Advanced Laravel Tips — Step-by-Step Guide & Transcript

[00:00] Hello guys! In this video I will show you three tips that I would call advanced level from Laravel and PHP based on AI software tycoon codebase that I released like a week ago and that was a video on my channel if you haven't watched that

[00:13] one I will put the link in the description below so I will show you three things first what happens if anyone while playing the game or in any form for your applications would have another tab opened with the same form

[00:28] and how to prevent data duplication. The second tip will be about architecture. So how to have the backend game engine or engine of your SaaS, for example, in AppGame, which is PHP, without Laravel.

[00:41] Any code of Laravel would be forbidden in that folder, and that would be ensured by automated test. And then the third tip would be about how to allow your users to start something,

[00:53] start a campaign of a game or your SaaS, some kind of action without user ID, anonymous in session, but then at any point you would be able to create account and then get redirected to your already work in progress.

[01:09] So all of those were relatively short tips, so I thought to combine them in one a bit longer video. Let's dive in. So when working with forms, and in my case I have a form to build action basket for one turn of the game,

[01:23] how do you deal with situation that this form may be also opened in another browser tab? Which may be accidental or maybe malicious attempt to do something with the state of the record.

[01:35] So, for example, what happens if I, like, choose a few actions, and before submitting the action, I take the same URL, open it in another browser with fresh state of month 2 of the game,

[01:47] and then I submit the first browser, and then it changes the state, and then I move on to perform some other action, and now I'm on month 3.

[01:59] But this form is in the beginning of month 2. So what happens if I choose other actions? It doesn't allow me to. So there is a check that immediately redirects to the current latest state of that record.

[02:14] So how to deal with that? So, in the database I have games database table and let me refresh that and I have some active games or in fact the latest active is this one by created add and here you see

[02:28] version column. So that column is increased with every step of the game and then it is checked for updates. Let me show you in the code. It's kind of an interesting trick done by Codex in this case, but I really like the

[02:43] idea. when saving any state of the game, any form on any month, there's update with snapshot game ID where version equals the same version that was in the beginning of loading that page. So when you

[03:00] load the form, you read the version from the database, and then when you update that record with a new status, new choices, new months, or whatever, you have this. The check if affected

[03:13] rows is not one which means if the version doesn't exist anymore in that database state then the update doesn't actually happen or in fact in my case it

[03:26] did already happen in another browser tab which increased the version by plus one and then in the case of that second kind of malicious update or update by mistake then

[03:38] you can choose what you want to do. So throw new exception in this case, for example. Then, for example, you may catch that exception elsewhere. So, for example, in this campaign, we have try catch with a message of this component

[03:52] changed before the submission completed and then redirect somewhere or show the message to reload the browser. The next tip will be about separation of app game php folder the game engine

[04:05] the backend php from visual layer of laravel and livewire and how to ensure that with automated architectural tests. But before I show you that code I want to thank my sponsor for this video

[04:19] who allow me to keep shooting these free videos for you guys on youtube. This video is sponsored by Sparty, again under the tool Flare to monitor and track errors in Laravel, PHP and JavaScript

[04:31] projects. So this is the part I want to show in this video. It's not just for Laravel. In their docs, just look at the variety of tech stack options they support. And I will try it in React, I have a new project with React starter kit of Laravel, and I will ask

[04:47] Cloud Code to install everything for me. So there are instructions at the bottom, but I can choose NPM or other package manager or bundler, and I will choose the project, so I have a separate test project of Flare, and I copy the instructions, paste them into

[05:03] my cloud code, and let's see what happens. And actually, this is even better in cloud code, because it will challenge some things if it's not according to the docs. So in this case, I have Inertia plus React, so the installation should be a bit different,

[05:16] and it challenges a few things, and then I need to reprompt or confirm how exactly I to do some things. And this was done in almost two minutes with changes in JavaScript here,

[05:28] in the TSX, then another TSX, then main app, but also the changes in Zed config and in .env, and let's see if it actually works. So if I go to that website in the browser, for example, let's

[05:43] click around and register, and JavaScript should be running, and let's see if anything landed on Flare because there was flare.test like this. Yep, so it is running powered by one line in

[05:57] JavaScript. Here there was flare test. So now it is confirmed and I can remove that line. So yeah, Flare is tracking not only Laravel but JavaScript and not just JavaScript but React,

[06:11] Vue and also Svelte. Try it out in your full stack projects. And thank you again to Sparky you for sponsoring my videos on this channel. And now I'll get back to this video. So, as I mentioned, there's a separation of backend game engine with PHP, and there's kind of a small-ish layer of

[06:29] routes web with Laravel and Livewire, and routes web is just a few lines, basically. So, you're playing the game, and behind the scenes, there's a huge PHP, I call it engine, it's not a visual 3D

[06:42] but it's a huge PHP set of files with a lot of classes, validators, factory strategies and stuff like that. But the thing is, nowhere in these classes you would see Laravel.

[06:55] No illuminate, no eloquent, no auth. So if we open any campaign rules for example it a PHP class with properties with public and private methods but there is no laravel here these internal classes don know anything about laravel which

[07:13] allows to create the front-end layer with livewire or with javascript or create a mobile application which i'm in progress by the way with with native php that's a separate video on native php daily

[07:27] channel coming soon hopefully. So yeah that separation of concern is ensured by automated test. Let me show you that. So this is the automated unit test called phase 8 framework

[07:41] boundary test. I was doing that in phases and that code was generated by GPT Sol and Luna so that's why the naming is pretty funny. This is a test for phase 8 out of 10 phases I was working

[07:55] with, but these are the methods. And the names of those methods basically have the meaning without booting Laravel and framework neutral game. Let me show you the code. So the first

[08:07] method is creating the scenario for the game, which is in the app game engine. You can see app game, no Laravel here, and it tries to simulate the game and expect that it actually

[08:19] works without any Laravel. So that's kind of the first step, without booting Laravel. But then down below we see the files and folders and classes list that are allowed. So this is the code, again written by Codex, but I really liked the logic here.

[08:35] So we recursively iterate through files and folders and assert something like this. So assert framework neutral game module, which is an internal function in the same test,

[08:47] and then for each of these namespaces basically as I mentioned illuminate models database if it happens then we throw exception which means the test failed similar thing assert allowed dependencies

[09:02] and there we will have a separate logic of what is allowed within which folder of that game engine it's not even about separating Laravel in this case this goes deeper so ensuring the boundary

[09:17] of specific design patterns with what is the contract what is the domain it's kind of a domain driven design DDD in a way so yeah which namespaces are allowed which folders and which subfolder of app game so it goes even deeper in a way it

[09:34] is similar to past architecture testing shares the documentation so you can do something like this in past so expect app folder to not use DDD or expect models

[09:46] to extend model or expect traits to be well traits and stuff like that but this is deeper implementation with php and with folders so this is a custom thing but for more simple scenarios

[10:01] and more restrictions of files folders and classes you may also use past architecture testing and the final tip will be about how to save session of a game in this case or your sass project for example

[10:15] without creating the user yet, and they may create a user register some time later. So, for example, I can start a company without being registered. I go on to click something, and it is in the database with user ID null,

[10:32] but at any point I can go create account I will use Fix Your Chrome Extension create account and then I redirected to my own company in progress or start another company so I

[10:45] can get back here and continue my game now with user ID assigned how does it work and I will show you a few tricks along the way so first this is the method around that thought the game and it has DB transaction and check if we

[11:00] have instance of user, then we have user ID operations, otherwise we just begin month, and we have only game ID, no user ID, and if user is no, we remember anonymous game,

[11:15] which goes into session, like this, and then the game keeps being played, and then at some point I go to, well, register, this is live wire component, what could be a controller for registration, and then I have this. So, some validation, rate limiting, and then I create a user,

[11:33] log in, and then this. The method claim anonymous games from session, and it gets anonymous game IDs from session. This is the method, private method. Then we get those IDs, which may be

[11:47] multiple IDs, by the way, and then for all of them, we update the user ID, we forget the session of game IDs and we move on with the game already logged in. One more thing about the ownership

[12:01] of the game, the check. So, there's a set accessible. So, we have the check if the game, the ID of the game belongs to the user themselves and that method checks the ownership by user,

[12:14] the logged in user and game ID and if it doesn't match, then it throws not 403 forbidden but 404 not found. Which means that the user that is trying to do something malicious

[12:27] wouldn't know if the record exists, and they just don't have access, which means they can continue trying to hack something, or 404 wouldn't give them any information, like, does the

[12:39] record not exist, or maybe the ID is wrong, or maybe they don't have access, so this is kind of extra security thing. And I remember recently Nuno Maduro on his YouTube channel shot this video, published

[12:51] this video always return 404 this was one of the security mistakes he mentioned so I advise you to watch that video as well and in general in Laravel you can do kind of a trick with gate define there is a thing called response deny as not found which will be exactly the same behavior

[13:08] returning 404 instead of default 403 for gates or similar with form requests and policies and the And finally, with anonymous games, there is a command to prune anonymous games, delete

[13:21] them from the database hourly, and then you can customize what is the old game. So if there is a game without the session, without the user ID, you may delete that from

[13:33] the database and config that in session lifetime, for example, 120 minutes. So yeah, three quick tips from my AI software tycoon, again, mostly generated by GPT-56

[13:46] and Luna, but I was reviewing the code pretty deeply and even deeper after it was released and found quite a few interesting gems, so I think it was worth showing you here on YouTube.

[13:58] But what do you guys think? Did you learn anything new or was it boring or do I need to go deeper in one of those topics? Let's discuss in the comments below as usual. That's it for this time and see you guys in other videos.