Artisan Gui Laravel Package

Getting Started

This release is a small, additive feature: URL generation can now be forced to the HTTPS scheme. Nothing is removed, so upgrading from v2.0.0 is a drop-in change — but it is a beta, so pin the exact version ("vendor/package": "2.0.1-beta2") rather than a caret constraint.

Minimal steps:

1. composer require vendor/package:2.0.1-beta2
2. php artisan vendor:publish --tag=package-config and open the published config file first — the HTTPS behaviour is almost certainly driven by a new key alongside the existing URL/scheme settings.
3. Read the package's service provider to see whether it rebinds Laravel's url singleton, decorates UrlGenerator, or wraps it. That determines whether the new flag affects route(), url(), asset(), and action() uniformly or only the package's own builder.
4. Clear cached config before testing: php artisan config:clear.

First use case to validate: a queue worker or console command that renders absolute URLs into emails. Those run outside a request, so there is no incoming scheme to inherit — forcing HTTPS there is the canonical reason this feature exists.

// config/package.php (key name per the published file)
'force_https' => env('PACKAGE_FORCE_HTTPS', env('APP_ENV') === 'production'),

Implementation Patterns

Environment-scoped forcing. Do not hardcode true. Drive it from APP_ENV or a dedicated env var so local Sail/Valet setups on http://localhost keep working while staging and production are pinned to HTTPS.

Per-call override over global config. Prefer the explicit argument/option where available so a single global setting doesn't leak into contexts that must stay scheme-relative (webhooks to internal services, health checks, mixed-content-tolerant iframes).

Pair it with TrustProxies. Forcing the scheme is only half the story behind a load balancer. Configure App\Http\Middleware\TrustProxies with Request::HEADER_X_FORWARDED_PROTO (or * if you control the edge) so $request->isSecure() agrees with what you generate. Mismatched detection is the usual source of "it redirected but the URL is still http".

Signed URLs are the highest-risk surface. If the package influences URL::signedRoute(), forcing the scheme changes the string that gets signed. Generate and validate in the same configuration, and audit any signature created before the deploy — in-flight email links or queued jobs holding pre-signed URLs will 403 after the switch. Roll out by forcing only for newly generated URLs, or re-issue long-lived signed links.

Testing hooks. In phpunit.xml, set the package's force flag explicitly per test suite rather than depending on APP_ENV. For assertions, URL::forceScheme('https') from Laravel core is a useful control to confirm the package's behaviour matches the framework's native one — divergence there is a bug, not a feature.

Integration points to sweep after enabling: pagination links (->links() emits absolute URLs), password reset and verification mailables, Storage::url() / CDN asset helpers, sitemap and canonical tag generation, and OAuth/SSO callback URLs registered with third parties (those must match exactly, scheme included).

Gotchas and Tips

• Beta stability. 2.0.1-beta2 means API churn is possible before 2.0.1 final. Read the diff between beta1 and beta2 rather than the changelog summary; "add forcing URL with HTTPS" is one line that may hide a changed default.
• Config cache is the classic silent failure. A stale bootstrap/cache/config.php will make the new key appear to do nothing. Always config:clear when debugging.
• Redirect loops. If the package forces HTTPS and you also have a ForceHttps middleware or a web-server rewrite, a misconfigured proxy can bounce requests between schemes. Keep exactly one layer authoritative.
• Asset URLs may be excluded. Many URL packages deliberately leave asset() alone because CDNs often serve over a different scheme or host. Verify rather than assume; forcing HTTPS on asset URLs pointing at an http:// CDN will produce mixed-content blocks rather than fixes.
• APP_URL disagreement. If APP_URL is http:// while the package forces https://, you get two sources of truth for host and scheme. Align them, then let the package handle only the scheme.
• Local development certs. Self-signed HTTPS in Docker/Sail will trigger browser warnings; keep force_https=false locally and test the enabled path in CI or staging instead.
• Debugging tip. Dump app('url') and check the class name — if it's still Laravel's UrlGenerator, the package's forcing logic is applied at call sites, not globally, and you need to trace the specific helper you are using.
• Extension points. The rebind in the service provider is the natural place to wrap behaviour (e.g. skip forcing for a specific host or route name). Prefer a small decorator around the package's builder over editing vendor config, so upgrades to the non-beta release stay clean.