replace FormRequest magic field access with explicit validated accessors

Author: michalsn

system/HTTP/FormRequest.php

@@ -174,30 +174,33 @@ public function validated(): array
     }
 
     /**
-     * Returns a single validated field value by name, or null if the field
-     * is not present in the validated data (either not declared in rules() or
-     * validation has not yet run).
+     * Returns a single validated field value by name, or the default value
+     * if the field is not present in the validated data.
      *
-     * Allows accessing individual fields as object properties:
-     *
-     *  $title = $request->title;
-     *
-     * @return mixed
+     * Supports dot-array syntax for nested validated data.
      */
-    public function __get(string $name)
+    public function getValidated(string $key, mixed $default = null): mixed
     {
-        return $this->validatedData[$name] ?? null;
+        helper('array');
+
+        if (! dot_array_has($key, $this->validatedData)) {
+            return $default;
+        }
+
+        return dot_array_search($key, $this->validatedData);
     }
 
     /**
-     * Returns true when the named field exists in the validated data and its
-     * value is not null. Mirrors standard PHP isset() semantics on properties:
+     * Returns true when the named field exists in the validated data, even if
+     * its value is null.
      *
-     *  if (isset($request->title)) { ... }
+     * Supports dot-array syntax for nested validated data.
      */
-    public function __isset(string $name): bool
+    public function hasValidated(string $key): bool
     {
-        return isset($this->validatedData[$name]);
+        helper('array');
+
+        return dot_array_has($key, $this->validatedData);
     }
 
     /**

tests/system/HTTP/FormRequestTest.php

@@ -164,59 +164,115 @@ public function testValidatedReturnsOnlyFieldsCoveredByRules(): void
     }
 
     // -------------------------------------------------------------------------
-    // __get / __isset - property-style access to validated fields
+    // Explicit access to validated fields
     // -------------------------------------------------------------------------
 
-    public function testMagicGetReturnsValidatedFieldValue(): void
+    public function testGetValidatedReturnsValidatedFieldValue(): void
     {
         service('superglobals')->setPost('title', 'Hello World');
         service('superglobals')->setPost('body', 'Some body text');
 
         $formRequest = new ValidPostFormRequest($this->makeRequest());
         $formRequest->resolveRequest();
 
-        $this->assertSame('Hello World', $formRequest->title);
-        $this->assertSame('Some body text', $formRequest->body);
+        $this->assertSame('Hello World', $formRequest->getValidated('title'));
+        $this->assertSame('Some body text', $formRequest->getValidated('body'));
     }
 
-    public function testMagicGetReturnsNullForMissingField(): void
+    public function testGetValidatedReturnsNullForMissingField(): void
     {
         service('superglobals')->setPost('title', 'Hello World');
         service('superglobals')->setPost('body', 'Some body text');
 
         $formRequest = new ValidPostFormRequest($this->makeRequest());
         $formRequest->resolveRequest();
 
-        $this->assertNull($formRequest->nonexistent); // @phpstan-ignore property.notFound
+        $this->assertNull($formRequest->getValidated('nonexistent'));
     }
 
-    public function testMagicGetReturnsNullBeforeValidationRuns(): void
+    public function testGetValidatedReturnsDefaultForMissingField(): void
+    {
+        service('superglobals')->setPost('title', 'Hello World');
+        service('superglobals')->setPost('body', 'Some body text');
+
+        $formRequest = new ValidPostFormRequest($this->makeRequest());
+        $formRequest->resolveRequest();
+
+        $this->assertSame('fallback', $formRequest->getValidated('nonexistent', 'fallback'));
+    }
+
+    public function testGetValidatedReturnsNullBeforeValidationRuns(): void
     {
         $formRequest = new ValidPostFormRequest($this->makeRequest());
 
-        $this->assertNull($formRequest->title);
+        $this->assertNull($formRequest->getValidated('title'));
     }
 
-    public function testMagicIssetReturnsTrueForValidatedField(): void
+    public function testHasValidatedReturnsTrueForValidatedField(): void
     {
         service('superglobals')->setPost('title', 'Hello World');
         service('superglobals')->setPost('body', 'Some body text');
 
         $formRequest = new ValidPostFormRequest($this->makeRequest());
         $formRequest->resolveRequest();
 
-        $this->assertTrue(isset($formRequest->title));
+        $this->assertTrue($formRequest->hasValidated('title'));
     }
 
-    public function testMagicIssetReturnsFalseForMissingField(): void
+    public function testHasValidatedReturnsFalseForMissingField(): void
     {
         service('superglobals')->setPost('title', 'Hello World');
         service('superglobals')->setPost('body', 'Some body text');
 
         $formRequest = new ValidPostFormRequest($this->makeRequest());
         $formRequest->resolveRequest();
 
-        $this->assertFalse(isset($formRequest->nonexistent)); // @phpstan-ignore property.notFound
+        $this->assertFalse($formRequest->hasValidated('nonexistent'));
+    }
+
+    public function testGetValidatedAndHasValidatedSupportDotSyntax(): void
+    {
+        service('superglobals')->setPost('post', [
+            'title' => 'Hello World',
+            'meta'  => [
+                'slug' => 'hello-world',
+            ],
+        ]);
+
+        $formRequest = new class ($this->makeRequest()) extends FormRequest {
+            public function rules(): array
+            {
+                return [
+                    'post.title'     => 'required',
+                    'post.meta.slug' => 'required',
+                ];
+            }
+        };
+
+        $formRequest->resolveRequest();
+
+        $this->assertSame('Hello World', $formRequest->getValidated('post.title'));
+        $this->assertSame('hello-world', $formRequest->getValidated('post.meta.slug'));
+        $this->assertTrue($formRequest->hasValidated('post.meta.slug'));
+    }
+
+    public function testHasValidatedReturnsTrueForNullValidatedField(): void
+    {
+        service('superglobals')->setServer('CONTENT_TYPE', 'application/json');
+
+        $formRequest = new class ($this->makeRequest('{"note":null}')) extends FormRequest {
+            public function rules(): array
+            {
+                return ['note' => 'permit_empty'];
+            }
+        };
+
+        $formRequest->resolveRequest();
+
+        $this->assertSame(['note' => null], $formRequest->validated());
+        $this->assertNull($formRequest->getValidated('note'));
+        $this->assertNull($formRequest->getValidated('note', 'fallback'));
+        $this->assertTrue($formRequest->hasValidated('note'));
     }
 
     // -------------------------------------------------------------------------

user_guide_src/source/incoming/form_requests.rst

@@ -56,15 +56,13 @@ are silently discarded, protecting against mass-assignment.
 .. literalinclude:: form_requests/009.php
    :lines: 2-
 
-Individual fields can also be read as object properties. This is equivalent to
-``$request->validated()['field'] ?? null``:
+Use ``getValidated()`` to read a single validated field and ``hasValidated()``
+to check whether a validated key exists, including keys whose value is
+``null``. Both methods support dot-array syntax for nested validated data:
 
 .. literalinclude:: form_requests/014.php
    :lines: 2-
 
-``isset($request->field)`` returns ``true`` when the field was validated and
-has a non-null value, following standard PHP ``isset()`` semantics.
-
 Accessing Other Request Data
 ============================
 
@@ -230,7 +228,8 @@ whose type extends ``FormRequest``:
    rules are applied.
 #. ``run()`` executes the validation rules. If it fails, ``failedValidation()``
    is called, and its response is returned to the client.
-#. The validated data is stored internally and available via ``validated()``.
+#. The validated data is stored internally and available via ``validated()``,
+   ``getValidated()``, and ``hasValidated()``.
 #. The resolved FormRequest object is injected into the controller method or
    closure.
 

user_guide_src/source/incoming/form_requests/014.php

@@ -1,8 +1,8 @@
 <?php
 
-$title = $request->title;  // same as $request->validated()['title'] ?? null
-$body  = $request->body;
+$title = $request->getValidated('title');
+$slug  = $request->getValidated('post.meta.slug', 'draft');
 
-if (isset($request->note)) {
-    // 'note' was validated and has a non-null value
+if ($request->hasValidated('note')) {
+    // 'note' was validated, even if its value is null
 }