Laravel ベストプラクティス

declare(strict_types=1);

namespace App\Actions\Order;
 
use App\Models\Order;
use App\Models\User;
use Illuminate\Support\Facades\DB;
 
final class PlaceOrderAction
{
    public function __construct(
        private readonly InventoryService $inventory,
    ) {}
 
    public function execute(User $user, array $items): Order
    {
        return DB::transaction(function () use ($user, $items) {
            $this->inventory->reserve($items);
 
            $order = $user->orders()->create([
                'status' => OrderStatus::Pending,
            ]);
 
            $order->items()->createMany($items);
 
            OrderPlaced::dispatch($order);
 
            return $order;
        });
    }
}

// Good
Route::resource('posts', PostController::class);
Route::apiResource('comments', CommentController::class)->only(['index', 'store']);
 
// Bad: 同じことを個別に書く
Route::get('/posts', [PostController::class, 'index']);
Route::get('/posts/create', [PostController::class, 'create']);
// ...

return redirect()->route('posts.show', $post);

// Good
public function show(Post $post) { ... }
 
// Bad
public function show($id)
{
    $post = Post::findOrFail($id);
}

Route::middleware(['auth', 'verified'])
    ->prefix('admin')
    ->name('admin.')
    ->group(function () {
        Route::resource('users', Admin\UserController::class);
    });

final class PublishPostController extends Controller
{
    public function __invoke(Post $post, PublishPostAction $action)
    {
        $this->authorize('publish', $post);
 
        $action->execute($post);
 
        return back()->with('status', '公開しました');
    }
}

// Bad: すべてをコントローラーで処理
public function store(Request $request)
{
    $request->validate([...]);
    if ($request->user()->cannot('create', Post::class)) abort(403);
    $post = new Post();
    $post->title = $request->title;
    // ...長いロジック
    Mail::to(...)->send(...);
}
 
// Good
public function store(StorePostRequest $request, CreatePostAction $action)
{
    $post = $action->execute($request->user(), $request->validated());
 
    return redirect()->route('posts.show', $post);
}

final class StorePostRequest extends FormRequest
{
    public function authorize(): bool
    {
        return $this->user()->can('create', Post::class);
    }
 
    public function rules(): array
    {
        return [
            'title'   => ['required', 'string', 'max:255'],
            'body'    => ['required', 'string'],
            'status'  => ['required', Rule::enum(PostStatus::class)],
            'tags'    => ['array'],
            'tags.*'  => ['integer', 'exists:tags,id'],
        ];
    }
}

class Post extends Model
{
    protected $fillable = ['title', 'body', 'status'];
}

// Bad: posts件数分のクエリが発生
$posts = Post::all();
foreach ($posts as $post) {
    echo $post->author->name;
}
 
// Good
$posts = Post::with('author')->get();

// AppServiceProvider::boot()
Model::shouldBeStrict(! app()->isProduction());

User::select(['id', 'name', 'email'])->get();

User::where('active', true)->chunkById(1000, function ($users) {
    foreach ($users as $user) { ... }
});
 
foreach (User::lazy() as $user) { ... }

// モデル
public function scopePublished(Builder $query): void
{
    $query->where('status', PostStatus::Published)
          ->whereNotNull('published_at');
}
 
// 利用側
Post::published()->latest()->paginate();

enum PostStatus: string
{
    case Draft = 'draft';
    case Published = 'published';
}
 
class Post extends Model
{
    protected function casts(): array
    {
        return [
            'status'       => PostStatus::class,
            'published_at' => 'datetime',
            'meta'         => 'array',
        ];
    }
}

protected function fullName(): Attribute
{
    return Attribute::make(
        get: fn () => "{$this->last_name} {$this->first_name}",
    );
}

DB::transaction(function () { ... });

// Bad: SQLインジェクションの危険
DB::select("SELECT * FROM users WHERE email = '$email'");
 
// Good
DB::select('SELECT * FROM users WHERE email = ?', [$email]);

Schema::create('posts', function (Blueprint $table) {
    $table->id();
    $table->foreignId('user_id')->constrained()->cascadeOnDelete();
    $table->string('title');
    $table->text('body');
    $table->string('status')->index();
    $table->timestamp('published_at')->nullable();
    $table->timestamps();
    $table->softDeletes();
 
    $table->index(['status', 'published_at']);
});

final class PostPolicy
{
    public function update(User $user, Post $post): bool
    {
        return $user->id === $post->user_id;
    }
}

// コントローラー
$this->authorize('update', $post);
// または Gate::authorize('update', $post);
 
// ルート
Route::put('/posts/{post}', ...)->can('update', 'post');
 
// Blade
@can('update', $post)
    <a href="{{ route('posts.edit', $post) }}">編集</a>
@endcan

final class PostResource extends JsonResource
{
    public function toArray(Request $request): array
    {
        return [
            'id'           => $this->id,
            'title'        => $this->title,
            'status'       => $this->status->value,
            'author'       => UserResource::make($this->whenLoaded('author')),
            'published_at' => $this->published_at?->toIso8601String(),
        ];
    }
}

RateLimiter::for('api', function (Request $request) {
    return Limit::perMinute(60)->by($request->user()?->id ?: $request->ip());
});

// config/services.php
'stripe' => [
    'key' => env('STRIPE_KEY'),
],
 
// アプリケーションコード
config('services.stripe.key'); // Good
env('STRIPE_KEY');             // Bad: config:cache 後は null になる

final class SendWelcomeEmail implements ShouldQueue
{
    use Dispatchable, InteractsWithQueue, Queueable, SerializesModels;
 
    public int $tries = 3;
    public array $backoff = [10, 60, 300];
 
    public function __construct(public readonly User $user) {}
 
    public function handle(): void
    {
        Mail::to($this->user)->send(new WelcomeMail($this->user));
    }
 
    public function failed(Throwable $e): void
    {
        report($e);
    }
}

SendWelcomeEmail::dispatch($user)->afterCommit();

$stats = Cache::remember('dashboard.stats', now()->addMinutes(10), function () {
    return [
        'users' => User::count(),
        'posts' => Post::published()->count(),
    ];
});

it('allows the author to update their post', function () {
    $user = User::factory()->create();
    $post = Post::factory()->for($user)->create();
 
    $this->actingAs($user)
        ->put(route('posts.update', $post), [
            'title' => '新しいタイトル',
            'body'  => '本文',
            'status' => 'draft',
        ])
        ->assertRedirect(route('posts.show', $post));
 
    expect($post->fresh()->title)->toBe('新しいタイトル');
});
 
it('forbids other users from updating the post', function () {
    $post = Post::factory()->create();
 
    $this->actingAs(User::factory()->create())
        ->put(route('posts.update', $post), [...])
        ->assertForbidden();
});

./vendor/bin/pint
./vendor/bin/phpstan analyse
php artisan test --parallel

composer install --no-dev --optimize-autoloader
php artisan migrate --force
php artisan optimize        # config/route/view/event のキャッシュ
php artisan queue:restart   # ワーカーに新しいコードを反映