Filament Rich Editor Extender Laravel Package

Getting Started

Install and pin the fixed patch

composer require <vendor>/<package>:"^1.1.3"

v1.1.3 is a patch release with no API changes — if you are already on 1.1.x, bump and run composer update. If you use Laravel Boost, this version is the first that will not blow up during boost:install.

Wire it into a model

1. Add the package's rich-content trait to the model that owns the content (e.g. Post).
2. Ensure the backing column exists (commonly a content text/LONGTEXT column) and that it is fillable, or that you assign it explicitly.
3. Cast/configure the attribute if the package exposes a cast or config entry — check config/ after php artisan vendor:publish.

First use case: render stored content in Blade

{!! $post->renderRichContent('content') !!}

That raw echo is the intended contract: the method returns an HTML string, not an escaped value. Your first task after getting it on screen is deciding where sanitization happens (see Gotchas).

Where to look first

• The package README for the trait name, method signature, and supported attribute/field argument.
• config/<package>.php for sanitizer, allowed-tags, and renderer settings.
• resources/boost/guidelines/core.blade.php in the vendor tree — this is the machine-readable usage guide that Laravel Boost feeds to AI agents. Run php artisan boost:install and it becomes the authoritative reference for how the package expects to be used, which is often more current than prose docs.

Implementation Patterns

Trait-on-model, render-at-the-edge. Keep the raw markup in the database and call renderRichContent() in the view, mail template, or API resource — not in the controller. This keeps the model free of presentation concerns and lets you swap renderers later.

Blade views

<article class="prose">
    {!! $post->renderRichContent('content') !!}
</article>

Wrap output in a styling scope (prose, a .rich-content class) rather than restyling the generated tags globally.

API / JSON responses. The method returns a string, so hand it to a resource explicitly rather than relying on toArray():

return PostResource::make($post->load('author'));
// in the resource:
'content_html' => $this->renderRichContent('content'),

Consider emitting both content (raw/source) and content_html (rendered) so clients can choose.

Mail and notifications. Render inside the Mailable's build()/content() so the HTML is produced once per send; markdown mailables will escape it, so use an HTML view for rich bodies.

Caching. Rendered HTML is a pure function of the stored field plus config. Cache it on the model (Cache::remember("post:{$id}:html:{$updatedAt}", ...)) and key on updated_at so edits invalidate naturally.

AI-assisted development with Boost. Once boost:install has run, ask your agent for "package X usage" and it will read the guideline file. When you upgrade the package, re-run boost:install so the agent's guidance tracks the installed version rather than a stale copy.

Testing. Assert on rendered output, not on the raw column:

$post = Post::factory()->create(['content' => '<p>Hello <strong>world</strong></p>']);
$this->get("/posts/{$post->slug}")
    ->assertSee('<strong>world</strong>', escape: false);

Include a fixture with a disallowed tag (<script>, onclick=) to lock in your sanitization policy.

Gotchas and Tips

Raw echo is the trust boundary. {!! !!} around renderRichContent() is safe only if the stored markup is trusted or sanitized. If content comes from users, sanitize on write (a sanitizer in the model's mutator or a form request) or on read via the package's config. Do not rely on Blade escaping here — it will visibly mangle legitimate markup instead of protecting you.

Do not paste the guideline snippet into a Blade file unescaped. This is exactly the bug v1.1.3 fixed: resources/boost/guidelines/core.blade.php contained a live {!! $post->renderRichContent('content') !!}. Boost compiled that file as a real Blade view, so boost:install failed with an "undefined $post" error. The snippet is now wrapped in @verbatim. If you have copied package snippets into your own .blade.php docs, wrap them in @verbatim too.

Upgrade note for v1.1.3. If php artisan boost:install has ever failed for you with an undefined-variable error mentioning $post, this is the fix — upgrade and re-run the installer. There are no breaking changes, no signature changes, and no migration steps. Pin ^1.1.3 rather than ^1.1.0 so CI picks up the fix.

Sanitizer config is global. Tightening allowed tags affects every model using the trait. If two content types need different policies, override the trait method per model or pass configuration at call time if supported; don't fork the config file.

N+1 on rendered relations. Rich renderers often reach into media, authors, or embeds. with() those relations before rendering, or the render call becomes a query per row in an index listing.

Debugging a blank or literal output. Dump the raw attribute first ($post->getRawOriginal('content')) to confirm the data is there. If you see escaped tags on the page, you have a double-escape from an extra {{ }} or a Markdown mail view. If you see nothing, check the sanitizer config — an aggressive allow-list can strip everything a user submitted.

Extension points. Look for a publishable Blade view or formatter binding before subclassing; overriding a container binding or config key survives upgrades far better than overriding the trait method. Custom sanitizer implementations are usually the right place for house rules, keeping the trait untouched.