Nova Toggle 5 Laravel Package

Getting Started

nova-toggle-5 gives Nova resources an inline on/off switch instead of a read-only boolean column, backed by its own toggle endpoint so the switch works from index, lens and relationship views without opening the detail form.

Minimal setup:

1. composer require almirhodzic/nova-toggle-5 (drop-in upgrade to v1.3.1 — no migrations, no code changes).
2. Publish the config (php artisan vendor:publish --tag=nova-toggle-config, check the readme for the exact tag) and add your togglable columns to the whitelist.
3. Swap Boolean::make('Active') for Toggle::make('Active') on the resource, scoping it with ->onlyOnIndex() if you only want it in tables.

Where to look first, in order: the published config (the attribute whitelist is the usual reason nothing happens), then the resource's policy (update gates the toggle), then routes/ or php artisan route:list --path=nova-vendor if you get a 404.

First use case worth wiring: an Active / Published flag on an index that admins flip in bulk while scanning the table — that is the whole point of the package, and it's exactly where the new soft-delete fix matters.

Implementation Patterns

Index-only toggles. Keep the field out of the detail form to avoid two sources of truth:

Toggle::make('Active')
    ->onlyOnIndex()
    ->rules('required', 'boolean'),

Whitelist the column, not the label. The config's togglable list is matched against the underlying attribute name, so a field labelled Is Live backed by is_live must be whitelisted as is_live. Treat this list as a security boundary, not boilerplate.

Trashed rows and lenses (v1.3.1). If a resource uses SoftDeletes, a "With Trashed"/archived lens surfaces rows that the package now resolves via withTrashed() before toggling. Previously these returned 404, which made the switch look broken rather than forbidden. If you maintain such a lens, this is the release to take.

// Archived lens — toggle now works on trashed models as of 1.3.1
public function fields(Request $request): array
{
    return [
        Toggle::make('Active')->onlyOnIndex(),
        Text::make('Deleted At')->sortable(),
    ];
}

Authorization stays uniform. Both whitelist and policy checks still run against trashed records, so a trashed row is 403 when the policy denies and only 404 when the record genuinely can't be resolved. Design your policy update method to handle trashed models explicitly rather than relying on the lookup to reject them.

Pair with canSee for role gating. ->canSee(fn () => $request->user()->isAdmin()) hides the control, but it is cosmetic — the endpoint still enforces the policy, so don't treat visibility as the guard.

Testing the endpoint. Write feature tests that actingAs a Nova user and hit the toggle route directly, asserting both the 200 path and the 403 path for a user without update. Include a withTrashed() case, since that's the regression this release fixed.

Gotchas and Tips

• 404 vs 403 is your first diagnostic. 404 means the record couldn't be resolved (wrong resource key, missing softDeletes on the model, stale route cache); 403 means the lookup succeeded and the policy or whitelist rejected it. Don't start editing policies until you've distinguished the two.
• softDeletes must actually be present on the model. The package branches on the Nova resource using soft deletes; a model with the SoftDeletes trait but a resource/table mismatch will still 404 from archived lenses.
• Config and route caching. Nova routes are dynamic, so php artisan route:cache in production can bite. After any upgrade run php artisan config:clear && php artisan route:clear before concluding the endpoint is missing.
• Whitelist mismatches fail quietly. An unlisted attribute surfaces as a blocked request rather than an error in the UI, and the switch may appear to snap back. Check the network tab's response body first.
• Bypass flows skip Nova's update pipeline. Toggles hit a dedicated endpoint, so observers, updating model events and updated_at touching may behave differently than in the detail form. Verify in staging if you hang audit logging or notifications off the model events.
• Gate::before super-admin bypasses silently widen toggle access for trashed records too — confirm that's intended before shipping to a lens that exposes deleted data.
• Extension point is the config and the field class, not vendor edits. If you need custom behaviour on a specific resource, compose with ->rules(), ->canSee() and policy logic rather than patching the package internals; the 1.3.1 patch landed as a one-line lookup change and vendor edits would have collided.