- Can I use glifery/entity-hidden-type-bundle in a Laravel application?
- No. It is a Symfony2 bundle that depends on symfony/form, the Symfony bundle kernel and Doctrine ORM, none of which exist as such in a standard Laravel stack, so its core mechanism has no host to attach to. Pulling it in would add a large Symfony and Doctrine dependency graph just to obtain an ID-to-entity transformer. In Laravel you get the same capability in roughly 20 to 40 lines using a hidden input, exists validation and a policy check.
- What Laravel and PHP versions does this package support?
- It does not support Laravel at all. The bundle targets Symfony 2.3 to 2.8 and PHP 5.x to 7.x, with the last release dated 2017-07-18, and any claim of PHP 8 or Symfony 5 and 6 support should be treated as unverified. Trying to satisfy its constraints in a modern composer.json usually produces unresolvable dependency graphs rather than clean errors.
- How do I pass an entity ID through a hidden form field in Laravel?
- Render a hidden Blade input containing the key, validate it in a FormRequest with the exists:table,id rule, then resolve the model with findOrFail or route model binding. Finish with an authorize call or a policy check before associating the model. This keeps the implementation first-party, testable and free of extra framework dependencies.
- Is it safe to store an entity ID in a hidden input field?
- A hidden field is fully client-tamperable, so it is a textbook insecure direct object reference surface. Anyone can post an arbitrary ID, which means you must validate that the record exists and run an explicit authorization check on every submission. The bundle handles the ID-to-entity conversion only; the authorization check is the real work and it does not provide it.
- How do I convert a submitted hidden ID back into an Eloquent model?
- Validate the incoming value first with exists:table,id or a custom rule, then resolve it with findOrFail or route model binding. Authorize the resolved model through a policy or Gate before attaching it to anything. If the field is optional, mark it nullable and handle the null case explicitly instead of relying on fallback behaviour.
- Does this bundle work with Symfony 5 or Symfony 6?
- No. The bundle is built for Symfony 2.3 to 2.8 and uses deprecated APIs such as setDefaultOptions and getName that were removed in Symfony 3 and 4. On modern Symfony, write a small AbstractType wrapping HiddenType with an IdToEntityTransformer built on EntityManagerInterface and register it as a service. That removes two framework-level dependencies and restores testability.
- Is entity-hidden-type-bundle still maintained?
- It appears abandoned. The last release is 2017-07-18 from a single maintainer, with around 18 stars, zero dependents and no CI signal or security disclosure path. If a legacy Symfony application already depends on it, vendor a fork into your monorepo, pin the version and wrap it behind an internal form type so call sites are insulated from the eventual replacement.
- How do I handle UUIDs or composite keys with a hidden entity field?
- The legacy implementation assumes a scalar identifier, so UUIDs and composite keys either fail silently or throw confusing errors. In Laravel, validate UUIDs with the uuid rule or a custom rule, resolve the record with findOrFail, and never accept a raw composite key without splitting and validating each part. For non-integer keys, prefer route model binding with an explicitly bound key.
- What are the alternatives to this bundle for hidden entity fields?
- In Laravel the alternative is first-party code: a hidden input, exists validation or route model binding, and a policy or Gate check before association. In Symfony 4 and later it is a roughly 30-line custom AbstractType wrapping HiddenType with an IdToEntityTransformer built on EntityManagerInterface, registered as a service. Both approaches remove the Symfony 2-only dependency and keep the logic testable.
- How do I migrate away from entity-hidden-type-bundle?
- Do not port the bundle; reimplement the transformer logic. Confirm the requirement is genuinely an entity reference the user cannot choose, rather than one where the user simply should not see the full list, then write the validation and authorization in-house this sprint. If a legacy application already depends on it, pin a vendored fork and schedule removal against the next form-layer refactor.