- How do I install tizis/lara-comments in a Laravel app?
- Run composer require tizis/lara-comments, then publish the package config and migrations with the artisan vendor:publish command. Run php artisan migrate, add the package trait to the model that should receive comments, and configure auth gates and HTMLPurifier rules before exposing writes. Test on a disposable database first because package defaults are not a full moderation policy.
- Which Laravel and PHP versions does tizis/lara-comments support?
- The last release was March 2023, so the package is best treated as targeting Laravel 8-10 and PHP 8.0-8.2. Laravel 11 and 12 support should not be assumed; check the illuminate constraints and run a compatibility spike. If your app is newer, plan for a fork or shim.
- Can tizis/lara-comments attach comments to any Eloquent model?
- Yes. The package uses a polymorphic commentable relationship, so you add its trait to any Eloquent model you want to comment on. That works well in a standard Laravel monolith or API backend that already uses morph relations, but it assumes the host app owns authorization and presentation.
- Are the API routes enabled by default, and how do I secure them?
- The API routes are optional and should be treated as opt-in, then reconciled with your app's middleware, auth guards, and rate limiting. Review the published routes and config before enabling them, and add throttling plus authorization checks on create, reply, rate, and delete endpoints. Do not expose the rating or reply endpoints without abuse controls.
- What are the default HTMLPurifier rules, and are they safe for untrusted comments?
- HTML filtering is customizable through HTMLPurifier, and the package defaults should be treated as a starting point rather than a safety guarantee. For untrusted comment input, review the allowed tags and attributes, disable risky URI schemes, and add server-side validation plus spam controls. Test with malicious payloads before production.
- Does tizis/lara-comments include moderation or an admin UI?
- No. tizis/lara-comments is a library, not a platform, so it has no admin UI, no moderation workflow, and no queue-backed processing beyond what you build. You will need to add pending, approved, and spam states yourself, plus any reporting or notification flows.
- How are replies handled, and is there an N+1 risk on deep threads?
- Replies are supported, typically through a parent_id relationship on comments. Deep threads can create N+1 query risk if you lazily load children recursively, so eager load replies, paginate thread reads, and add indexes on parent_id and the morph columns. Cache or precompute deep thread fragments if you expect high read volume.
- Is the comment rating a vote or star system, and can I disable it?
- The package includes a comment rating feature, but the README does not clearly define whether it behaves as a simple vote or a star rating, so inspect the migrations and controller methods before depending on it. You can disable it by not exposing the rating routes and removing rating controls from your UI, and by reviewing the published config. Treat it as a basic building block, not a full reputation system.
- What happens to comments when the parent model is deleted?
- Deleting a parent model can orphan its comments because a polymorphic commentable relation cannot enforce a foreign key on every parent table. Check the package migration for cascade behavior on reply parent_id, and add model observers or cleanup jobs to delete or reassign comments when a commentable model is removed. Test deletes on a disposable database before rollout.
- Is tizis/lara-comments maintained and safe for production?
- The package is a single-maintainer project with about 119 stars and no release since March 2023, so the main risk is lifecycle rather than code quality. Pin the version, audit its HTML filtering and auth defaults, and budget for a fork if you need Laravel 11 or 12 support. Ask whether there is a security disclosure process before putting it on an abuse-facing surface.