create-nevela 0.8.0 → 0.9.2

package/template/laravel/src/Http/TrashController.php

@@ -6,6 +6,7 @@ use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
 use Illuminate\Http\Response;
 use Nevela\Laravel\Support\Descriptor;
+use Nevela\Laravel\Support\Key;
 use Nevela\Laravel\Trash\Trash;
 use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;
 use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
@@ -176,7 +177,7 @@ final class TrashController
     {
         // Where ids are integers, something that isn't one is nobody's id. Asked anyway,
         // some databases answer with an error instead of with nothing.
-        if ((new $model)->getKeyType() === 'int' && ! preg_match('/^[0-9]{1,18}$/', $id)) {
+        if (! Key::fits($model, $id)) {
             return null;
         }
 

package/template/laravel/src/Http/UploadController.php

@@ -14,6 +14,7 @@ use Nevela\Laravel\Models\Upload;
 use Nevela\Laravel\Nevela;
 use Nevela\Laravel\Support\Descriptor;
 use Nevela\Laravel\Support\Field;
+use Nevela\Laravel\Support\Key;
 use Symfony\Component\HttpFoundation\Response;
 
 /**
@@ -171,8 +172,7 @@ final class UploadController
         }
         $definition = $descriptor?->fields[$field] ?? null;
         $model = 'App\\Models\\'.($descriptor?->name ?? '');
-        if ($descriptor === null || $definition === null || $definition->kind !== 'file' || ! $definition->private || ! class_exists($model)
-            || ($descriptor->idType === 'int' && ! preg_match('/^[0-9]{1,18}$/', $id))) {
+        if ($descriptor === null || $definition === null || $definition->kind !== 'file' || ! $definition->private || ! class_exists($model) || ! Key::fits($model, $id)) {
             abort(404);
         }
         // A record in the trash is found by nobody here: trashing it exposes nothing.

package/template/laravel/src/Nevela.php

@@ -22,7 +22,7 @@ use Nevela\Laravel\Support\Naming;
 final class Nevela
 {
     /** Written by `pnpm release`; the same number as the repository's git tag. */
-    public const VERSION = '0.8.0';
+    public const VERSION = '0.9.2';
 
     /** @var array<string, Descriptor> */
     private static array $descriptors = [];
@@ -136,6 +136,21 @@ final class Nevela
         }
 
         foreach ($list->filters as $filter) {
+            if (isset($filter['state'])) {
+                // Published: its time has come. Scheduled: it has one, still to come. Draft: it has none.
+                match ($filter['state']) {
+                    'draft' => $query->whereNull($filter['column']),
+                    'scheduled' => $query->where($filter['column'], '>', now()),
+                    default => $query->whereNotNull($filter['column'])->where($filter['column'], '<=', now()),
+                };
+
+                continue;
+            }
+            if (isset($filter['confirmed'])) {
+                $filter['confirmed'] ? $query->whereNotNull($filter['column']) : $query->whereNull($filter['column']);
+
+                continue;
+            }
             $field = $resource->fields[$filter['field']] ?? null;
             if ($filter['value'] !== null && $field?->kind === 'belongsTo' && ! self::couldBeId((string) $field->target, (string) $filter['value'])) {
                 // Nothing belongs to a record that can't exist. Asked anyway, some databases
@@ -150,6 +165,18 @@ final class Nevela
         }
     }
 
+    /**
+     * A count is of the people who are really there: where a resource's form asks for an
+     * address to be proved, the ones who haven't yet are left out. The list still shows
+     * them, marked.
+     */
+    private static function proved(Builder $query, Descriptor $resource): void
+    {
+        if ($resource->public?->confirm !== null && method_exists($query->getModel(), 'scopeConfirmed')) {
+            $query->confirmed();
+        }
+    }
+
     /** Whether a value has the shape of one of a resource's ids: digits, or a UUID. */
     private static function couldBeId(string $name, string $value): bool
     {
@@ -186,6 +213,7 @@ final class Nevela
             return response()->json(['error' => 'Invalid query.', 'issues' => $list->issues], 400);
         }
         self::narrow($query, $resource, $list);
+        self::proved($query, $resource);
         $base = fn () => (clone $query)->reorder();
 
         // Counted per day by the database, one grouped query over the created_at index,
@@ -320,6 +348,7 @@ final class Nevela
         $now = now();
         $since = $now->copy()->subDays($days);
         $before = $now->copy()->subDays($days * 2);
+        self::proved($query, $resource);
         $base = fn () => (clone $query)->reorder();
 
         $values = [];

package/template/laravel/src/NevelaServiceProvider.php

@@ -14,7 +14,10 @@ use Illuminate\Support\ServiceProvider;
 use Nevela\Laravel\Access\Access;
 use Nevela\Laravel\Access\Permissions;
 use Nevela\Laravel\Console\AdoptCommand;
+use Nevela\Laravel\Console\BlogCommand;
 use Nevela\Laravel\Console\DevCommand;
+use Nevela\Laravel\Console\DigestCommand;
+use Nevela\Laravel\Console\DisposableCommand;
 use Nevela\Laravel\Console\GenerateCommand;
 use Nevela\Laravel\Console\MakeResourceCommand;
 use Nevela\Laravel\Console\SeedCommand;
@@ -29,6 +32,7 @@ use Nevela\Laravel\Http\Access\RolesAreSetUp;
 use Nevela\Laravel\Http\Access\RolesController;
 use Nevela\Laravel\Http\Access\UsersController;
 use Nevela\Laravel\Http\FlareErrors;
+use Nevela\Laravel\Http\FormsController;
 use Nevela\Laravel\Http\Auth\AccountController;
 use Nevela\Laravel\Http\Auth\SecurityController;
 use Nevela\Laravel\Http\Auth\SignInController;
@@ -61,9 +65,9 @@ final class NevelaServiceProvider extends ServiceProvider
 
             $this->publishes([__DIR__.'/../config/nevela.php' => config_path('nevela.php')], 'nevela-config');
             $this->commands([
-                MakeResourceCommand::class, AdoptCommand::class, GenerateCommand::class, SeedCommand::class, UserCommand::class,
+                MakeResourceCommand::class, AdoptCommand::class, BlogCommand::class, GenerateCommand::class, SeedCommand::class, UserCommand::class,
                 UpdateCommand::class, DevCommand::class, StatusCommand::class, VersionCommand::class, SetupCommand::class,
-                TrashCommand::class,
+                TrashCommand::class, DigestCommand::class, DisposableCommand::class,
             ]);
 
             // What has been in the trash too long is removed each night, wherever the app's
@@ -71,6 +75,8 @@ final class NevelaServiceProvider extends ServiceProvider
             // happens whenever someone opens the trash.
             $this->callAfterResolving(Schedule::class, function (Schedule $schedule) {
                 $schedule->command(TrashCommand::class)->dailyAt('03:40')->withoutOverlapping();
+                // The notices to the owner that were held back in a busy hour, as one email.
+                $schedule->command(DigestCommand::class)->hourly()->withoutOverlapping();
             });
         }
 
@@ -204,6 +210,9 @@ final class NevelaServiceProvider extends ServiceProvider
             Route::delete('_nevela/trash/{slug}/{id}', [TrashController::class, 'destroy'])->name('trash.destroy');
             Route::delete('_nevela/trash/{slug}', [TrashController::class, 'empty'])->name('trash.empty');
 
+            // A public form, from the inside: what it checks and what it has turned away.
+            Route::get('_nevela/forms/{slug}', [FormsController::class, 'show'])->name('forms.show');
+
             // Users and roles, for whoever holds the permissions to manage them.
             Route::middleware(RolesAreSetUp::class)->group(function () {
                 Route::get('_nevela/users', [UsersController::class, 'index'])->name('users.index');

package/template/laravel/src/Support/Descriptor.php

@@ -21,6 +21,8 @@ final class Descriptor
      * @param  bool  $adopted  The table was there before Nevela, so no migration is written to create it
      * @param  array<string, Action>  $actions  What can be done to a record or to the list beyond create, edit and delete, by name
      * @param  PublicAccess|null  $public  What of it anyone may read or create without signing in. Nothing, when null.
+     * @param  string|null  $publish  The date-and-time field that says when a record is published: empty is a draft, a time to come is scheduled
+     * @param  string|null  $blog  Where on the site its public records are a blog, e.g. "/blog". The pages are written by `nevela:blog`.
      */
     public function __construct(
         public readonly string $name,
@@ -36,6 +38,8 @@ final class Descriptor
         public readonly bool $adopted = false,
         public readonly array $actions = [],
         public readonly ?PublicAccess $public = null,
+        public readonly ?string $publish = null,
+        public readonly ?string $blog = null,
     ) {
         if (! preg_match('/^[A-Z][A-Za-z0-9]*$/', $name)) {
             throw new InvalidArgumentException('Resource name must be PascalCase, e.g. Product or BlogPost.');
@@ -63,6 +67,22 @@ final class Descriptor
             $keys[$action->key()] = true;
         }
         $public?->check($name, $fields);
+        foreach ($fields as $field) {
+            if ($field->from !== null && (! isset($fields[$field->from]) || ! in_array($fields[$field->from]->kind, ['string', 'text'], true))) {
+                throw new InvalidArgumentException("{$name}: \"{$field->name}\" is made from \"{$field->from}\", which has to be a string field of {$name}.");
+            }
+        }
+        if ($publish !== null && (! isset($fields[$publish]) || $fields[$publish]->kind !== 'datetime' || $fields[$publish]->required)) {
+            throw new InvalidArgumentException("{$name}: \"publish\" names the field that says when a record is published. It has to be an optional datetime: {$publish}:datetime?");
+        }
+        if ($blog !== null) {
+            if (! preg_match('#^/[a-z0-9][a-z0-9/-]*$#', $blog)) {
+                throw new InvalidArgumentException("{$name}: \"blog\" is where the blog is on the site, such as \"/blog\".");
+            }
+            if ($public?->read === null || $public->by === null) {
+                throw new InvalidArgumentException("{$name}: a blog reads its posts publicly, each by a unique field. Give it \"public\": { \"read\": { \"by\": \"slug\", \"fields\": […] } }.");
+            }
+        }
     }
 
     /** Build from a name and a `--fields` string: "name:string, price:money, status:enum(draft|live)?". */
@@ -127,6 +147,8 @@ final class Descriptor
             (bool) ($data['adopted'] ?? false),
             $actions,
             isset($data['public']) ? PublicAccess::fromArray((array) $data['public']) : null,
+            $data['publish'] ?? null,
+            $data['blog'] ?? null,
         );
     }
 
@@ -155,6 +177,8 @@ final class Descriptor
             'icon' => $this->icon,
             'group' => $this->group,
             'titleField' => $this->titleField,
+            'publish' => $this->publish,
+            'blog' => $this->blog,
             'fields' => array_map(fn (Field $f) => $f->toArray(), $this->fields),
             'actions' => $this->actions ? array_map(fn (Action $a) => $a->toArray(), $this->actions) : null,
             'public' => $this->public?->toArray(),

package/template/laravel/src/Support/Field.php

@@ -44,6 +44,7 @@ final class Field
      * @param  int|null  $maxLength  string and text: the most characters it holds, where that isn't the usual 255 or 65,535
      * @param  bool  $private  file: kept where the web server doesn't reach, and handed only to someone who may view the record
      * @param  string|int|float|bool|null  $default  What the field is when a create leaves it out. Also the column's default.
+     * @param  string|null  $from  slug: the field it is made from when a create leaves it empty, e.g. "title"
      */
     public function __construct(
         public readonly string $name,
@@ -59,6 +60,7 @@ final class Field
         public readonly ?int $maxLength = null,
         public readonly bool $private = false,
         public readonly string|int|float|bool|null $default = null,
+        public readonly ?string $from = null,
     ) {
         if (! preg_match('/^[a-z][A-Za-z0-9]*$/', $name)) {
             throw new InvalidArgumentException("Field \"{$name}\" must be camelCase (e.g. publishedAt).");
@@ -107,6 +109,14 @@ final class Field
                 throw new InvalidArgumentException("\"{$name}\" is unique, so only one record could ever have its default.");
             }
         }
+        if ($from !== null) {
+            if ($kind !== 'string' || $format !== 'slug') {
+                throw new InvalidArgumentException("\"{$name}\" can't be made from another field: that is for a slug ({$name}:slug({$from})).");
+            }
+            if (! preg_match('/^[a-z][A-Za-z0-9]*$/', $from) || $from === $name) {
+                throw new InvalidArgumentException("\"{$name}\" is made from a field of the same resource, named as it is there: {$name}:slug(title).");
+            }
+        }
         if ($private && $kind !== 'file') {
             throw new InvalidArgumentException("\"{$name}\" can't be private: that is for file fields. Who may see a record's other fields is its policy's to say.");
         }
@@ -139,6 +149,7 @@ final class Field
      *   manual:file(pdf|document)         any other upload
      *   cv:file(pdf|private)              one only those who may view the record can fetch
      *   status:enum(pending|paid)=pending what it is when a create leaves it out
+     *   slug:slug(title)!                 made from the title when left empty
      *
      * Grit's and Flare's spellings are understood too: see normalise().
      */
@@ -198,6 +209,10 @@ final class Field
             throw new InvalidArgumentException("Unknown type \"{$type}\" on \"{$name}\". Use one of: ".implode(', ', array_keys(self::ALIASES)).', enum(a|b), belongsTo(Resource), image, file(pdf|…).');
         }
         [$kind, $format] = self::ALIASES[$type];
+        // slug:slug(title)!: made from the title when a create leaves it empty.
+        if ($format === 'slug' && $args !== '' && ! ctype_digit($args)) {
+            return new self($name, $kind, $format, $required, $unique, from: Naming::camel($args));
+        }
         // excerpt:string(500): a length of its own.
         $maxLength = in_array($kind, ['string', 'text'], true) && $format !== 'color' && ctype_digit($args) ? (int) $args : null;
 
@@ -245,6 +260,7 @@ final class Field
             isset($data['maxLength']) ? (int) $data['maxLength'] : null,
             (bool) ($data['private'] ?? false),
             $data['default'] ?? null,
+            $data['from'] ?? null,
         );
     }
 
@@ -261,6 +277,7 @@ final class Field
             'maxLength' => $this->maxLength,
             'private' => $this->private ?: null,
             'default' => $this->default,
+            'from' => $this->from,
             'required' => $this->required ? null : false,
             'unique' => $this->unique ?: null,
             'label' => $this->label,

package/template/laravel/src/Support/Key.php

@@ -0,0 +1,57 @@
+<?php
+
+namespace Nevela\Laravel\Support;
+
+use Illuminate\Database\Eloquent\Concerns\HasUlids;
+use Illuminate\Database\Eloquent\Concerns\HasUuids;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Support\Str;
+
+/**
+ * Whether a string from an address could be a record's id at all.
+ *
+ * SQLite and MySQL answer "where id = 'nobody'" with no rows. Postgres checks the type
+ * first: an id column is a number or a UUID, 'nobody' is neither, and the query is an
+ * error, which reaches the visitor as a 500 where a 404 was meant. Inside a transaction
+ * it also aborts everything else in it. So an id is looked at before the database is
+ * asked, and one of the wrong shape is nobody's.
+ */
+final class Key
+{
+    /** A whole number that fits a bigint column. */
+    public static function isInt(mixed $id): bool
+    {
+        return is_scalar($id) && preg_match('/^[0-9]{1,18}$/', (string) $id) === 1;
+    }
+
+    public static function isUuid(mixed $id): bool
+    {
+        return is_string($id) && Str::isUuid($id);
+    }
+
+    /**
+     * Whether `$id` has the shape of this model's key: digits for a numbered key, and
+     * whatever a model with Laravel's UUID or ULID keys says is one of its own. A model
+     * with some other key of its own making is taken at its word.
+     *
+     * @param  Model|class-string<Model>  $model
+     */
+    public static function fits(Model|string $model, mixed $id): bool
+    {
+        $model = is_string($model) ? new $model : $model;
+        if (! is_scalar($id)) {
+            return false;
+        }
+        if (in_array($model->getKeyType(), ['int', 'integer'], true)) {
+            return self::isInt($id);
+        }
+
+        $traits = class_uses_recursive($model);
+
+        return match (true) {
+            isset($traits[HasUuids::class]) => Str::isUuid((string) $id),
+            isset($traits[HasUlids::class]) => Str::isUlid((string) $id),
+            default => true,
+        };
+    }
+}

package/template/laravel/src/Support/ListQuery.php

@@ -25,7 +25,17 @@ final class ListQuery
 
     public ?string $q = null;
 
-    /** @var list<array{field: string, column: string, value: string|int|float|bool|null}> */
+    /** The three things a record with a publish date can be. */
+    public const PUBLISHED = ['published', 'draft', 'scheduled'];
+
+    /** The filter that isn't a field: whether a record's address has been proved ("confirm"). */
+    public const CONFIRMED = 'confirmed';
+
+    /**
+     * A filter on the field a resource is published by carries `state` in place of a value.
+     *
+     * @var list<array{field: string, column: string, value: string|int|float|bool|null, state?: string, confirmed?: bool}>
+     */
     public array $filters = [];
 
     /** @param array<string, mixed> $params */
@@ -66,6 +76,24 @@ final class ListQuery
         foreach ($filters as $key => $value) {
             $param = "filter[{$key}]";
             $field = $resource->fields[$key] ?? null;
+            // filter[publishedAt]=draft: not a date to match, but which of the three it is.
+            if ($field !== null && $resource->publish === $key) {
+                $state = is_string($value) ? strtolower($value) : '';
+                in_array($state, self::PUBLISHED, true)
+                    ? $query->filters[] = ['field' => $key, 'column' => $field->column(), 'value' => null, 'state' => $state]
+                    : $query->issue($param, 'Must be one of: '.implode(', ', self::PUBLISHED).'.');
+
+                continue;
+            }
+            // filter[confirmed]=true: whether the address was proved, for a resource whose form asks.
+            if ($field === null && $key === self::CONFIRMED && $resource->public?->confirm !== null) {
+                $proved = is_array($value) ? null : filter_var($value, FILTER_VALIDATE_BOOLEAN, FILTER_NULL_ON_FAILURE);
+                $proved === null
+                    ? $query->issue($param, 'Must be true or false.')
+                    : $query->filters[] = ['field' => $key, 'column' => 'confirmed_at', 'value' => null, 'confirmed' => $proved];
+
+                continue;
+            }
             if ($field === null || ! $field->filterable()) {
                 $query->issue($param, "Can't filter by \"{$key}\".");
 

package/template/laravel/src/Support/PublicAccess.php

@@ -15,6 +15,17 @@ use InvalidArgumentException;
  * Nothing is open without it, and nothing beyond what it names: a resource with "read"
  * alone can't be written to, and a field that isn't listed is never sent or accepted.
  * Which records can be read is the model's to say, in its publicQuery scope.
+ *
+ * A form anyone can send is sent by bots too, so a create can say what stands in their
+ * way, and whether the address it is given has to be proved:
+ *
+ *     "create": {
+ *       "fields": ["email"],
+ *       "protect": { "turnstile": true, "honeypot": true, "minSeconds": 3, "email": "email" },
+ *       "confirm": "email"
+ *     }
+ *
+ * See Forms\FormGuard for the checks, and Forms\Confirmation for the link.
  */
 final class PublicAccess
 {
@@ -23,11 +34,19 @@ final class PublicAccess
 
     public const CREATE_THROTTLE = '10,1';
 
+    /** What "protect" can turn on. */
+    public const CHECKS = ['turnstile', 'honeypot', 'minSeconds', 'email'];
+
+    /** The longest a form can be made to wait before it is sent, in seconds. */
+    public const MAX_SECONDS = 3600;
+
     /**
      * @param  list<string>|null  $read  The fields anyone may read, or null when nothing may be
      * @param  string|null  $by  The unique field one record is fetched by, in place of its id
      * @param  list<string>|null  $create  The fields anyone may send to create a record, or null when nobody may
      * @param  list<string>  $middleware  More middleware for these routes: the app's own spam checks
+     * @param  array{turnstile: bool, honeypot: bool, minSeconds: int, email: string|null}|null  $protect  The checks a create passes before it is looked at, or null for none
+     * @param  string|null  $confirm  The field holding an address its owner has to prove, by a link sent to it
      */
     public function __construct(
         public readonly ?array $read = null,
@@ -36,6 +55,8 @@ final class PublicAccess
         public readonly string $readThrottle = self::READ_THROTTLE,
         public readonly string $createThrottle = self::CREATE_THROTTLE,
         public readonly array $middleware = [],
+        public readonly ?array $protect = null,
+        public readonly ?string $confirm = null,
     ) {
         foreach ([$readThrottle, $createThrottle] as $throttle) {
             if (! preg_match('/^[1-9][0-9]*,[1-9][0-9]*$/', $throttle)) {
@@ -50,6 +71,43 @@ final class PublicAccess
                 throw new InvalidArgumentException('Public middleware is named as in a route: "honeypot", or "throttle:5,1".');
             }
         }
+        if ($protect !== null && ! $protect['turnstile'] && ! $protect['honeypot'] && $protect['minSeconds'] === 0 && $protect['email'] === null) {
+            throw new InvalidArgumentException('"protect" turns nothing on. Give it "turnstile", "honeypot", "minSeconds" or "email", or leave it out.');
+        }
+        if ($protect !== null && ($protect['minSeconds'] < 0 || $protect['minSeconds'] > self::MAX_SECONDS)) {
+            throw new InvalidArgumentException('"minSeconds" is how long a person takes to fill the form in: between 0 and '.self::MAX_SECONDS.'.');
+        }
+    }
+
+    /** Whether a create has checks to pass. */
+    public function protected(): bool
+    {
+        return $this->protect !== null;
+    }
+
+    /**
+     * "protect" as it is written, made whole: every check said yes or no to.
+     *
+     * @return array{turnstile: bool, honeypot: bool, minSeconds: int, email: string|null}
+     */
+    private static function protection(mixed $given): array
+    {
+        if (! is_array($given)) {
+            throw new InvalidArgumentException('"protect" lists the checks to make: { "turnstile": true, "honeypot": true, "minSeconds": 3, "email": "email" }.');
+        }
+        if (($unknown = array_diff(array_keys($given), self::CHECKS)) !== []) {
+            throw new InvalidArgumentException('"protect" has no check called "'.reset($unknown).'". There are: '.implode(', ', self::CHECKS).'.');
+        }
+        $seconds = $given['minSeconds'] ?? 0;
+        if (! is_int($seconds)) {
+            throw new InvalidArgumentException('"minSeconds" is a whole number of seconds.');
+        }
+        $email = $given['email'] ?? null;
+        if ($email !== null && ! is_string($email)) {
+            throw new InvalidArgumentException('"email" in "protect" names the field that holds the address.');
+        }
+
+        return ['turnstile' => ($given['turnstile'] ?? false) === true, 'honeypot' => ($given['honeypot'] ?? false) === true, 'minSeconds' => $seconds, 'email' => $email];
     }
 
     /** @param array<string, mixed> $data */
@@ -65,6 +123,8 @@ final class PublicAccess
             (string) ($read['throttle'] ?? self::READ_THROTTLE),
             (string) ($create['throttle'] ?? self::CREATE_THROTTLE),
             array_values((array) ($data['middleware'] ?? [])),
+            isset($create['protect']) ? self::protection($create['protect']) : null,
+            isset($create['confirm']) ? (string) $create['confirm'] : null,
         );
     }
 
@@ -80,6 +140,9 @@ final class PublicAccess
             'create' => $this->create === null ? null : array_filter([
                 'fields' => $this->create,
                 'throttle' => $this->createThrottle === self::CREATE_THROTTLE ? null : $this->createThrottle,
+                // Only what is on, so a descriptor reads as it was written.
+                'protect' => $this->protect === null ? null : array_filter($this->protect, fn ($v) => $v !== false && $v !== 0 && $v !== null),
+                'confirm' => $this->confirm,
             ], fn ($v) => $v !== null),
             'middleware' => $this->middleware ?: null,
         ], fn ($v) => $v !== null);
@@ -120,6 +183,18 @@ final class PublicAccess
                 throw new InvalidArgumentException("{$resource}: a record is fetched by \"{$this->by}\", which has to be a unique field ({$this->by}:slug!).");
             }
         }
+        if ($this->create === null && ($this->protect !== null || $this->confirm !== null)) {
+            throw new InvalidArgumentException("{$resource}: \"protect\" and \"confirm\" are about a public create, and there isn't one.");
+        }
+        foreach (['protect.email' => $this->protect['email'] ?? null, 'confirm' => $this->confirm] as $what => $named) {
+            if ($named === null) {
+                continue;
+            }
+            // The address has to be something a visitor types into the form.
+            if (! in_array($named, $this->create ?? [], true) || $fields[$named]->kind !== 'string') {
+                throw new InvalidArgumentException("{$resource}: {$what} names \"{$named}\", which has to be a text field the public create lists.");
+            }
+        }
         if ($this->create !== null) {
             foreach ($fields as $field) {
                 // Left out of the form, a field needs something to be: nothing, or a default.

package/template/laravel/src/Support/Slug.php

@@ -0,0 +1,43 @@
+<?php
+
+namespace Nevela\Laravel\Support;
+
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Str;
+
+/**
+ * A slug nobody typed: made from another field, and made different from every one
+ * already in the table.
+ *
+ * "Opening day" is `opening-day`; the next post of that name is `opening-day-2`. Records
+ * in the trash are counted, because they still hold their value and can come back with it.
+ */
+final class Slug
+{
+    /** Room left at the end of the column's 255 for the "-12" that makes one different. */
+    private const LONGEST = 240;
+
+    /**
+     * @param  array<string, true>  $taken  Values spoken for that the table doesn't hold yet: earlier rows of the same batch. The one returned is added.
+     */
+    public static function free(string $table, string $column, string $from, array &$taken = []): string
+    {
+        $base = Str::limit(Str::slug($from), self::LONGEST, '');
+        // A title with nothing a slug can keep (all symbols, say) still needs an address.
+        $base = trim($base, '-') !== '' ? trim($base, '-') : 'untitled';
+
+        $held = $taken;
+        // Straight from the table, past the model's scopes: a record in the trash holds its slug too.
+        foreach (DB::table($table)->where($column, $base)->orWhere($column, 'like', $base.'-%')->pluck($column) as $existing) {
+            $held[(string) $existing] = true;
+        }
+
+        $slug = $base;
+        for ($n = 2; isset($held[$slug]); $n++) {
+            $slug = "{$base}-{$n}";
+        }
+        $taken[$slug] = true;
+
+        return $slug;
+    }
+}

package/template/laravel/src/Trash/Trash.php

@@ -102,7 +102,9 @@ final class Trash
     public static function purge(Model $record): bool
     {
         try {
-            $record->forceDelete();
+            // In a transaction of its own. Called inside another, that makes it a savepoint:
+            // on Postgres a refused delete would otherwise abort everything around it.
+            $record->getConnection()->transaction(fn () => $record->forceDelete());
 
             return true;
         } catch (QueryException $e) {

package/template/web/.env.example

@@ -1,2 +1,6 @@
 # Where Nevela's routes live in the Laravel app (apps/api), including the prefix.
 NEVELA_API_URL=http://127.0.0.1:8000/api
+
+# Cloudflare Turnstile's site key, for a public form whose descriptor asks for the robot
+# check. Its secret key goes in apps/api/.env as TURNSTILE_SECRET_KEY.
+# NEXT_PUBLIC_TURNSTILE_SITE_KEY=

package/template/web/app/api/[...path]/route.ts

@@ -18,7 +18,7 @@ import { API_URL, callerHeaders, sessionToken } from "@/lib/laravel";
  *
  * And for a site's visitors, who have no session: what a resource's "public" section
  * opens (`/api/public/…`). Reading it, a form's create (`POST /api/public/<slug>`) and a
- * file for that form (`PUT /api/public/_nevela/uploads/<Resource>/<field>`) go through
+ * file for that form (`PUT /api/public/<slug>/_uploads/<field>`) go through
  * with no token. Laravel has those routes only for resources whose descriptor opens them.
  */
 export const dynamic = "force-dynamic";
@@ -104,8 +104,11 @@ export async function POST(request: NextRequest, context: Context) {
 export async function PUT(request: NextRequest, context: Context) {
   const { path } = await context.params;
   const url = target(path, request.nextUrl.search);
-  // A visitor's file for a public form: /api/public/_nevela/uploads/<Resource>/<field>.
-  const forVisitor = path.length === 5 && path[0] === "public" && path[1] === "_nevela" && path[2] === "uploads";
+  // A visitor's file for a public form: /api/public/_nevela/uploads/<Resource>/<field>,
+  // or by the form's own address, /api/public/<slug>/_uploads/<field>.
+  const forVisitor =
+    path[0] === "public" &&
+    ((path.length === 5 && path[1] === "_nevela" && path[2] === "uploads") || (path.length === 4 && !path[1].startsWith("_") && path[2] === "_uploads"));
   if (!url || !(forVisitor || (path[0] === "_nevela" && path[1] === "uploads"))) {
     return Response.json({ error: "Only uploads are sent this way. Records are saved through the dashboard." }, { status: 405 });
   }

package/template/web/app/confirm/page.tsx

@@ -0,0 +1,51 @@
+import Link from "next/link";
+import { AuthShell } from "@/components/auth/auth-shell";
+import { laravel } from "@/lib/laravel";
+
+export const metadata = { title: "Confirm your address", robots: { index: false } };
+
+/**
+ * Where the link in a confirmation email leads: a list someone joined through a public
+ * form whose descriptor has "confirm". Opening it proves the address is theirs.
+ *
+ * Laravel made the link and Laravel checks it. This page passes on what the link
+ * carries and says how it went. To send people somewhere of your own, change what is
+ * shown here, or point nevela.public.confirm.path at another page that does the same.
+ */
+export default async function ConfirmPage({ searchParams }: { searchParams: Promise<{ list?: string; id?: string; key?: string }> }) {
+  const { list = "", id = "", key = "" } = await searchParams;
+  // Only what a link of ours looks like is passed on.
+  const wellFormed = /^[a-z0-9][a-z0-9-]{0,80}$/.test(list) && /^[A-Za-z0-9-]{1,40}$/.test(id) && /^[a-f0-9]{64}$/.test(key);
+
+  let confirmed = false;
+  let unreachable = false;
+  if (wellFormed) {
+    try {
+      const response = await laravel(`public/_nevela/confirm/${list}/${id}/${key}`, { method: "POST", token: null });
+      confirmed = response.ok;
+      unreachable = response.status >= 500 || response.status === 429;
+    } catch {
+      unreachable = true;
+    }
+  }
+
+  const [title, subtitle] = confirmed
+    ? ["You're confirmed", "Thank you. Your address is on the list."]
+    : unreachable
+      ? ["We couldn't check that just now", "Nothing is wrong with your link. Open it again in a moment."]
+      : ["This link is no longer good", "It may have been used too late. Sign up again and we'll send a new one."];
+
+  return (
+    <AuthShell
+      title={title}
+      subtitle={subtitle}
+      footer={
+        <Link href="/" className="font-medium text-link hover:underline">
+          Back to the site
+        </Link>
+      }
+    >
+      {null}
+    </AuthShell>
+  );
+}