- How do I install emilianotisato/nova-tinymce in a Laravel Nova application?
- Install it with Composer using composer require emilianotisato/nova-tinymce, then publish the package assets and config so Nova can load the field's Vue component. After publishing, register the field on a resource with TinyMCE::make('Body') and it renders as a rich text editor in the Nova form. You will also need a working Laravel Nova installation, since this package is a Nova field and has no value without it. Rebuild or clear Nova's compiled assets if the editor does not appear immediately.
- Which Laravel Nova and TinyMCE versions does nova-tinymce support?
- The package is a thin wrapper, so its compatibility is bound to both Nova majors and TinyMCE majors at once, and those move independently. Check the repository's composer.json constraints and recent release notes for the Nova version range actually tested, and confirm which TinyMCE build the bundled assets correspond to. There is no formal published compatibility matrix in most releases, so treat the last release date as the real signal for whether the current Nova major is covered. If you are on the newest Nova release, test in a staging resource before adopting it widely.
- How do I enable image uploads in the TinyMCE field?
- Image upload is the package's main differentiator over Nova's stock fields, and it works by routing TinyMCE's image handler to a Laravel filesystem disk configured in the package config. You point the upload settings at a disk, and images are stored there while the editor inserts the resulting URL into the HTML content. Because the field stores plain HTML, the image references persist as absolute or relative URLs depending on your disk's public URL configuration. Verify the upload path end to end in a non-production environment before shipping it to editors.
- Can nova-tinymce store uploaded images on S3 or another non-local disk?
- Uploads are intended to go through Laravel's filesystem abstraction, so an S3-compatible disk should work where the config exposes a configurable disk name rather than hardcoding local public storage. Confirm this by reading the package's upload handler in source, since hardcoded local paths are a common shortcut in small Nova field packages. If the disk is configurable, make sure the disk has a public or signed URL strategy so inserted image URLs stay valid. Test MIME handling and size limits on the target disk separately, as remote storage behaves differently from local.
- Does nova-tinymce sanitize the HTML it saves to the database?
- No, and it should not be relied on for that. TinyMCE's client-side filtering is an editing convenience, not a security boundary, and the field simply persists whatever HTML string the editor submits into the column your resource already maps. Stored rich HTML that is later rendered to end users is a classic XSS vector, so sanitize on the server at save time or at render time using a library such as HTML Purifier or a strict allowlist approach. Treat any sanitization hook as your application's responsibility unless the package explicitly documents otherwise.
- How do I customize the TinyMCE toolbar, plugins, and editor options in Nova?
- The package exposes TinyMCE's configuration through its field or published config, so you can set toolbar groups, plugin lists, menubar behavior, and height the same way you would in a standalone TinyMCE init object. Options can typically be set per field with a fluent method or globally in the published config file, which keeps multiple resources consistent. Keep the plugin set lean, because every added plugin increases the asset payload loaded into the Nova admin panel. Re-publish or rebuild assets after changing which TinyMCE bundle is served.
- Do I need a TinyMCE Cloud API key, or can I self-host TinyMCE?
- Both paths exist and the choice is a procurement and compliance decision, not just a technical one. TinyMCE's cloud offering uses an API key with usage quotas and gated premium features, while the self-hosted community build avoids the key but makes you responsible for shipping and updating the editor bundle. Small Nova packages often load TinyMCE from a CDN or expect a key, so check how assets are sourced and what happens if that source is unreachable. Decide this before rollout so you are not discovering licensing terms in production.
- Is the nova-tinymce image upload endpoint protected by authentication and Nova field authorization?
- This must be verified in the package source rather than assumed. Check that the upload route sits behind Nova's authenticated middleware, enforces MIME type and file size validation, and respects field-level authorization rules so a user who cannot edit the field cannot post files to it. MIME sniffing, extension allowlists, and per-disk authorization are the usual weak points in small upload implementations. If any of these are missing, add a route-level guard or a custom upload controller before enabling the feature in production.
- Is emilianotisato/nova-tinymce actively maintained, and what is the bus factor risk?
- It is a single-maintainer package with modest adoption, so treat it as adopt with a pre-approved exit plan rather than a strategic dependency. The practical risk is version drift: the package must track Nova majors and TinyMCE majors, and a lag on either axis can stall your own upgrade. Skim the issue and pull request activity as a proxy for whether upstream will absorb the next Nova release. Because the integration is additive and stores plain HTML, the exit path is simple: swap in a stock Text field or another editor and your data is unchanged.
- Can I migrate existing Nova Text or Trix field content to nova-tinymce?
- Migration is structurally easy because the field writes an HTML string to a normal database column, so an existing content column can be reused without schema changes. If your current field stores plain text, the old values will render as unformatted text inside the editor and you may want a one-time conversion pass. If it already stores HTML, switching the field class is usually enough, but re-check that any shortcodes, embeds, or custom markup survive TinyMCE's filtering on first edit. Back up the column before switching fields in production.