j($f->label) : null,
                 'format' => in_array($f->format, ['money', 'percent', 'rating'], true) ? $j($f->format) : null,
@@ -1154,6 +1277,9 @@ final class ResourceGenerator
             if ($f->private) {
                 $parts[] = '...({ private: true } as {})';
             }
+            if ($f->from !== null) {
+                $parts[] = '...({ from: '.$j($f->from).' } as {})';
+            }
             if ($f->isRich()) {
                 // Flare has no word for it, so it is said in passing: the dashboard reads `rich` off the field.
                 $parts[] = '...({ rich: true } as {})';

package/template/laravel/src/Http/Access/DeletedAccountsController.php

@@ -11,6 +11,7 @@ use Nevela\Laravel\Access\ClosedAccounts;
 use Nevela\Laravel\Auth\Account;
 use Nevela\Laravel\Auth\AuthMail;
 use Nevela\Laravel\Http\Auth\Answers;
+use Nevela\Laravel\Support\Key;
 use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
 
 /**
@@ -144,7 +145,7 @@ final class DeletedAccountsController
 
     private function find(string $id): mixed
     {
-        return ClosedAccounts::closed()->find($id) ?? throw new NotFoundHttpException('No such deleted account.');
+        return (Key::fits(Account::model(), $id) ? ClosedAccounts::closed()->find($id) : null) ?? throw new NotFoundHttpException('No such deleted account.');
     }
 
     /** An upgraded app keeps no deleted accounts until it has run its migrations. */

package/template/laravel/src/Http/Access/RolesController.php

@@ -13,6 +13,7 @@ use Nevela\Laravel\Access\ClosedAccounts;
 use Nevela\Laravel\Access\Permissions;
 use Nevela\Laravel\Http\Auth\Answers;
 use Nevela\Laravel\Models\Role;
+use Nevela\Laravel\Support\Key;
 use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;
 use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
 
@@ -124,7 +125,7 @@ final class RolesController
 
     private function find(string $id): Role
     {
-        return Role::query()->find($id) ?? throw new NotFoundHttpException('No such role.');
+        return (Key::fits(Role::class, $id) ? Role::query()->find($id) : null) ?? throw new NotFoundHttpException('No such role.');
     }
 
     private function users(Role $role): int

package/template/laravel/src/Http/Access/UsersController.php

@@ -19,6 +19,7 @@ use Nevela\Laravel\Auth\AuthMail;
 use Nevela\Laravel\Http\Auth\Answers;
 use Nevela\Laravel\Media\Uploads;
 use Nevela\Laravel\Models\Role;
+use Nevela\Laravel\Support\Key;
 use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
 
 /**
@@ -248,7 +249,7 @@ final class UsersController
 
     private function find(string $id): mixed
     {
-        return ClosedAccounts::open()->find($id) ?? throw new NotFoundHttpException('No such user.');
+        return (Key::fits(Account::model(), $id) ? ClosedAccounts::open()->find($id) : null) ?? throw new NotFoundHttpException('No such user.');
     }
 
     /**

package/template/laravel/src/Http/ActionController.php

@@ -12,6 +12,7 @@ use Illuminate\Validation\ValidationException;
 use Nevela\Laravel\Nevela;
 use Nevela\Laravel\Support\Action;
 use Nevela\Laravel\Support\Descriptor;
+use Nevela\Laravel\Support\Key;
 use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;
 use Symfony\Component\HttpKernel\Exception\HttpExceptionInterface;
 use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
@@ -128,7 +129,7 @@ final class ActionController
     private function one(Descriptor $descriptor, string $id): ?Model
     {
         $model = "App\\Models\\{$descriptor->name}";
-        if (! class_exists($model) || ($descriptor->idType === 'int' && ! preg_match('/^[0-9]{1,18}$/', $id))) {
+        if (! class_exists($model) || ! Key::fits($model, $id)) {
             return null;
         }
         $record = $model::query()->find($id);

package/template/laravel/src/Http/Auth/AccountController.php

@@ -21,6 +21,7 @@ use Nevela\Laravel\Models\Upload;
 use Nevela\Laravel\Rules\UploadKey;
 use Nevela\Laravel\Support\Descriptor;
 use Nevela\Laravel\Support\Field;
+use Nevela\Laravel\Support\Key;
 
 /**
  * An account and what its owner can do with it: create it, prove the email address,
@@ -281,9 +282,11 @@ final class AccountController
     public function revokeSession(Request $request, string $id): Response
     {
         $user = $request->user();
-        DB::table('personal_access_tokens')
-            ->where('tokenable_type', $user->getMorphClass())->where('tokenable_id', $user->getAuthIdentifier())
-            ->where('id', $id)->delete();
+        if (Key::isInt($id)) {
+            DB::table('personal_access_tokens')
+                ->where('tokenable_type', $user->getMorphClass())->where('tokenable_id', $user->getAuthIdentifier())
+                ->where('id', $id)->delete();
+        }
 
         return response()->noContent();
     }

package/template/laravel/src/Http/Auth/SecurityController.php

@@ -2,6 +2,7 @@
 
 namespace Nevela\Laravel\Http\Auth;
 
+use Illuminate\Database\Eloquent\ModelNotFoundException;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
 use Illuminate\Http\Response;
@@ -13,6 +14,7 @@ use Nevela\Laravel\Auth\Passkeys;
 use Nevela\Laravel\Auth\Totp;
 use Nevela\Laravel\Models\Passkey;
 use Nevela\Laravel\Models\TwoFactor;
+use Nevela\Laravel\Support\Key;
 use RuntimeException;
 
 /**
@@ -161,6 +163,9 @@ final class SecurityController
     public function renamePasskey(Request $request, string $id): JsonResponse
     {
         $input = $request->validate(['name' => ['required', 'string', 'max:80']]);
+        if (! Key::fits(Passkey::class, $id)) {
+            throw (new ModelNotFoundException)->setModel(Passkey::class, [$id]);
+        }
         $passkey = Passkey::query()->where('user_id', (string) $request->user()->getAuthIdentifier())->findOrFail($id);
         $passkey->fill(['name' => trim($input['name'])])->save();
 
@@ -170,7 +175,9 @@ final class SecurityController
     /** DELETE auth/passkeys/{id} */
     public function removePasskey(Request $request, string $id): Response
     {
-        Passkey::query()->where('user_id', (string) $request->user()->getAuthIdentifier())->where('id', $id)->delete();
+        if (Key::fits(Passkey::class, $id)) {
+            Passkey::query()->where('user_id', (string) $request->user()->getAuthIdentifier())->where('id', $id)->delete();
+        }
 
         return response()->noContent();
     }

package/template/laravel/src/Http/FormsController.php

@@ -0,0 +1,45 @@
+<?php
+
+namespace Nevela\Laravel\Http;
+
+use Illuminate\Http\JsonResponse;
+use Illuminate\Support\Facades\Gate;
+use Nevela\Laravel\Forms\FormBlocks;
+use Nevela\Laravel\Forms\FormGuard;
+use Nevela\Laravel\Nevela;
+use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
+
+/**
+ * What a resource's public form has been doing, for whoever may see the resource:
+ *
+ *   GET {prefix}/_nevela/forms/{slug}   → { protect, confirm, robotCheck, blocked }
+ *
+ * `blocked` is what was turned away in the last week, in all and by reason. It is how a
+ * form that is well protected is told from one nobody uses.
+ */
+final class FormsController
+{
+    public function show(string $slug): JsonResponse
+    {
+        $descriptor = null;
+        foreach (Nevela::all() as $candidate) {
+            if ($candidate->slug === $slug) {
+                $descriptor = $candidate;
+            }
+        }
+        $model = $descriptor === null ? null : "App\\Models\\{$descriptor->name}";
+        if ($descriptor === null || $descriptor->public?->create === null || ! class_exists((string) $model)) {
+            throw new NotFoundHttpException;
+        }
+        Gate::authorize('viewAny', $model);
+        $protect = $descriptor->public->protect;
+
+        return response()->json([
+            'protect' => $protect,
+            'confirm' => $descriptor->public->confirm,
+            // Asked for and not possible: the form is refusing everyone (production) or checking nobody (development).
+            'robotCheck' => ($protect['turnstile'] ?? false) ? FormGuard::robotCheck() : 'off',
+            'blocked' => FormBlocks::summary($descriptor->name),
+        ]);
+    }
+}

package/template/laravel/src/Http/PublicController.php

@@ -8,6 +8,9 @@ use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
 use Illuminate\Http\Response;
 use Illuminate\Support\Facades\DB;
+use Nevela\Laravel\Forms\Confirmation;
+use Nevela\Laravel\Forms\FormBlocks;
+use Nevela\Laravel\Forms\FormGuard;
 use Nevela\Laravel\Media\Uploads;
 use Nevela\Laravel\Models\Upload;
 use Nevela\Laravel\Nevela;
@@ -22,6 +25,9 @@ use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
  *   GET  {prefix}/public/{slug}/{id}     one of them, by id or by the field the section names
  *   POST {prefix}/public/{slug}          create one, from the fields the section lists
  *   PUT  {prefix}/public/_nevela/uploads/{Resource}/{field}   a file for such a create
+ *   PUT  {prefix}/public/{slug}/_uploads/{field}              the same, by the form's own address
+ *   GET  {prefix}/public/_nevela/form/{slug}                  what a protected form sends back with it
+ *   POST {prefix}/public/_nevela/confirm/{slug}/{id}/{key}    the link that proves an address
  *
  * The routes are generated (routes/nevela-public.php), one set per resource that has a
  * section and only for what it opens, so a resource without one has nothing here to call.
@@ -75,8 +81,39 @@ final class PublicController
         $requestClass = "App\\Http\\Requests\\Nevela\\{$descriptor->name}Request";
         $model = $this->model($descriptor);
         $input = $request->json()->all() ?: $request->request->all();
+        $input = is_array($input) ? $input : [];
 
-        $checked = (new $requestClass)->forFields($public->create, is_array($input) ? $input : []);
+        // Before anything is validated or stored: what "protect" asks for. What is turned
+        // away is counted, and a program is told it worked.
+        if (($refusal = FormGuard::check($descriptor, $request, $input)) !== null) {
+            FormBlocks::record($descriptor->name, $refusal->reason);
+
+            return $refusal->response();
+        }
+        $input = FormGuard::strip($descriptor, $input);
+
+        $address = null;
+        if ($public->confirm !== null) {
+            $column = $descriptor->fields[$public->confirm]->column();
+            $typed = $input[$public->confirm] ?? null;
+            if (is_string($typed) && filter_var(trim($typed), FILTER_VALIDATE_EMAIL)) {
+                // One spelling of an address, so the same one can't join twice.
+                $address = $input[$public->confirm] = strtolower(trim($typed));
+                // Already on the list, or once was: answered exactly as the first time, so the
+                // form can't be used to ask who is on it. Someone still waiting gets the link
+                // again, as often as an address may be written to.
+                $existing = DB::table($descriptor->table)->whereRaw("lower({$column}) = ?", [$address])->first();
+                if ($existing !== null) {
+                    if (property_exists($existing, 'confirmed_at') && $existing->confirmed_at === null && ($existing->deleted_at ?? null) === null) {
+                        Confirmation::send($descriptor, $existing->id, $address, $request);
+                    }
+
+                    return response()->noContent(201);
+                }
+            }
+        }
+
+        $checked = (new $requestClass)->forFields($public->create, $input);
         // A file has to be one a visitor uploaded for this, a moment ago, and not yet used.
         foreach ($public->create as $field) {
             $key = $checked['values'][$descriptor->fields[$field]->column()] ?? null;
@@ -89,7 +126,12 @@ final class PublicController
         }
 
         $record = DB::transaction(function () use ($model, $checked, $descriptor, $public) {
-            $record = $model::create($checked['values']);
+            $record = new $model($checked['values']);
+            if ($public->confirm !== null) {
+                // Not yet: see Concerns\Confirmable.
+                $record->setAttribute('confirmed_at', null);
+            }
+            $record->save();
             // Claimed: the nightly clear-out of uploads nobody used leaves it alone from here on.
             foreach ($public->create as $field) {
                 $key = $descriptor->fields[$field]->kind === 'file' ? $record->getAttribute($descriptor->fields[$field]->column()) : null;
@@ -101,8 +143,14 @@ final class PublicController
             return $record;
         });
 
-        // What they may read of what they made, or nothing where nothing may be read.
-        if ($public->read === null) {
+        if ($address !== null) {
+            Confirmation::send($descriptor, $record->getKey(), $address, $request);
+        }
+
+        // What they may read of what they made, or nothing where nothing may be read. A
+        // form with checks, or an address to prove, says nothing either way: the answer to
+        // one that was sent has to be the answer to one that was quietly turned away.
+        if ($public->read === null || $public->protected() || $public->confirm !== null) {
             return response()->noContent(201);
         }
         $resourceClass = $this->resourceClass($descriptor);
@@ -110,6 +158,43 @@ final class PublicController
         return response()->json($this->visible($descriptor, $public, (new $resourceClass($record->refresh()))->resolve($request)), 201);
     }
 
+    /**
+     * What a protected form needs before it is shown: a token that says when it was handed
+     * out, the name of the field a person never sees, and whether the robot check is on.
+     */
+    public function form(Request $request): JsonResponse
+    {
+        [$descriptor] = $this->open($request, 'create');
+
+        return response()->json(FormGuard::issue($descriptor))->header('Cache-Control', 'no-store');
+    }
+
+    /**
+     * The link in the email: the record it names is confirmed. The key is what only this
+     * app could have written for that record and that address, so a link can't be made up
+     * and stops working if the address is changed. Following it twice does no harm.
+     */
+    public function confirm(Request $request): JsonResponse
+    {
+        [$descriptor, $public] = $this->open($request, 'create');
+        $id = (string) $request->route('id');
+        $model = $this->model($descriptor);
+        $gone = fn () => response()->json(['error' => 'This link is no longer good. It may have been used too late: sign up again for a new one.'], 404);
+        if ($public->confirm === null || ($descriptor->idType === 'int' ? ! preg_match('/^[0-9]{1,18}$/', $id) : ! \Illuminate\Support\Str::isUuid($id))) {
+            return $gone();
+        }
+        $record = $model::query()->whereKey($id)->first();
+        $address = $record?->getAttribute($descriptor->fields[$public->confirm]->column());
+        if ($record === null || ! is_string($address) || ! hash_equals(Confirmation::hash($descriptor, $id, $address), (string) $request->route('key'))) {
+            return $gone();
+        }
+        if ($record->getAttribute('confirmed_at') === null) {
+            $record->forceFill(['confirmed_at' => now()])->save();
+        }
+
+        return response()->json(['confirmed' => true]);
+    }
+
     /** A file for a public create: the field's own types and size limit, and no sign-in. */
     public function upload(Request $request): JsonResponse
     {

package/template/laravel/src/Http/ResourceRequest.php

@@ -10,6 +10,7 @@ use Illuminate\Validation\Rules\Exists;
 use Illuminate\Validation\Rules\Unique;
 use Illuminate\Validation\Validator;
 use Nevela\Laravel\Support\Html;
+use Nevela\Laravel\Support\Slug;
 
 /**
  * Base for generated resource requests.
@@ -53,6 +54,43 @@ abstract class ResourceRequest extends FormRequest
         return [];
     }
 
+    /**
+     * Fields made from another when a create leaves them empty: a slug from a title. A
+     * generated request with any says which, and where to look for the ones taken.
+     *
+     * @return array<string, array{from: string, table: string, column: string}>
+     */
+    protected function made(): array
+    {
+        return [];
+    }
+
+    /**
+     * Fill what a create left empty and can be made, and keep a later save from emptying
+     * it: once made, a slug is an address, and an address doesn't move.
+     *
+     * @param  array<string, mixed>  $values  by column
+     * @param  array<string, true>  $taken  Values made for earlier rows of the same batch
+     * @return array<string, mixed>
+     */
+    private function make(array $values, bool $creating, array &$taken = []): array
+    {
+        $columns = $this->columns();
+        foreach ($this->made() as $definition) {
+            $column = $definition['column'];
+            $empty = ! isset($values[$column]) || $values[$column] === '';
+            if (! $empty) {
+                $taken[(string) $values[$column]] = true;
+            } elseif ($creating) {
+                $values[$column] = Slug::free($definition['table'], $column, (string) ($values[$columns[$definition['from']] ?? ''] ?? ''), $taken);
+            } else {
+                unset($values[$column]);
+            }
+        }
+
+        return $values;
+    }
+
     /**
      * A create from some of the fields only: a public form's, where nobody is asked who
      * they are and so only what the descriptor lists is taken.
@@ -93,7 +131,7 @@ abstract class ResourceRequest extends FormRequest
             }
         }
 
-        return ['values' => $values, 'issues' => []];
+        return ['values' => $this->make($values, true), 'issues' => []];
     }
 
     /**
@@ -252,6 +290,7 @@ abstract class ResourceRequest extends FormRequest
         $values = [];
         $problems = [];
         $taken = [];
+        $made = [];
         foreach (array_values($rows) as $index => $row) {
             $number = $index + 1;
             if (! is_array($row) || array_is_list($row)) {
@@ -299,7 +338,8 @@ abstract class ResourceRequest extends FormRequest
                     $mapped[$column] = $defaults[$field];
                 }
             }
-            $values[] = $mapped;
+            // Two rows with one title get two slugs: what was made for an earlier row is remembered.
+            $values[] = $this->make($mapped, true, $made);
         }
 
         return ['values' => $values, 'problems' => $problems];
@@ -322,6 +362,6 @@ abstract class ResourceRequest extends FormRequest
             }
         }
 
-        return $values;
+        return $this->make($values, $this->isMethod('POST'));
     }
 }