feat(panel): ship a dedicated middleware group (spec 0059)#2580
Merged
Conversation
The panel wrapped its routes in the host app's `web` middleware group. A downstream app that installs Inertia registers its own HandleInertiaRequests into `web`, which then double-stacks with the panel's HandlePanelInertiaRequests -- leaking the app's shared props into panel responses and triggering spurious 409 asset reloads. Any other host `web` customisation applied to panel routes too. Register a `lunar.panel` middleware group from the framework `web` primitives (cookies, session, CSRF, bindings, share-errors) and default `route_middleware` to it. Session/cookie/CSRF config is still read from the app; only app-appended middleware is dropped. The config seam is preserved for anyone who wants the host stack back. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Laravel 13 renamed ValidateCsrfToken to PreventRequestForgery. Hardcoding the new name broke the L12 CI matrix (PHPStan "class not found" + panel suite). Resolve the class name at runtime via class_exists() with string literals, so both versions get a real class and PHPStan does not flag a missing class reference. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The panel already ships its own Inertia middleware (
HandlePanelInertiaRequests), but it wrapped its routes in the host app'swebmiddleware group (route_middleware => ['web']).That couples the panel to whatever the consuming app has bolted onto
web. The concrete failure: installing Inertia in the host app registersApp\Http\Middleware\HandleInertiaRequestsinto thewebgroup, which then double-stacks with the panel's own Inertia middleware on every panel route — leaking the app's shared props into panel responses, conflicting on the root view, and (most damaging) disagreeing on the assetversion(), which triggers spurious 409 full-page reloads. Any otherwebcustomisation (locale, tenancy, extra auth) rode along too.Change
Register a dedicated
lunar.panelmiddleware group from the frameworkwebprimitives and defaultroute_middlewareto it:EncryptCookies,AddQueuedCookiesToResponse,StartSession,ShareErrorsFromSession,PreventRequestForgery,SubstituteBindingssession.php, cookie domain, CSRF except paths), so session/cookie/CSRF behaviour is preserved — only app-appended middleware is dropped.webstack (or a bespoke one) still overrideslunar.panel.route_middleware.Migration note
The default value of
lunar.panel.route_middlewarechanges['web']→['lunar.panel']. Transparent for apps on defaults (strictly a fix). An app that has published the panel config keeps its existing['web']value until it re-publishes — recommended path is to re-publish or set['lunar.panel']manually. Not a code-level break; no Rector rule needed.Tests
PanelServiceProviderTest: asserts the new default, the exact group membership, and thatpanel.dashboardgathersHandlePanelInertiaRequestsbut notweb.Spec:
specs/0059-panel-middleware-group.md(statusaccepted).🤖 Generated with Claude Code