Laravel Menu Laravel Package

Getting Started

• Install with composer require <vendor>/<package> and publish config only if you need to override defaults (php artisan vendor:publish --tag=<package>-config). Most day-to-day use works with zero config.
• Look first at the package's model/DTO classes and their $fillable property. As of 3.1.2 these are public, so you can read them at runtime without reflection — this is the single most useful entry point for understanding what the package will and won't mass-assign.
• First use case: introspect the fillable contract before writing any create/update code.

$fillable = (new Vendor\Package\Models\Thing)->getFillable(); // or ->fillable now that it's public

• Then build your first flow: instantiate the package model/DTO, create() through the package service or repository, and confirm the persisted attributes match $fillable.

Implementation Patterns

• Contract-driven form/validation generation. Because $fillable is public, derive validation rules or form fields directly from it instead of duplicating the attribute list:

$rules = collect($model->fillable)
    ->mapWithKeys(fn ($attr) => [$attr => ['sometimes', 'nullable', 'string']])
    ->all();

• Runtime fillable adjustment per tenant/module. Public visibility lets you open up or restrict attributes conditionally — useful in multi-tenant apps where a subset of clients get extra fields:

if ($tenant->hasFeature('extended_profile')) {
    $model->fillable = [...$model->fillable, 'vip_note', 'internal_ref'];
}

• Test assertions against the public contract. Assert that your app-level model extension keeps the expected fillable surface after a package upgrade:

$this->assertContains('email', (new User)->fillable);

• Documentation and OpenAPI generation. Point your schema generators at the public $fillable array rather than hand-maintained lists, so package upgrades propagate into your API docs automatically.
• Wrapper/subclass pattern. Extend the package model and add your own attributes in the child; you now have a public parent property to merge against rather than re-declaring blindly.
• Admin tooling / CRUD scaffolding. Generators can read $fillable from the container-resolved model to build index/create/edit screens without reflection or config duplication.

Gotchas and Tips

• Subclass visibility is now a hard constraint. If you previously redeclared protected $fillable in a class extending a package model, upgrading to 3.1.2 causes a fatal error: Access level to X::$fillable must be public (as in class Y). Change your override to public $fillable (or better, merge in the constructor/boot).
• Public does not mean safe to mutate casually. $fillable is per-class state, not per-instance-per-request in a meaningful sense — mutating it in one place affects every instance resolved afterwards in that request. Mutate early (service provider boot, dedicated configurator) and never inside a loop over heterogeneous records.
• Widening visibility is technically non-breaking but is an API surface commitment. Treat the public property as part of the package's contract: if you build generators against it, pin the version range and re-run your introspection tests on minor bumps.
• Don't confuse fillable with safe. A public $fillable is a convenience for tooling, not a security boundary. Keep $guarded, casts, and FormRequest authorization doing the real work — never accept user-supplied attribute names and assume $fillable filters them appropriately.
• Debugging tip: if a mass-assignment silently drops an attribute, dump the public $fillable from a freshly resolved instance before any runtime mutation, and compare against what your request payload sends. Divergence there is the usual culprit.
• Extension point: prefer overriding via a subclass + merge in the parent constructor, or a package-level config key, over direct property mutation. That keeps you compatible if a later release tightens visibility or swaps the property for a method (getFillable()/setFillable()), which is the likely next step if the property keeps growing.
• Watch the changelog for a follow-up release converting $fillable into accessor methods; that would be breaking for anyone reading the property directly, and would require moving to getFillable().