Request

Introduction

Request wraps the incoming request for both AJAX and REST transports. Type-hint it on a controller method and the router injects it:

use YourPlugin\Deps\BitApps\WPKit\Http\Request\Request;

public function update(Request $request)
{
    $id = $request->id;
}

Reading input

Attributes are readable as properties, as array keys, or through accessor methods — Request implements ArrayAccess:

$request->title;          // property access
$request['title'];        // array access
$request->get('title');   // with an optional default
$request->input('title', 'untitled');

isset($request->title);   // presence check
$request->has('title');

Bulk access:

$request->all();                  // every attribute
$request->except('password');     // everything but the named keys
$request->files();                // uploaded files
$request->queryParams();          // query string only
$request->body();                 // raw body

Request metadata:

$request->method();       // GET, POST, ...
$request->contentType();
$request->getRoute();     // the matched route

warning

Reading an attribute returns it unsanitized. Run input through validation — with a sanitize: rule — before storing it or echoing it back.

Validating

validate() takes a rules array, and returns only the fields that passed, after sanitization:

$validated = $request->validate([
    'id'    => ['required', 'integer'],
    'title' => ['required', 'string', 'sanitize:text'],
]);

On failure it answers immediately with a 422 and this body, so nothing after the call runs:

{
  "status": "error",
  "code": "VALIDATION",
  "data": { "title": ["The title field is required."] }
}

Custom messages and attribute labels are the second and third arguments:

$validated = $request->validate(
    ['title' => ['required']],
    ['title.required' => 'Give the tag a name.'],
    ['title' => 'Tag name']
);

Uploaded files are merged into the attributes before validation, so file fields validate like any other field.

Form requests

When a rule set is reused across actions — or is simply long — move it into a class under backend/app/HTTP/Requests. Extend Request and return the rules from rules():

namespace YourPlugin\HTTP\Requests;

if (!defined('ABSPATH')) {
    exit;
}

use YourPlugin\Deps\BitApps\WPKit\Http\Request\Request;

class ConnectionStoreRequest extends Request
{
    public function rules()
    {
        return [
            'app_slug'        => ['required', 'string', 'sanitize:text'],
            'auth_type'       => ['required', 'string', 'sanitize:text'],
            'connection_name' => ['required', 'string', 'sanitize:text'],
            'encrypt_keys'    => ['nullable', 'array'],
            'auth_details'    => ['required', 'array'],
        ];
    }
}

Type-hint the form request instead of Request on the controller method:

public function store(ConnectionStoreRequest $request)
{
    $validated = $request->validate($request->rules());
}

Name the class after the action it serves — ConnectionStoreRequest, ConnectionUpdateRequest, WebhookIndexRequest — so one request class maps to one route.