php 45 lines · 6 steps

How a Laravel FormRequest validates invoices

A FormRequest bundles authorization, validation rules, and localized error messaging into one reusable class.

Explained by highlit

Laravel Intermediate validation authorization form-request localization nested-arrays

1<?php
2 
3namespace App\Http\Requests;
4 
5use Illuminate\Foundation\Http\FormRequest;
6 
7class StoreInvoiceRequest extends FormRequest
8{
  public function authorize(): bool
  {
      return $this->user()->can('create', Invoice::class);
  }
13 
  public function rules(): array
  {
      return [
          'customer_email' => ['required', 'email', 'max:255'],
          'issued_at' => ['required', 'date', 'before_or_equal:today'],
          'due_at' => ['required', 'date', 'after:issued_at'],
          'line_items' => ['required', 'array', 'min:1'],
          'line_items.*.description' => ['required', 'string', 'max:500'],
          'line_items.*.amount' => ['required', 'numeric', 'min:0.01'],
      ];
  }
25 
  public function messages(): array
  {
      return [
          'due_at.after' => __('validation.custom.invoice.due_after_issue'),
          'line_items.min' => __('validation.custom.invoice.line_items_required'),
          'line_items.*.amount.min' => __('validation.custom.invoice.positive_amount'),
      ];
  }
34 
  public function attributes(): array
  {
      return [
          'customer_email' => __('validation.attributes.customer_email'),
          'issued_at' => __('validation.attributes.issued_at'),
          'due_at' => __('validation.attributes.due_at'),
          'line_items.*.description' => __('validation.attributes.line_item_description'),
          'line_items.*.amount' => __('validation.attributes.line_item_amount'),
      ];
  }
45}

01 / 01

STEP 01

Walkthrough

Space play ←→ step click any line

Three takeaways

1FormRequest classes keep authorization and validation out of controllers so actions stay lean.
2Dot and star notation let you validate every element of a nested array with a single rule key.
3Overriding messages() and attributes() turns raw field names into human-friendly, translatable error text.

Related explainers

typescript

import { Injectable, UnauthorizedException } from '@nestjs/common';
import { PassportStrategy } from '@nestjs/passport';
import { ExtractJwt, Strategy } from 'passport-jwt';
import { ConfigService } from '@nestjs/config';

How a JWT strategy authenticates in NestJS

authentication jwt passport

Intermediate 7 steps

php

<?php
 
namespace App\Http\Controllers;

Streaming a filtered CSV export in Laravel

streaming csv-export query-builder

Intermediate 9 steps

php

<?php
 
namespace App\Http\Middleware;

Idempotent requests with Laravel middleware

idempotency middleware caching

Advanced 8 steps

typescript

import { CanActivate, ExecutionContext, Injectable, UnauthorizedException } from '@nestjs/common';
import { GqlExecutionContext } from '@nestjs/graphql';
import { Reflector } from '@nestjs/core';
import { JwtService } from '@nestjs/jwt';