-Hey. I'm Michael Dyrynda. -And I'm Jake Bennett.
And welcome to episode 183 of the North Meet South Web Podcast.
Hello, friends. It is once again that time of the week. It is Monday
night, and, uh, it's dark out. And it's been dark for, like, the last five
hours. I'm not digging this thing. And the thing is, I know it's gonna get even
worse because
shortly they're gonna change the time to be an hour... It's gonna start getting
-dark at, like, 4:00 instead of 5:00. -Mm-hmm.
Oh, I just hate this time of year. No fun, dude. No fun.
-Are you- -And y-
Are you getting rid of daylight savings? Is that what's happening?
-Uh, you know what, man? -Or is that still-
I feel like they've been put... I feel like they've been teasing us with this for
-forever. -Right. Yeah, yeah.
I really wish they would, uh, but I don't know if they are. I don't know. I feel
like last year was like, "This is the last year they're gonna do it." And then it
was like, "Ah, psych," or something. I don't know. We'll find out.
-Yeah, okay. -We'll find out soon enough.
-Find out when it happens -But I don't know.
So I guess we... Not this weekend, next weekend, daylight saving starts here. So
we're, you know, the day is already getting longer. It's bright when you wake
-up. -Yup, yup.
It's bright longer into the evening. So it's
good for us because, you know, obviously it means you can get up a bit earlier and
-there is some sunlight. -Yeah.
And you finish work at the end of the day, and there is still sunlight, so.
-Absolutely. Great. -But it has been, has been raining, which
is, has made it difficult. Last episode we talked about my adventures with, uh-
-Hay fever -... LawnHub. And well, hay fever, yes, but
-LawnHub. -Mm-hmm.
And I had to, had to go out and spray the weeds. And it says you're not supposed to
do that if there's going to be rain within four hours. And when-
-Ah -... I'm planning this ten days in advance,
it's very hard to tell if there's going to be rain.
-It is. Yes. -Because even if they can predict ten days
-in advance, it's never correct. -Not n- Yeah, exactly. Exactly.
So, you know, I, I got up on that day, and I look outside, and I'm like, "It doesn't
look like it's gonna rain." And then I went for a, a run in the morning, or I
went for a walk in the morning, and, and I got rained on. And I thought, "Okay,
well, this has not bode well." And then I, I waited a bit and there was no rain. And
I, I checked the, the forecast, and it said there's no rain due until, you know,
three o'clock in the afternoon. This is 10:00 in the morning. I'm like, "Okay, I'm
gonna go out, and I'll spray the weeds now." And I got almost finished, and it
-started raining. -Ah.
-You know, 30 minutes later, I'm like- -Oh my gosh. Pointless.
-Come on. -I just wasted all that stuff.
-Come on. -Yeah.
But, uh, it, it seems to have worked though, 'cause I went out the next day and
all of the, the weeds that I had sprayed had started-
Yeah, but it'll still be at least, like, partially effective
-... drooping and stuff, so. -Yeah. Yeah, it'll be fine. It'll be fine.
So yeah, the next one is in, in 14 days when I have to go out and spray the actual
fertilizer on the lawn, will be interesting. So I'm gonna, I'm gonna see
if I can go and hire a dethatcher or a scarifier-
-Oh, yeah -... whatever you call it-
-Yeah, sure. Mm-hmm -... to go and, like, pull up all of the,
the deadness from the surface of the, of the-
-Yep -... lawn before I then go and put down the
fertilizer. And, and hopefully that will help to rejuvenate it. So-
Are you gonna, are you gonna aerate the soil too? You gonna pile out, pull out the
-plugs and all that stuff? -Mm-mm. No, I'm probably-
Dude, you're gonna become one of those lawn guys?
No, I'm probably not gonna go that far. The scarifier I would do because it's,
like, you know, a machine that you can hire that goes through and does it.
-Yep, yep. -But anything that involves too much manual
labor is something that I'm not that interested in, so.
-Mm-hmm. -I have... Like, if, as long as I fertilize
the lawn, it tends to come up okay. It's when it starts to get cold and wet, and I
go, "I'm not gonna go out there and mow the lawn," 'cause it just turns to mush,
-right? -Yeah. Yeah, absolutely. Uh-huh.
And so, you do that once, and then before you know it, the weeds grow, you know-
-Yep, yep, yep -... as high as your knees. And then you go
and, and then you've gotta go and mow it, like, four times just to get it down to
level. And by that point, it's too late, and it's just turned into weeds. So
-I'm hoping it should be okay. -Hey, speaking of Scarify,
speaking of Scarify, Halloween is around the corner.
Yeah.
-We're transitioning- -Do you guys do Hallow-
-No -Do you guys do Halloween? Do you guys do
-Halloween? -No, although we've been invited to a, a
-Halloween birthday party, which I'm- -Oh, that sounds fun.
Yeah. So
for, for, uh... How old is he? Uh, uh, uh-
-Nine. -I can't remember if this is the older
-child or the younger child. -Eli's hanging out with the older kids
these days. He's moving on up.
Yeah. Yeah, he certainly is. Yeah. I am... It occurred to me that we were, we... One
of the kids from school that lives, like, two doors down, he's in the, the year
above Eli. And, um,
we went around... With, with them, we went to the park. We had, like, a kick of the,
the soccer ball, we played a bit of basketball, we pushed some kids on the
swings. It was, it was a good bit of fun. But one of the other kids was there, plays
in Eli's soccer team. And I was trying to put two and two together, like, how, how
is this child friends with the older kid when he plays in Eli's soccer team?
-Yeah, sure. -And it took me a while to realize that he
is actually an older kid
-playing- -Ah, okay
... down a grade in soccer. So he is in, in the older kids' year level, so.
-That's fun. -But, uh-
-Yeah. -You know, they played, they played
together for two terms before I realized this.
-That's fun. -So-
Yeah, no. It's good, probably good for Eli to play up with, like, a little bit older
-kids and stuff. -Mm-hmm.
And yeah, I'm sure he gets... You know, it's like you play to the level of your
competition or of your teammates, I suppose.
-It's, uh, yeah. -And so you probably get better as you
play. Yeah. So we, um... Harrison had a soccer game this last Saturday and scored
two goals. He was practicing his hat trick dance if he got three goals.
-Ah, yes. If he gets three, yeah. -And so he, yeah, he had it all planned
out. Oh, he was... He wanted it so bad. He had a couple, like... He got two goals
-and then he- -Mm-hmm
... kicked a third. It was high, it had a lot of, like, spin on it. Like, hit right
in front of the goal and bounced backwards.
-Yeah. -Like, uh, did not go into the goal. Yeah.
-Then he had a couple of those. Anyway- -Good.
It was fun. He almost made it. It was, it was the last game of the season, so it was
-like his last chance- -Mm-hmm
... to get it. But no, it was, it was all fun. All fun. Um, yeah. Okay. I've... You
know, when we started this, this show we're like, "What should we talk about?"
Well, I've got a couple things. First of all, um, have you ever seen these 1Up
Arcade boxes? So, like, they're, like, not a full arcade cabinet, but, like, it's,
th- they're like mini arcade cabinets, if you will. So, like, 1Up Arcade, Street
Fighter, they've got whatever. So David Hemphill and I are big into Street
Fighter. We played, uh, Street Fighter when we were at Lari: Con this year. That
-was fun. Um- -Mm-hmm.
But I always wanted a little Street Fighter box. And so I found one on
Facebook Marketplace, this guy was selling it for, like, 100 bucks. I'm like, "Why
is he selling it for ch- so cheap?" Well, turns out he was trying to convert it to,
like, a RetroPie.Which is like a Raspberry Pi with, like, the software...
-Mm-hmm -... installed on it that allows you to
download ROMs and then use all the stuff. So he had done all the conversion on it.
Like, where you have to swap out all the buttons, you have to buy this, like, LCD,
um, converter that will hook it up to the port. He bought all the parts, had done
all the things, and could not get the last step. Could not get it to work, just
didn't have the chops,
and so... Or so I thought. And so I was like, "Well..."
-Mm-hmm. -"...I'll figure this out, no big deal."
Well, no, it's been sitting in my basement for two months and I have not been able
to get it to work. And then I rewatched a couple tutorials and realized there was a
ribbon cable that was flipped around the opposite way.
-Wow. -Turned it around, plugged it in. That was
it, dude, I was, I was off and running. And so that's been so fun, been playing
-with that, like- -It's wild they did something so simple.
-Oh, seriously. I mean, it's just- -But yeah, I suppose if you, if you flip
-the pins, then it's, uh... -Yes.
But, uh, you know, this is why, uh, PC cases have always had the little notch so
that you could never get it the other way around.
-Yes. Yep, not this- -Because you don't wanna s-
-... not this one. -You don't wanna r- yeah, you don't wanna
-reverse, uh- -Yeah, polarity order, yeah
... electricity going to the motherboard, huh?
Exactly. And so anyway, dude, that's been so fun, and it's a really fun little,
like, hobby project. Now, the cool thing is, like-
-Mm-hmm -... I didn't have to pay $400 for it. I
paid, like, 100 bucks for it, and then half was already bought.
-Yeah, it's pretty good. -So yeah, it's, it's been a little, it's
been a lot of fun just playing around with that. Me and Harrison played some Street
Fighter today, and we both like that game, and so... Yeah, that's been pretty cool,
so I would suggest that as a fun little hobby to anybody if they're interested.
There's, uh, there's some cool little mods you can do out there with it and it's,
-it's pretty fun, so that's been cool. -All right.
-Um, yeah. -I can, we can buy these things here, uh-
-Nice, yeah -... Mortal Kombat, Mortal Kombat Deluxe...
Yes.
Arcade machine has 14 games, Mortal Kombat 1,
2, 3. There's some other Mortal Kombat and a few other random games on there,
-thousand bucks, plus delivery. -Yeah.
-All right, good times. -Yeah. Yep. So this is almost... Yeah
-Lose that before I spend money. -The- the pri- yeah, exactly. The price was
right. Like, it was, it was way cheap, and I was...
-Mm-hmm. -"Yeah, I'll try this out." So that's been,
-that's been kind of fun... -Yeah
... to just mess around with but, and finally got it working.
-Love it. -Um, the other thing that I wanted to talk
about though is
we've talked a lot about the permissions stuff, right?
-Mm-hmm. -And so I- I wanna, I wanna sorta share the
saga with you, if I can. Um,
so we talked originally about how we went through all of our applications, and
previously we only had roles, and we replaced any place where we are checking a
role with a named permission. So instead of saying has role admin or has role
manager, we would say, "Nope, what are we trying to do in this place? Oh, we're
trying to edit a blog post. Okay, so we're gonna replace that with a check to say
permission enum
-edit blog post." Right? -Mm-hmm.
-That's- that's what it was. Um- -Yeah
... and then we used attributes to associate active directory group, security
group names with those permissions, and then in active directory we just set those
permissions, or we set those groups, those security groups on the particular
users that need those things. It works great. Works really, really well.
-Yeah. -It's pretty cool.
-I think. -We've had some other interesting solutions
around that. Okay, that's the, that's that side of it.
Um, now, the question has been, where do we do those permission checks? And all
we're doing with those permission checks is we're just doing gates, right? We're
-setting up gates... -Yeah
... um, so that you can use Laravel's default can. You have can middleware, you
-have a can directive, you have... -Mm-hmm.
You know, this authorize that you can use inside of the controller if your
controllers are auth- y- you know, using the authorizable trait. Um, you can do it
inside of a form request, you can do it, you know, a bunch of different places.
-Yeah. -Um, you can, uh,
you know, you could just use the gate facade. There's all sorts of ways that you
can do this, right? And so the way that we had previously done it, like, as our
first step is we just replaced any of the middleware checks, um, in our routes file
with can middleware checks, and, uh, I mean, totally fine.
But that sort of broke down a little bit. Um, we ended up having to, like, rearrange
-how our routes files were set up, and... -Yeah.
... you'd end up having to, like, break apart different pieces, um, based on-
-Just to get the granularity. -Exactly. And so, like, you'd have a route
file that would belong with another one, like, co-located with it that would have
to be, like, further down, and then ended up being like, there'd be a merge conflict
and somebody, like, fixed the merge conflict but they accidentally moved one
-out of that group. -Yeah, yeah.
And so now it was without permissions because, you know, it's just, like, in the
-routes file, and so- -Yeah
... I was like, "We can't do that anymore." Um...
-Mm-hmm. -We- we've gotta... It- it just did not
feel like it was close enough to the metal. It just felt like it was so s- sort
-of, like, out there and removed. -Yeah. Yeah.
Um,
and so, um, so first off, like, do you identify with that at all? Like, do you
feel that? Like, do you ever feel like if you're doing a- a middleware check or a
can check out at the edge there on the routes file, does that ever make you feel
a little bit like, "Eh, feels a little too fragile"?
I don't know off the top of my head anywhere where we are doing
an authorization check in our routes file.
-Okay. -Like, maybe very high level, but- but
-nothing granular. I think all of that- -Sure
-... granularity... -Like, are... yeah. Sure, like-
... all those authorization checks will push down into a form request or into,
like, an action class if we wanna enforce that behavior deep into the- the business
rules of that behavior.
But- but typically, it'll be in- in the authorize method of a
form request or inside of, like, an a-
an action class,
-somewhere where we're authorizing that. -Okay. So that l- that brought me to my
next step, which was, okay, so if we're not gonna do it in the middleware, we
have, uh, we can- we can do it inside of each controller, uh, method.
-Mm-hmm. Mm-hmm. -Right? So if we're using resourceful
controllers, um, we can just do a
-this authorize, um... -Yeah
... or request authorize or whatever it is, this authorize, and that's gonna pass
in the user, and then you can just pass in the permissions check, which is fine.
That- that works great. But
it's, like, I sort of hate having to have those at the top of every controller
method. It sorta sucks. And so you have some options, right? Um, one option that
was really interesting and attractive to me was that if you're dealing with a
resource, like a blog post, for example, instead of having to put that in every
single method...Um, this gate check, this authorize check, in the constructor you
could say, "This authorize resource," and then you could point it at the policy that
you had created, if you created a policy, like a post policy.
-Mm-hmm. -And then you could do your, your gate
checks in there. So inside of that, you could just kind of say, you know, um,
"Here are the different a- view any, view, edit, update, whatever."
-Mm-hmm. -And you would just say, "Authorize
resource, here's the policy," and it would automatically apply the correct policy
check to the proper method, which was amazing.
-Yeah. -I was like, "This is great." Okay, so
we're gonna move everything to policies now.
-Mm-hmm. -Everything to policies, and then we'll do
our, you know, our permission checks inside of those policies so we know like,
okay, you go to the controller, the controller's gonna have an authorize
resource. And then at the top you're gonna click through that, and that's gonna get
you to your policy. And the policy is gonna define the, the different, you know,
permissions that they need in order to be able to do these things. Very well
organized, very clean, super nice, loved it.
-Yeah. -And then Laravel 12 came along.
And Laravel 12 basically nukes all of that.
-Mm-hmm. -It does not use the authorize resource
anymore, it is not in the docs anymore, and
now it's back to, and all the docs recommend using
Gate.dodop.authorize inside of every controller method.
-Mm-hmm. -And I'm just like, "I hate this.
I really-" "...hate how it looks." And so I know-
-Mm-hmm -...what you're saying is you just use a
-form request in that case, right? -Yeah.
If you want to, if you want to do that authorization check, you're just gonna
say, "I am, I am going to do that inside of a form request
for every method inside of all those controllers," right?
-Yeah. -Um, is that accurate? Is that how you
-would do it? -Yeah. And we, we also typically use a lot
-of single action controllers because- -Mm-hmm
...we are not, like we're not building a crud, cruddy app really. Um-
-Yeah -...we have lots of components, and
components make requests to specific routes.
-Endpoints, yeah, sure. -Endpoints that are responsible for doing
particular things. So yeah, we, we will typically have an action that is called,
uh, from a controller that is, um,
past a, a request object which is responsible for doing the authorization.
And whether, you know, whether it's a, a get endpoint or an index endpoint where
like, some things don't need to be authorized, and so the authorize method of
-that form request will just return true. -Yeah, sure.
But there will be some index methods where we do need to do tho- those checks in
there. And so we will do the authorization inside of, you know, a otherwise empty
form request. But it gives us, you know, extra files around the place, but they are
consistently named and consistently located. So if we have like a, a
user index controller, for example, then we would also have a user index request
that goes in, you know, the, the request folder or whatever. But if you are using
your fuzzy, fuzzy finder in your editor, you're going to type, you know, user index
and you will see the request and the controller there, uh, next to each other.
So it's easy enough to find 'em. And then you'll also have the user index action
perhaps. Um, and so all of this stuff, because it's, it's got like a
s- a common prefix, it all comes up when you're searching for it. Um,
your mileage may vary depending on whether or not you'll, you're navigating the file
-tree or if you're using fuzzy find. Um- -Sure, sure
...you know, obviously as a VIM user, my hand's on the keyboard so, uh-
-Yeah, yeah -...it's, it's more common that I will find
things that way. Um, and that also then extends to tests, like if you've got a
user index test, for example, um, or a user index controller test, whatever you
wanna call it, all of these things will appear, you know, at the top of your
search anyway. So
it makes it easier from that perspective to locate things rather than having to
traverse the directory tree to look in like a request folder or a controllers
folder or wherever else. It's all just there. Um, so yeah, more files but
they're, they're typically very small files,
but it also then allows us to co-locate that behavior where it makes the most
-sense. You know, requests- -Yeah
...and authorization kind of go together. Controllers are really
just for delegating, you know, taking some data, passing it to some action and
returning some response. But they're, they're typically, you know, no more than
five or six lines long.
Right. Yeah, and I think, I think for me, I get it, like I get... I'm not
necessarily so concerned with
making a new form request for every single thing, although it does sort of suck,
honestly. Um, and I think it's just because it's like, how many levels of
indirection do I have to have before I finally get down to the thing? You know
-what I mean? -Mm-hmm.
'Cause it's like the reason we organized it around policies is because we were
like, "Okay great, we're gonna treat them as resources." Okay, so now we have
-policies. -Mm-hmm.
Wonderful. But now it's like we're sort of saying, well, I mean maybe it's a policy
but we're basically gonna have a form request for every single one of them
every, anyway, so what's the point of having the policy?
-Mm-hmm. -Like, now the pol- so, so now I go
route controller, method, form request, authorize, policy, then permission?
-Mm-hmm. -I mean, holy crap.
-Mm-hmm. -That's like seven layers of indirection to
-get down to the actual- -Yeah
...permission check. It's crazy. And so it's like, if you're gonna do that, if
you're going to do a form request, it almost feels like you could do without the
-policy, um, because- -Mm-hmm
...like, I don't really, I'm not using it almost anywhere else-
-Yeah -...except for in the controller. And so-
-Yeah -...you know, if I'm going to create the
form requests, I almost don't wanna create the policies because-
-Yeah -...I don't wanna do one more layer.
Yeah. It also depends. Like if you're very
resource-centric as it seems to be that you are, then, you know, the policies-
-I mean, sometimes it's- -...do make sense. But we, we definitely
err on the side of
not having resources. Like we're not updating people and businesses and
addresses and things like that as commonly as we are adding a person to application
or add address to person or, you know, all of this kind of stuff where these actions
kind of dictate what's happening.So, um, and so whether or not you have access to
do that action is kind of decoupled from the resource itself. Whereas
you, because you've got the policies and that kinda stuff, you're- you're more
leaning towards that side of things,
so it probably makes more sense to use the policies. Um, but I still think, you
know, the form requests just make a- a consistent... Yeah. Yeah, it's seven
layers and it's more things, et cetera, but it's always gonna be in the same
place. You don't have to stop and think, "Oh, hang on. This is an index method.
Where do I authorize this now?" No, it just goes in the form request.
-Yeah. -Like-
-Mm-hmm -... yes, extra file, yes, extra location.
Potentially, like, if you're doing the policy and, you know... But it, but it
means that you can guard those things directly as well, using the policies.
Yeah.
-Um, where- -I guess that's-
... you're not necessarily encapsulating business logic behind
-a request or an action or whatever else. -Yeah. Okay, so here's the last piece with
the form request thing. So, like, there will be... So there are places where we do
have more intensive sort of policy logic. So for example-
-Mm-hmm -... I'll have, like, a coaching entry,
right?
And for that, a coaching... And, like, if somebody... The ability to be able to view
a coaching entry depends on if it is... Like, if the person that's logged
in, if their user ID is the person that is, like... They're the coachable team
-member ID- -Mm-hmm
-... or something like that, right? -Mm-hmm.
They're the person who's being coached. So if it belongs to them, they can see it.
Or if it is a person who directly manages them. So if they're anywhere within... So
indirectly or directly manages them. So if they're anywhere in the tree of that
-person's- -Mm-hmm
... purview, they can be seen, right? Where does that live? That has to live
inside the policy. That's the logical place for it to live.
-Mm-hmm. -My question is,
if I'm doing that, um, does the... So, like, let's say the, uh, the view
coaching entry request, right? Or is it coaching entry view request? Which one is
it? Coaching entry show request? Is that what you'd call it?
Yeah, it's show coaching entry request, I think.
-Okay. So verb and then model and then- -Mm-hmm. Mm-hmm. Yeah
-... yeah? Okay. -Yeah.
So show coa- so show coaching entry request. If I do that, um-
-Mm-hmm -... does the show coaching entry request
authorize the method, have access to the ID or to the currently hydrated, eager
loaded, um, model binding, right? Does that make sense?
Uh, like, yeah, for the, like, for the relate, for the related entry.
Right. So, like, so when you do, you know, you have implicit route model binding,
-right? -Mm-hmm.
So, like, it will, it will automatically pull the ID. You know, it says, "Here's
-the ID." -Yep.
Uh, "I'm going to go ahead and grab that particular type hinted model out of the
-database," or "I'm gonna 404." -Mm-hmm.
And then you use that in the policy to then check against, is this current, you
know, is this current, uh, coaching entry? You know, you inspect it, basically, to
determine if the person who's currently logged in can see that thing or not.
-Yeah. -So my question is, does the authorize
method have access to that particular model? So that when I'm saying, uh, this
arrow authorize post class, comma, or- or just say, like, view, comma, and then I
-pass in that particular post. -Yeah. Well, the- the route model binding
stuff is done
up the stack and then passed down into the request. So you do have access to the
route and all of its bound parameters at that point. Yeah.
So, yeah, like, in the controller, typically you have, like, the way that the
implicit route model binding works is in the controller you have request, you know,
type entered request, dollar sign request, comma-
-Mm-hmm -... type entered coaching entry, dollar
-sign coaching entry. -Mm-hmm. Yeah.
-Right? -Yeah, yep.
And then in the controller, you have access to that thing. So what I'm saying
is I don't know how to get access to the coaching entry, dollar sign coaching
entry, from the authorize method, 'cause I would need that-
-Yeah, and- -... in order to be able to do my policy
check.
Yes. La- uh, so typ- previously, you'd have to do, like, this route and then pass
-it the, the string name. -Mm-hmm.
I think in Laravel 12, they introduced the thing so you can use an attribute to then
bind that directly out of the route. So you can... I think it's pound square
bracket route, and then give it the thing, and then you can actually inject a
properly typed, um,
class or instance there so that you will get the completion and you'll get all of
that stuff there, and Laravel will then handle injecting that from the request
-automatically. From- from the route- -Because doesn't that feel like... So if
I'm just, I- I'm- I'm discovering the solution here with you. I'm talking it
-through- -Mm-hmm
... because I'm interested in- in how it kinda does work. To me, it feels a little
bit gross that, like, I have it type entered inside the controller. Like, and I
know the name of it, I know the variable and all that stuff, but the form request
-does not have that. -Mm-hmm.
You know, it doesn't know. It doesn't have any idea of that route model binding
thing. It doesn't know. And so
it's like I have to either, you know, duplicate that inside of the form request
or I have to somehow pass it in. I just, like, I'm wondering, you know, what is
Team Laravel doing for this? Like, it seems like this is not
how I- I would think that it would be done. Like, it just-
-Yeah -... it seems too chaotic. I just, I'm
like, "Who..." There- there's gotta be a way. There... Either there's, A, they're
doing it a certain way that they're not super stoked with, um, and they're just
sort of doing it. Or, B, they're doing it a different way that I'm completely
unaware of. Or,
C, I just don't like it and they don't give a crap. They don't care at all.
-Mm-hmm. -It's fine. It's fine for them. You know
-what I mean? -Yeah. Nuno, I think Nuno was posting
something about this the other day. I saw a screenshot. So they're just calling
request validate, um... Oh, no, this is the MCP Tools thing. I'm sure I saw that
he tweeted somewhere.
In Laravel MCP, tools, prompts, and resources share the same API request
handle response. Similar to controllers in Laravel, you can validate input, dispatch
actions, and more.But this is calling request validate, this is not talking
about authorization.
I'm, yeah, I'm, I'm certain in one of Nuno's, um, streams or videos that he
posted, he did talk about how he goes through this. Which I assume would be very
similar to how they're doing it, uh, in Laravel Cloud at the very least, 'cause he
had a heavy hand in, in the architecture of that platform. So, um, it would
definitely be good to, to gauge
some... 'Cause I know that, you know, you brought this up in, uh, in Cash Money,
-and, and David- -Yeah
... David Hemphill and I, we've, we're very much aligned in this in terms of, um,
you know, using form requests for everything, and, and handling
-authorization that way, so... -So, so-
-I think- -Like-
... I think this is where it kinda comes down to, you know, there are many
different ways of doing these things in Laravel, and it, and it varies case by
case, app by app. Um, you know, some things make sense in some context that are
different in others. Uh, and it's hard to find, like, the one prescribed way of
-doing it. -Yeah.
-Um, but yeah, I know- -I just, I just wanna be consistent, and it
-just- -Yeah.
Every time I feel like I've got it nailed down, there's, like, some weird edge case
-thing that's like, "Oh-" -Mm-hmm.
"... except for that, then you have to do it a different way." And I'm like, "No-"
-Yeah. -"... dang it all, I don't wanna do it a
-different way. I wanna do it-" -Yeah.
"... the same way every time." Like, and it just feels like I can't find that way.
I thought I had. I though- I did, I actually did have it. When I had that
authorized resource thing, it was working perfectly. Now I, now it's, now I can't.
-It's, it's- -Yeah, I mean, that's-
-I'm screwed. -That's gone from
the controller, because the base controller is gone, but you can still use
the trait directly if you wanted to. You can, I mean, you can always bring that
-base controller- -Well, no-
-... back if you wanted to. -You can, but-
-Or is it gone? -... you have to extend, like, if you do
that, the, the, the way that they do the middle ware on the controllers is also
-different now- -Right, okay
... because they've, they've removed that construct middle ware.
-Yeah, 'cause it's a method now. -Yeah, they've con- removed that. And so
you have to have, like, there's like a public static function middle ware on
every controller, but the authorized resource uses that middle ware the way
that it was previously written. Which is why I think-
-Mm-hmm -... they removed it from the docs. It was
like, "No, we're not gonna do this anymore." Like, you have to extend-
-Mm-hmm -... a different type of, um... I- I looked
into it. It's just, you have to do something funky. It's definitely not the
direction the framework was going. Which I'm fine with saying we're gonna stick
with where the c- the framework was going. I'm fine with changing, I just don't feel
like I have a clear picture of, like, how it is. And, and again-
-Mm-hmm -... maybe it's... They are just like, "No,
no, no, there is a clear picture. The clear picture is do a gate authorize check
in every single controller method." And I'm just like, "Ick, I don't like that.
-That's still the thing." Um- -Yeah.
-And so, you know. -I found, I found Nuno's, uh, tweet about
it. It was from the 29th of January. So some things just stick in my head better
than others. But he said, "Yes, authorization on my form request. I
typically test form request on my controller test." So the... I- I've linked
it to you, I have a link for you in the show notes. Basically he's got a
controller which has a method that injects the request, and the assumption is that
the authorization has already happened in the request, and the validation obviously
then happens in the, uh, form request implicitly. And then it's just a matter of
calling the action handle method and returning response from the controller,
-and- -Okay, so here's, here's my only, this is
my only hang up, right? And you may have an answer to this, you may not.
If I have
a
item.
If I'm edit, like, so if I'm editing an item, okay?
-Mm-hmm. Mm-hmm. -And I am getting that through the
controller method, um, not store, not like a new one, like I'm-
-Mm-hmm -... editing or I'm viewing one that
-already exists. -Mm-hmm.
How can I reference that item that's coming in in my form request
in the authorize method? That's it. If I could figure that out, I feel like I'm
good.
And I'm, I want that to be actually a good answer. Like, I don't want it to be some
janky, like, I have to pull it from the route thing. Like, I want it to, like...
Yeah. Well this is the, the route parameter attribute that you would, you
would
hint that
in that authorize method, and it should inject it for you that way.
-Okay. -That's how I believe it's meant to work,
so.
Storage, keep that route parameter attribute. Yeah.
Yeah. Yeah, and I'd say the only piece to me that still feels incomplete on that is
that I have to have that in both my controller and my form request, that same
variable. I have to keep it in. I have to keep it consistent. It, my refactor tools
are not gonna know that those are gonna need to change together.
No. They won't. Um,
no.
But you, you need... Well, yeah, you need to put them in both places anyway
if you need both of them to be aware of it. It's, like, it's no different than
passing it down into an action or sending it somewhere else. Like, those things just
-need to know about it. -Well, except for from there, I'm passing
-it from the controller into the action. -Mm-hmm. Mm-hmm.
Right? And so I can see it in the controller. It's like it's right there.
-Yeah, yeah. -I can see the name of the variable. I know
I have that available to me in the controller.
-Mm-hmm. -And so then I just... And it's no problem.
-I- I just, it's like it's- -I mean, if you wanted to
if you wanted to, you could then, you could then type the route parameter in
both of them rather than relying on the implicit injection
-into the controller. -Could I do, could I...
-So rather than just- -Go ahead.
Yeah, so rather than in your controller method doing, you know, binding the, the
model directly, you could just say route parameter. 'Cause this, you can-
-Ah, okay -... that route parameter attribute
is, a- an attribute that targets parameters. So you could do it on a, on a
controller's edit method, yeah.
-Mm-hmm. -But, you know, without running the code,
looking at it, it certainly seems to, to be the case.
Okay. I need to find the documentation for that,
for what you're talking about. Is it an attribute, that route attribute?
Contextual, yeah, contextual, contextual attributes, I think is what they're called
-in the documentation. -Okay. Let's look that up.
Contextual attributes, yeah, as part of the service container documentation.
Contextual attributes.
Route parameter, and then so you say, like, the route parameter would be, uh,
-coaching- -Yeah
... as a string, and then you would have a, you know, coaching,
dollar coaching, you know, and put it put it in the definition that way.
I'm curious if when I get it that way, if it's actually going to give me is is it
just going to give me the value, the ID that's being passed through? So I have to
-look it up again? -It'll it'll do the casting for you.
-It will do that. -It's basically an explicit model
binding.
Right? You're saying take this thing explicitly from the route, right, the the
ID of the coaching
model, and then Mhmm. It will handle casting that into a coaching
-Oh, I see it -... model.
Mhmm. Mhmm. Mhmm. Yep.
And it does a container make from the request and gets that route parameter, and
then you get that back because it's an attribute that you have now typed as a as
a, method parameter, you'll get the type of that thing knowing that it is an
instance of whatever it should be out of the route, which in this case
Interesting. So I could do that I could do that inside of the, um,
-the form request? -The form request and the controller. Yeah.
I mean, it it doesn't stop the like, I've gotta put it in two places. But it makes
-it -Yeah. Or maybe or maybe it actually I
wonder if it actually also, makes 2 queries.
-That would be the thing to check for. -Hmm.
I mean, it's pulling it out of the route. So it's set
-on the route there. -Yeah.
-So
worth exploring. Uh, I wouldn't go and refactor my
I'm still not super yeah. Well so that's where we're at. It's like we're already
going through the process of refactoring the code base. So I'm pulling my hair out
trying to figure out, okay, we're doing this once. How do we wanna do it? And I
just don't feel like I have a good answer. So
-Yeah. There are -I might just end up I might just so what I
know what I know I can do is the the easy way that's ugly is just do the gate
authorize check at the top of every controller method and call it good. And it
is it is ugly, but it's effective, and it works every time. Like
-Yeah. -I mean, there are there are some ugly
things, and there are some paper cuts in the framework that I don't know that there
are good solutions for. Um,
and, like, I know that Taylor likes to go through and find these paper cuts and and
clean them up, but there are just some things that I think can't be cleaned up. I
mean, I say that now, maybe in 6 months, he will, you know he will have one of
those light bulb moments and figure out how to do it. But, um, yeah, the the form
request and the controller kind of different context as well.
-Yeah. Yeah. -Even though they're coupled. Um,
-yeah. -Yep. Yep. Yep. Yep. Okay.
Interesting. I'd be interested to to hear where you land on it though.
Yeah. I think I think if I'm if I'm just trying to be, like if I'm trying to be as
consistent and as, like, pragmatic as I would as I could be, I think, ideally, I
would like to put it in the form request. I would like to just always have a form
request object, always have an authorized method, and always be checking the policy
-in that spot. -Yeah.
Um, and then I think the trick the only trick I have to figure out is how I can
make sure that I have access to that that, um, model that is bound, you know, the
implicit binding. And if I can figure that out, then I'm I'm good to go. And I'll
I'll let you know kinda where we where we land on that.
-Yeah. Excellent. -Cool.
-It's nice. -Okay. Yes. Yes. Yes. Alright. We are what
-time are we at here? 34? -Yeah.
Alright. We got we we got anything else before wanna talk about before we go or
are we good?
Uh, no. I mean, we talked about the Salesforce mocking thing, uh, last
episode, which I'm still working my way through because I realized today that at
some point during the AI writing the code, it deleted a whole bunch of code that I
-Oh, fun. -... still had written. So and I'm not sure
like, I don't know if I'd stashed it and then dropped the stash because I thought I
wasn't working on that anymore. Um, but it likes to be very verbose. And so
what I have found through this process
is that
a lot of stuff you end up doing multiple times because you'd like you get the first
cut and then you have to like tidy it up and then it like starts doing weird
things. Like I said, I want you to bind a faker instance to the container. So it
went and actually bound
well, I said I wanted to choose dependency and injection. And so I went and then
bound an instance of faker to the container rather than just injecting it as
a constructor
property. So this is things like that. I'm I'm getting to the point where I'm, like,
I would just do this myself. Like, you have given me enough of the skeleton that
I can go and make the rest of this work. Otherwise, I'm just gonna keep going round
and round in circles.
So
I did find though, um, I'm using I think we spoke about open code last time. I'm
using that. They're offering brock code fast for free for a period of time while
they're testing it out with with their stuff. And I think
it tends to produce results, like, good enough results much quicker because it
doesn't
spit out all of the, like, thought process that it's going through where Claude
and the Sonnet model will say, you know, I'm doing this. I'm looking at this. Oh,
this didn't work. I'm gonna, like, go and investigate this. Whatever. Like, it's
very verbose in terms of describing what it's doing. Brock code seems to just,
like, do it and then go here's the result at the end, which
depending on who you are
may or may not be
a better option. But I found towards the end of last week that
that Groq code was
certainly producing results much quicker where Sonnet kept on timing out. But I
think Claude had some issues last week, and they made some tweaks to their models
or something like that. So maybe that came into play because it seems to be working
okay again today.So, anyway, I don't know. I think our code base is, is
quite large and some of the stuff that's in there may impair
-more than impact what it's doing. -Mm-hmm.
And so, yeah. It certainly has gotten through a lot of the boilerplate and a lot
of the things that I wouldn't wanna do, like, you know, coming up with mock
responses for Salesforce requests. Like, it's figured out what they should look
like and
the shape of the responses and generating all of the, the bodies. So it's been very
good at that. But in terms of tying all the pieces together, I'm not stoked with
-it, to be honest. -Yeah.
You know, whether, whether or not that's, like, the model is not capable of it or
I'm not capable of steering the model at this stage is
unclear. But it's just a frustrating thing, and it's, it's turning into a bit
of an abusive relationship now because every time I say- ... "Nah, this is crap.
I'm not gonna use this anymore. I'm gonna do it myself," I find my way back to it
and try again anyway. Maybe this time it'll be different, so.
-You get... You're codependent. -It's no, it's no good. But I feel-
-There's- -I, I just, I
-there's- -There's gonna be a whole industry popping
up around, like, AI, like, relationship coaching.
Yeah. Yeah. There's, uh, we'll, we'll probably wrap on this, and maybe I'll get
your opinion on it and then we can wrap. But
I feel like there's a big push
as an industry. Like, you see it all the time. Companies are saying, "You've gotta
use AI. We're not hiring any more staff unless you can show that you've exhausted
all avenues with AI," and, and whatever else. Like, so there's that whole school
of thought going on. And, um,
I feel like as engineers, as developers that have been in the game for a long
period of time, that have, like, done all of the work by hand for a long period of
time, sitting there and watching the computer write the code for you, it's
like, what am I being paid for now
to, like, sit there and just what? Like, I feel very dirty about it. Whereas some
people are like, "This is great. I can get more done," I don't feel like it's made
me quicker. I feel like it has certainly written more code than I could have over
the same period of time. I don't think it's produced the same amount of output
and the same amount of value as I could in that same amount of time, if that makes
-sense. -Mm. Yeah, so do you-
-Um- -You feel like it's actually made, made you
less efficient, but it's, it's easier for you?
-I don't think it's made me more- -Less produc- not, not less efficient, less
-productive? -Yeah.
-Do you feel like you're producing less? -Yeah, I feel like... Yeah, 'cause, like,
I'm not doing it. I'm watching the computer do it, right?
-Sure. -But I feel like what it's producing, I
still need to go over, and there's a lot of untangling going on there. So I'm, I'm
watching the computer write the code for, you know, hours of a day
or across a week, you know, hours of, of, of that week. And it's like, well, what,
what am I supposed to be doing while it's
churning out code? And then, oh, it's finished. Okay, now I've gotta go and look
at it. No, that's no good. Figure out how we're gonna fix it. Okay, then off it
goes again. It's like... I don't know. As, as someone who has always written the
code, it's like, I understand that I get, you know, you get paid to do the work, but
now I'm not doing the work, if that makes sense. So what-
-Yeah, yeah -... what, what am I, what am I being paid
-for here? -Are you, are you using, are you using it
in, like, planning mode first to kinda get it all set up?
-Yeah. -And then you... Yeah. Okay.
-Yeah. -So you're doing it that way. Okay. Yeah.
-Yeah. -I don't know, dude. I, honestly, I wish I
could tell you. I feel like tomorrow I actually told Andy Hinkle. I was like,
"Dude, you're gonna do a Teaching Tuesday for us tomorrow, and you're gonna show us
how you actually go through
with Claude and with, uh, Cursor and, and how you actually go through. What's your
process, you know? Um, how do you set it up in planning mode? What are the things
that you're prompting it with?" And whatever. And there, there are little
things. Like, so today he went through and was like, "Here are all the strings that
I want to have a passing test for, that it should have this output. And here are all
the ones that I have strings that should be ignored, and this is what it should
-be," whatever. And then he said- -Mm-hmm
... "I need a regex that solves all of these." And it was like, "Okay. Let me
wri- let me do this." And he's like, "No, no, no. Start with TDD first. Like, write
the test." It was like, "Okay, I'll write the test." Then he's like, "Okay. Now
write your regex." And it wrote a single regex that solved all of those, and it
-passed- -Mm-hmm
-... all the tests. And it's like, okay. -Yeah.
Pretty sweet. Like, 'cause Andy's... He's, he's good with... You know, he... I don't
think he's ever had to use or, like, had to know exactly what the regex was. Most
of the time, you can just kinda, like, Google it, and like, "Okay, I need a regex
-for a phone number." -Yeah. Yeah.
Great. There we go. You know, I don't know what it means, but whatever.
-He's very good at writing regexes. Yeah. -Totally. And, like, I love regex stuff.
And so, like, for me, it's very interesting to kinda see him pull it apart
and whatever. But it's like, does it really necessary for him to learn all
that, or can he just prompt the AI to do that? And so it's like-
-Yeah -... there are instances where it's, like,
-very useful for that sort of stuff. So- -Mm-hmm.
And it was stupid, it would be stupid for him to write that code because s- you
-know, it can write it for him. And so- -Yeah.
-Um, yeah. I don't know. -For those kinds of things, like, I have
definitely found that it's, it's quite good at it. Um, especially, you know, when
we've been wanting to figure out... Like, we have
in the Salesforce library
every- everything that, like, runs a raw query against the Salesforce endpoint, it
just sends an execute query request. So it could be a, it could doing a select from
contacts or accounts or, you know, whatever else. So the only way to kinda
figure out what kind of request is actually being sent in order for us to be
able to then fake the response is to inspect the query string. Um, and so,
like, it's kinda figured out
initially that it, it was writing a regex. I'm like, "I think this is a bit
overkill," 'cause I was looking at this regex. I'm like that, that looks very
complicated. Uh, let's maybe just use a string contains here and just look for,
like, if the query string contains from account, it means that we're doing an
account lookup so we can return the account if it... You know, all of that
kinda stuff. But
it's... Yeah. There, there are things... I haven't formulated a concrete opinion on
it yet. There are certainly things that it can do and does well. Like, I love using
-it to go and fix PHP stand violations. -Mm.
'Cause it's like, ah, I don't wanna go through that. Um-
-Yeah -... especially when you update a, a patch
release and end up with 90 or whatever
stand violations that weren't there before the update, like I did yesterday.
Um...... but, uh, yeah. There are also things that, even guided, like, "Okay. I
want a- I want you to create a- a registry of these things." Or "I want it..." You
know, if you- if you're very specific and very guided, um, it can go and generate a
lot of code. But then you've gotta go and look at it, because, um, it doesn't do
things quite as well as I would hope for code that I want to ship into production.
Because, yeah, the AI may have written it, but then I have to support it. So...
That's the main thing. Like, you do still need to understand it in, you know, in a
-professional capacity. -Yeah.
Like, if you're- if you're a non-programmer and you're just trying to
bring your ideas to life... I spoke to a friend the other day who's a- a UX
researcher, and he built this thing, um,
that does
some analysis. I don't wanna go too much into it, 'cause he's still building it
out. But he built this as, like, a- a next app, um, and, like, all of his stuff, it-
it does all the analysis, it provides reports, it shows you all these different
things, that over the last month and a half, two months, he's built himself. Um,
because he knows, like, what comes out the other side of it, he knows what he's
expecting there. But if you looked under the- under the hood of all of that code,
it's not gonna be something that you'd wanna maintain. For that use case-
-Yeah -... where you're building something that
-you would not have otherwise had- -It's... Yeah. You could toss-
-... the time, the capability- -Yeah
... the money to- to do, you know, it doesn't matter. But he's pro- providing
-value in the outcomes. So... -Yeah.
But as a software engi- uh, I keep saying engineer. As a software developer, I find
myself endlessly frustrated by what it puts out, um,
-and I'm- I'm not- not convinced by it. -Yeah.
Yep. Like I said, it's just... It always... The answer is it depends, right?
Yeah.
-As with anything. -Yeah.
As with anything. All right, my friends. Why don't we wrap it there? Uh, this is
-gonna be Episode 183? -183.
-183? -Mm-hmm.
Thanks for hang- thanks for hanging out with us, folks. Find those show notes for
this episode at northmeetsouth.audio/183. Hit us up on Twitter, on X, on Bluesky,
@MichaelDurant, @JacobBennett, or at North South Audio. And if you liked the show,
rate it up in your podcatcher of choice. Five stars would be incredible. Thanks,
-folks. Until next time. We'll see ya. -Bye.