Merge pull request #1 from dynamik-dev/chore/laravel-13-and-v0.2.0-improvements

chore(release): v0.2.0 — Laravel 13 + PHP 8.5, security & correctness…

Author: christopherarter

.bully.yml

@@ -1,9 +1,23 @@
+schema_version: 1
+
 # modman .bully.yml
 #
-# Bully wraps the three existing gates so they run at edit-time instead of only
-# in CI: Laravel Pint (format), Larastan (static analysis), and the Pest
-# architecture suite. Each rule no-ops gracefully if its binary isn't installed
-# yet, so bully works in a fresh clone before `composer install`.
+# Bully wraps the project gates so they run at edit-time instead of only in
+# CI: Laravel Pint (format), Larastan (PHPStan static analysis), the Pest
+# architecture suite, and composer manifest validation. Each rule no-ops
+# gracefully if its binary isn't installed yet, so bully works in a fresh
+# clone before `composer install`.
+
+skip:
+  - "vendor/**"
+  - "storage/**"
+  - "bootstrap/cache/**"
+  - "public/build/**"
+  - ".phpunit.cache/**"
+  - ".bully/**"
+  - ".git/**"
+  - ".idea/**"
+  - ".vscode/**"
 
 rules:
   pint:
@@ -17,22 +31,34 @@ rules:
 
   larastan:
     description: >
-      Larastan (PHPStan level 9 via phpstan.neon) catches type errors,
-      null-safety issues, and Laravel-specific mistakes. Running it per
-      edited file gives fast feedback without waiting for the CI matrix.
+      Larastan (PHPStan level 9 via phpstan.neon, with phpstan-strict-rules)
+      catches type errors, null-safety issues, and Laravel-specific mistakes.
+      Running it per edited file gives fast feedback without waiting for the
+      CI matrix.
     engine: script
     scope: ["src/**/*.php", "database/factories/*.php"]
     severity: error
     script: "[ -x vendor/bin/phpstan ] && { vendor/bin/phpstan analyse --memory-limit=1G --no-progress {file} && exit 0 || exit 1; } || exit 0"
 
   pest-arch:
     description: >
-      The Pest architecture suite (tests/Arch/ArchTest.php) enforces
-      package invariants: strict types everywhere in src/, contracts are
-      interfaces only, graders/policies are final, events are final
-      readonly, no debug calls, no direct Guzzle usage, and so on. Any
-      change under src/ or tests/Arch/ should re-run it.
+      The Pest architecture suite (tests/Arch/ArchTest.php) enforces package
+      invariants: strict types everywhere in src/, contracts are interfaces
+      only, graders/policies are final, events are final readonly, no debug
+      calls, no direct Guzzle usage, and so on. Any change under src/ or
+      tests/Arch/ should re-run it.
     engine: script
     scope: ["src/**/*.php", "tests/Arch/*.php"]
     severity: error
     script: "[ -x vendor/bin/pest ] && { vendor/bin/pest --testsuite=arch --compact && exit 0 || exit 1; } || exit 0"
+
+  composer-validate:
+    description: >
+      `composer validate --strict` checks composer.json for schema errors,
+      version normalization, and required keys. It is sub-second and cheap
+      to run on every manifest edit, so a malformed composer.json never
+      reaches CI.
+    engine: script
+    scope: ["composer.json"]
+    severity: error
+    script: "composer validate --strict --no-check-publish"

.composer-require-checker.json

@@ -18,6 +18,7 @@
         "Illuminate\\Database\\Eloquent\\Relations\\HasMany",
         "Illuminate\\Database\\Eloquent\\Relations\\MorphMany",
         "Illuminate\\Database\\Eloquent\\Relations\\MorphTo",
+        "Illuminate\\Database\\Eloquent\\Relations\\Relation",
         "Illuminate\\Foundation\\Bus\\Dispatchable",
         "Illuminate\\Http\\JsonResponse",
         "Illuminate\\Http\\Request",
@@ -26,6 +27,7 @@
         "Illuminate\\Routing\\Controller",
         "Illuminate\\Support\\Facades\\DB",
         "Illuminate\\Support\\Facades\\Event",
+        "Illuminate\\Support\\Facades\\Gate",
         "Illuminate\\Support\\Facades\\Http",
         "Illuminate\\Support\\ServiceProvider",
         "Illuminate\\Support\\Str",

.gitattributes

@@ -0,0 +1,34 @@
+# Files and directories below are stripped from the Composer dist archive.
+# Consumers running `composer require dynamik-dev/modman` get only runtime
+# code — no test fixtures, no CI metadata, no editor cruft. Reduces install
+# size and removes files that have no business in vendor/.
+
+# Tests, fixtures, and test config
+/tests                  export-ignore
+/phpunit.xml            export-ignore
+/.phpunit.cache         export-ignore
+/.phpunit.result.cache  export-ignore
+
+# Static analysis and lint config
+/phpstan.neon           export-ignore
+/pint.json              export-ignore
+/.composer-require-checker.json export-ignore
+
+# Agentic-lint (bully) config and telemetry
+/.bully.yml             export-ignore
+/.bully                 export-ignore
+
+# CI, GitHub metadata, and contributor docs
+/.github                export-ignore
+/.gitattributes         export-ignore
+/.gitignore             export-ignore
+
+# Project planning, agent context, and ADRs
+/CLAUDE.md              export-ignore
+/backlog                export-ignore
+/docs/superpowers       export-ignore
+
+# IDE and tooling caches
+/.idea                  export-ignore
+/.vscode                export-ignore
+/.claude                export-ignore

.github/workflows/ci.yml

@@ -11,8 +11,14 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        php: ['8.3', '8.4']
-        laravel: ['11.*', '12.*']
+        php: ['8.3', '8.4', '8.5']
+        laravel: ['11.*', '12.*', '13.*']
+        # spatie/laravel-model-states 2.12.2+ (the first version supporting
+        # Laravel 13) requires PHP ^8.4, so the 8.3 × L13 combination is not
+        # an installable target even though Laravel 13 itself accepts PHP 8.3.
+        exclude:
+          - php: '8.3'
+            laravel: '13.*'
 
     steps:
       - uses: actions/checkout@v4
@@ -34,9 +40,6 @@ jobs:
       - name: PHPStan
         run: vendor/bin/phpstan analyse --memory-limit=1G --no-progress
 
-      - name: Rector (dry run)
-        run: vendor/bin/rector process --dry-run --no-progress-bar
-
       - name: Pest — arch
         run: vendor/bin/pest --testsuite=arch
 

.gitignore

@@ -8,3 +8,4 @@ composer.lock
 .rector/
 .idea/
 .vscode/
+.bully/

README.md

@@ -112,18 +112,20 @@ When `routes.enabled` is `false`, the package registers no HTTP routes — wire
 
 ### Authorization gates
 
-modman defines two gates with fail-closed defaults:
+modman defines three gates with fail-closed defaults:
 
+- `modman.view` — checked before `GET /modman/reports/{report}`
 - `modman.resolve` — checked before `POST /modman/reports/{report}/resolve`
 - `modman.reopen` — checked before `POST /modman/reports/{report}/reopen`
 
-Both deny by default (every request returns 403) until the host overrides them. Register replacements in any service provider that boots before `ModmanServiceProvider`, or simply at runtime — `Gate::has()` keeps the package from clobbering your definition:
+All three deny by default (every request returns 403) until the host overrides them. Register replacements in any service provider that boots before `ModmanServiceProvider`, or simply at runtime — `Gate::has()` keeps the package from clobbering your definition:
 
 ```php
 use Dynamik\Modman\Models\Report;
 use Illuminate\Support\Facades\Gate;
 use App\Models\User;
 
+Gate::define('modman.view', fn (User $user, Report $report) => $user->is_moderator);
 Gate::define('modman.resolve', fn (User $user, Report $report) => $user->is_moderator);
 Gate::define('modman.reopen', fn (User $user, Report $report) => $user->is_moderator);
 ```
@@ -142,8 +144,8 @@ The controllers respond with 401 when no user is authenticated, 403 when the aut
 
 ## Requirements
 
-- PHP 8.3+
-- Laravel 11 or 12
+- PHP 8.3+ (Laravel 13 requires PHP 8.4+ via spatie/laravel-model-states)
+- Laravel 11, 12, or 13
 - spatie/laravel-model-states ^2.7
 
 ## License

composer.json

@@ -7,24 +7,25 @@
         "php": "^8.3",
         "ext-intl": "*",
         "ext-mbstring": "*",
-        "illuminate/contracts": "^11.0|^12.0",
-        "illuminate/database": "^11.0|^12.0",
-        "illuminate/http": "^11.0|^12.0",
-        "illuminate/queue": "^11.0|^12.0",
-        "illuminate/support": "^11.0|^12.0",
+        "illuminate/contracts": "^11.0|^12.0|^13.0",
+        "illuminate/database": "^11.0|^12.0|^13.0",
+        "illuminate/http": "^11.0|^12.0|^13.0",
+        "illuminate/queue": "^11.0|^12.0|^13.0",
+        "illuminate/support": "^11.0|^12.0|^13.0",
         "spatie/laravel-model-states": "^2.7"
     },
     "require-dev": {
-        "orchestra/testbench": "^9.0|^10.0",
-        "pestphp/pest": "^3.0",
-        "pestphp/pest-plugin-arch": "^3.0",
-        "pestphp/pest-plugin-laravel": "^3.0",
+        "orchestra/testbench": "^9.0|^10.0|^11.0",
+        "pestphp/pest": "^3.0|^4.0",
+        "pestphp/pest-plugin-arch": "^3.0|^4.0",
+        "pestphp/pest-plugin-laravel": "^3.0|^4.0",
         "larastan/larastan": "^3.0",
         "laravel/pint": "^1.18",
-        "rector/rector": "^2.0",
-        "driftingly/rector-laravel": "^2.0",
+        "phpstan/phpstan-strict-rules": "^2.0",
         "icanhazstring/composer-unused": "^0.8|^0.9",
-        "maglnet/composer-require-checker": "^4.14"
+        "maglnet/composer-require-checker": "^4.14",
+        "phpstan/phpstan-deprecation-rules": "^2.0",
+        "roave/security-advisories": "dev-latest"
     },
     "autoload": {
         "psr-4": {

phpstan.neon

@@ -1,5 +1,7 @@
 includes:
     - vendor/larastan/larastan/extension.neon
+    - vendor/phpstan/phpstan-strict-rules/rules.neon
+    - vendor/phpstan/phpstan-deprecation-rules/rules.neon
 
 parameters:
     level: 9
@@ -15,3 +17,9 @@ parameters:
         -
             identifier: missingType.generics
             path: src/Models/Decision.php
+        # Laravel routes Builder/Request methods like lockForUpdate, pluck, and
+        # validate through __call. They are declared static on the underlying
+        # class but the framework expects instance-style calls; phpstan-strict-rules
+        # flags these as false positives.
+        -
+            identifier: staticMethod.dynamicCall

rector.php

@@ -40,11 +40,18 @@ public function report(?Model $reporter = null, ?string $reason = null): Report
             'state' => 'pending',
         ]));
 
-        Event::dispatch(new ReportCreated($report));
-
-        RunModerationPipeline::dispatch($report->id)
-            ->onConnection(RunModerationPipeline::connectionName())
-            ->onQueue(RunModerationPipeline::queueName());
+        // Defer both the domain event and the pipeline-job enqueue to commit.
+        // If a host wraps this call in a larger transaction that rolls back,
+        // listeners must NOT see a phantom Report and the queue must NOT receive
+        // a job pointing at a row that never persisted. DB::afterCommit() runs
+        // immediately when there is no active transaction.
+        DB::afterCommit(static function () use ($report): void {
+            Event::dispatch(new ReportCreated($report));
+
+            RunModerationPipeline::dispatch($report->id)
+                ->onConnection(RunModerationPipeline::connectionName())
+                ->onQueue(RunModerationPipeline::queueName());
+        });
 
         return $report;
     }