- How do I install ronnytorresmtz/comments in a Laravel Nova application?
- Install it with Composer, then publish the package migrations and configuration and run the migrations. Add the package trait to the Eloquent models that should receive comments, and verify Nova compatibility before deploying. Check the package README or composer.json for the exact publish tags and Nova version constraints.
- Which Laravel, PHP, and Nova versions does this comments package support?
- The provided overview does not list an explicit Laravel, PHP, or Nova support matrix, so confirm constraints in the package composer.json, README, and release notes. Verify compatibility with your Nova major version before installing, especially in an existing admin panel. Pin a tested version and include Nova and Laravel upgrades in your compatibility checklist.
- How do I attach comments to an Eloquent model with this package?
- Add the package trait to the model that should be commentable, then use the package API to create and retrieve comments for that model. The package uses polymorphic relations, so one comments table can serve multiple model types. Publish and run migrations first, and test the trait on a representative model before rolling it out broadly.
- Does allowToShowAllCompaniesComments() enforce authorization or just change query scope?
- Based on the technical assessment, allowToShowAllCompaniesComments() likely changes query visibility for system admins rather than enforcing access control itself. You should wrap calls in Laravel policies or gates and confirm how companies are identified in your tenancy model. Do not expose cross-company visibility without an explicit system-admin role check.
- What changed for showOnlyMyComments() in version 1.0.8?
- Version 1.0.8 fixes showOnlyMyComments() so its boolean argument is honored, which can change comment visibility after upgrade. Existing deployments may see different results when calling showOnlyMyComments(false). Regression-test both true and false paths against your existing Nova UI expectations before production rollout.
- How are companies or tenants identified for cross-company comment visibility?
- The provided material does not specify whether the package uses a tenant ID, an Eloquent relationship, or a global scope for company identification. Inspect the package configuration, migrations, and source code and validate them against your application tenancy model. Confirm this before enabling system-admin cross-company visibility.
- Are the migrations additive and reversible?
- The assessment does not confirm whether every migration is additive or reversible, so review the published migration files before running them. Test migrate and rollback in a non-production Nova environment with representative data. Take a backup and stage the rollout if existing comment or audit tables are involved.
- Can I use this package without Laravel Nova?
- The package is positioned as a Laravel Nova Comments add-on, and the assessment says it is less suitable if your team does not use Nova. The overview describes Eloquent commenting, but Nova integration and authorization hooks may be central to its intended use. If you need framework-agnostic commenting, evaluate alternatives or spike the package outside Nova first.
- How should I test comment visibility after upgrading to v1.0.8?
- Pin v1.0.8 in a non-production environment and test with representative multi-company data. Exercise showOnlyMyComments(true) and showOnlyMyComments(false), plus any cross-company system-admin path behind explicit authorization. Check for schema changes, audit the before-and-after visibility, and add indexes for company and comment lookups if needed.
- What are the production risks of enabling system-admin cross-company comment visibility?
- The main risk is data leakage if allowToShowAllCompaniesComments() is exposed without strict policy or gate enforcement. The showOnlyMyComments() fix can also change existing visibility behavior, so regression testing is required. Mitigate with audit logging, pagination, company and comment indexes, and a staged rollout with monitoring.