# Agent Notes

## `Model::unguard()` is intentional

`app/Providers/AppServiceProvider.php` calls `Model::unguard()` in `boot()`.

This is an intentional project-wide choice. Mass-assignment protection is enforced at the FormRequest / controller layer rather than through Eloquent `$fillable`. Removing `Model::unguard()` would require adding explicit `$fillable` arrays to every model and risks silently breaking create/update calls across the codebase.

**Do NOT remove `Model::unguard()` unless explicitly requested by the project owner.**

## Input-whitelisting convention

Because `Model::unguard()` disables Eloquent's last line of defence, **every create/update call must receive only validated/safe input**:

- Prefer `$request->validated()`.
- When only a subset is needed, use `$request->safe()->only([...])`.
- Never pass `$request->all()`, `$request->except([...])`, or raw `$request->input(...)` into `Model::create()`, `Model::update()`, or `Model::fill()`.
- Keep validation rules in Form Requests; do not "trust" controller-level casting to replace validation.

This convention is the project's substitute for `$fillable`/`$guarded`. Treat any PR that breaks it as a blocking issue.

## Enforced by a PHPStan custom rule

The convention above is mechanically enforced by `App\PHPStan\Rules\NoRawRequestInputInEloquentWriteRule`.

The rule reports an error whenever raw request input (`$request->all()`, `$request->except(...)`, or `$request->input()` with no key) is passed to Eloquent `create()`, `update()`, `fill()`, `firstOrCreate()`, or `updateOrCreate()`.

The rule is registered in `phpstan.neon.dist` and runs as part of the normal PHPStan analysis. A PR that violates the convention will fail CI before it can be merged.

## Form Requests for writes

Every endpoint that writes to the database must use a dedicated `FormRequest`. Inline `$request->validate([...])` in controllers is acceptable only for one-off cases (e.g. password change); the authoritative input shape must still live in a typed, reusable Form Request whenever the same input is used elsewhere or when the write affects an Eloquent model.