Commit Graph
449 Commits
Author SHA1 Message Date
Dan HarrinandAmp ea77942a70 Add JavaScript-rendered custom fields
Co-authored-by: Amp <amp@ampcode.com>
2026-09-21 21:29:36 +00:00
Dan HarrinandAmp e09c16a572 docs: document shared Blueprint workflow and Astra comparison (#20489)
Co-authored-by: Amp <amp@ampcode.com>
2026-09-11 09:17:35 +01:00
Dan HarrinandAmp f013f7ae15 docs: Document app authentication cache requirements (#20474)
* docs: Document app authentication cache requirements

Co-authored-by: Amp <amp@ampcode.com>

* docs: Use warning for app authentication cache requirements

Co-authored-by: Amp <amp@ampcode.com>

---------

Co-authored-by: Amp <amp@ampcode.com>
2026-09-09 10:42:41 +01:00
Dan HarrinandAmp ec36a799de docs: add compact panel theming guidance
Co-authored-by: Amp <amp@ampcode.com>
2026-09-07 19:27:43 +00:00
c0ead41bea Feature: Reusable MultiFactorChallenge class (#20353)
* extract MultiFactorChallenge

* docs

* Harden reusable multi-factor challenges

Co-authored-by: Amp <amp@ampcode.com>

---------

Co-authored-by: Dan Harrin <git@danharrin.com>
Co-authored-by: Amp <amp@ampcode.com>
2026-09-04 15:12:52 +01:00
dc34f6bb3d Do not trigger unsaved changes alert for action modals that cannot contain unsaved changes (#20331)
* Do not trigger unsaved changes alert for action modals that cannot contain unsaved changes

The panel-level unsaved changes alert hooked `beforeunload` whenever any
action was mounted, so read-only modals such as `ViewAction`'s warned
about unsaved changes that cannot exist. Mounted actions now expose a
`hasUnsavedChangesAlert` flag that the client-side guard checks, which
defaults to `false` for actions with a disabled schema and can be
controlled per action with `unsavedChangesAlert()`.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* Fix unsaved action changes alert edge cases

Co-authored-by: Amp <amp@ampcode.com>

* Prevent stale unsaved action alert state

Co-authored-by: Amp <amp@ampcode.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Co-authored-by: Dan Harrin <git@danharrin.com>
Co-authored-by: Amp <amp@ampcode.com>
2026-09-04 14:13:06 +01:00
babb82f4b3 Add the published assets to .gitignore on install (#20389)
* feat: add the published assets to `.gitignore` on install

`filament:install` now appends `/public/css/filament`, `/public/js/filament`
and `/public/fonts/filament` to the app's `.gitignore`, since those files are
copied out of the installed packages by `filament:assets` and do not need to be
committed.

Rules that are already ignored are left alone, the configured
`filament.assets_path` is respected, and nothing happens if the app has no
`.gitignore` file.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015vxpe34oAqmDtzZxC8HSV2

* fix: preserve `.gitignore` formatting during installation

Co-authored-by: Amp <amp@ampcode.com>

* docs: clarify custom theme deployment

Co-authored-by: Amp <amp@ampcode.com>

* fix: place published asset ignore rules with public paths

Co-authored-by: Amp <amp@ampcode.com>

* fix: preserve leading whitespace in ignore rules

Co-authored-by: Amp <amp@ampcode.com>

---------

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: Dan Harrin <git@danharrin.com>
Co-authored-by: Amp <amp@ampcode.com>
2026-09-04 12:43:33 +01:00
d84ed19e93 Convert Laravel Boost guidelines into an Agent Skill (#20338)
* Convert Laravel Boost guideline into an Agent Skill

* Refine Filament development skill

Co-authored-by: Amp <amp@ampcode.com>

---------

Co-authored-by: Dan Harrin <git@danharrin.com>
Co-authored-by: Amp <amp@ampcode.com>
2026-09-04 12:16:15 +01:00
33d86d4196 Support trait-named lifecycle hooks on pages and importers (#20189)
* Support trait-named lifecycle hooks on pages and importers

Lifecycle hooks such as afterCreate() and afterSave() can currently only
be defined directly on the page class. A trait that defines one of these
hooks is silently overridden as soon as the page declares its own,
which makes it impossible for reusable traits or plugins to reliably
hook into the page lifecycle.

callHook() now also invokes {hook}{TraitName}() for every trait used by
the class (recursively), mirroring how Eloquent boots model traits via
boot{TraitName}(). The class's own hook runs first, followed by each
trait hook. Applies to panel pages (BasePage) and importers (Importer).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* Test and document trait lifecycle hooks

Co-authored-by: Amp <amp@ampcode.com>

---------

Co-authored-by: jim <jim@townsend-music.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Co-authored-by: Dan Harrin <git@danharrin.com>
Co-authored-by: Amp <amp@ampcode.com>
2026-09-04 10:19:44 +01:00
Dan HarrinandAmp f9a72d9706 docs: update Blueprint Boost skill workflow (#20434)
Co-authored-by: Amp <amp@ampcode.com>
2026-09-01 22:20:13 +01:00
Dan HarrinandAmp 4f24961e14 docs: improve documentation section ordering (#20432)
Co-authored-by: Amp <amp@ampcode.com>
2026-09-01 20:55:08 +01:00
Dan Harrin 2fb90db538 docs: document custom MFA providers (#20422) 2026-08-30 18:58:34 +01:00
Dan Harrin 4791d796f1 Chart consistency 2026-08-25 09:20:43 +01:00
Dan Harrin f2e983097e fix 2026-08-24 11:53:22 +01:00
Dan Harrin d2f8cd130f icon aliases 2026-08-24 11:40:58 +01:00
Dan Harrin e847a1bfb7 Update 07-managing-relationships.md 2026-07-28 13:54:07 -04:00
ahmed-rashad-alnaggarandDan Harrin 7a71c68c01 docs: Update resource navigation parent items docs (#20163)
* Update 01-overview.md

Signed-off-by: ahmed-rashad-alnaggar <131385452+ahmed-rashad-alnaggar@users.noreply.github.com>

* cleanup

---------

Signed-off-by: ahmed-rashad-alnaggar <131385452+ahmed-rashad-alnaggar@users.noreply.github.com>
Co-authored-by: Dan Harrin <git@danharrin.com>
2026-07-12 21:12:49 +01:00
Dan Harrin 6cdb7832d8 security: Sanitize color CSS value in entries and columns (#20158)
* security: Sanitize color CSS value in entries and columns

* security: Sanitize CSS in RichEditor grid and text color

* sanitize image sizing
2026-07-12 16:33:09 +01:00
Dan Harrin 475924235e security: Table select modify query docs note (#20149) 2026-07-11 15:59:57 +01:00
Dan Harrin 8212b2b0b6 fix: Non-UTF8 column data docs & command notice (#20135) 2026-07-10 22:51:35 +01:00
ahmed-rashad-alnaggarandDan Harrin 0ca3424a0a feat: allow navigation parent items to be referenced by navigation item key (#20107)
* Update NavigationManager.php

Signed-off-by: ahmed-rashad-alnaggar <131385452+ahmed-rashad-alnaggar@users.noreply.github.com>

* Update Page.php

Signed-off-by: ahmed-rashad-alnaggar <131385452+ahmed-rashad-alnaggar@users.noreply.github.com>

* Update Page.php

Signed-off-by: ahmed-rashad-alnaggar <131385452+ahmed-rashad-alnaggar@users.noreply.github.com>

* Update HasNavigation.php

Signed-off-by: ahmed-rashad-alnaggar <131385452+ahmed-rashad-alnaggar@users.noreply.github.com>

* Update navigation grouping instructions and examples

Clarified the method for grouping navigation items and updated code examples for setting the parent item.

Signed-off-by: ahmed-rashad-alnaggar <131385452+ahmed-rashad-alnaggar@users.noreply.github.com>

* Add key property and related methods to NavigationItem

Signed-off-by: ahmed-rashad-alnaggar <131385452+ahmed-rashad-alnaggar@users.noreply.github.com>

* Refactor grouping and keying of navigation items

Signed-off-by: ahmed-rashad-alnaggar <131385452+ahmed-rashad-alnaggar@users.noreply.github.com>

* Update Page.php

Signed-off-by: ahmed-rashad-alnaggar <131385452+ahmed-rashad-alnaggar@users.noreply.github.com>

* Update HasNavigation.php

Signed-off-by: ahmed-rashad-alnaggar <131385452+ahmed-rashad-alnaggar@users.noreply.github.com>

* Update Page.php

Signed-off-by: ahmed-rashad-alnaggar <131385452+ahmed-rashad-alnaggar@users.noreply.github.com>

* Change getKey to fallback to label

Signed-off-by: ahmed-rashad-alnaggar <131385452+ahmed-rashad-alnaggar@users.noreply.github.com>

* Fix parent item handling

Signed-off-by: ahmed-rashad-alnaggar <131385452+ahmed-rashad-alnaggar@users.noreply.github.com>

* Add the ability to reference navigation parent item by key not only label

Signed-off-by: ahmed-rashad-alnaggar <131385452+ahmed-rashad-alnaggar@users.noreply.github.com>

* Add tests for navigation item parent referenced by key

Signed-off-by: ahmed-rashad-alnaggar <131385452+ahmed-rashad-alnaggar@users.noreply.github.com>

* Update HasSubNavigation.php

* cleanup

* Update NavigationManager.php

* Update HasSubNavigation.php

---------

Signed-off-by: ahmed-rashad-alnaggar <131385452+ahmed-rashad-alnaggar@users.noreply.github.com>
Co-authored-by: Dan Harrin <git@danharrin.com>
2026-07-10 21:31:36 +01:00
Ashraful Islam TusharandDan Harrin 4b72c912ba Add Closure support to darkMode() and add darkModeToggle() (#20008)
* feat: add Closure support to darkMode() and add darkModeToggle()

* feat: add hasDarkModeToggle() to FilamentManager

* feat: add hasDarkModeToggle() to Facade PHPDoc

* feat: respect darkModeToggle() in user menu

* consistency

* theme switcher

---------

Co-authored-by: Dan Harrin <git@danharrin.com>
2026-07-08 15:17:29 +01:00
51dd95df70 feat(panels): support grouped user menu items with separate dropdown … (#19863)
* feat(panels): support grouped user menu items with separate dropdown lists

* (fix) adjust for PHPStan

* cleanup

* chore: format and build

* cleanup

* screenshot

* Update 03-user-menu.md

* tenant menu grouping

* refactor for perf

---------

Co-authored-by: Dan Harrin <git@danharrin.com>
Co-authored-by: danharrin <41773797+danharrin@users.noreply.github.com>
2026-07-08 12:23:49 +01:00
ahmed-rashad-alnaggarandDan Harrin 6336bea363 feat: add chart widget empty state (#19579)
* Make HasEmptyState trait for chart widget

Signed-off-by: ahmed-rashad-alnaggar <131385452+ahmed-rashad-alnaggar@users.noreply.github.com>

* Utilize empty state in ChartWidget

Signed-off-by: ahmed-rashad-alnaggar <131385452+ahmed-rashad-alnaggar@users.noreply.github.com>

* Implement empty state display in chart widget

Added handling for empty state in chart widget.

Signed-off-by: ahmed-rashad-alnaggar <131385452+ahmed-rashad-alnaggar@users.noreply.github.com>

* Add empty state styles for chart widget

Added styles for chart empty state and its elements.

Signed-off-by: ahmed-rashad-alnaggar <131385452+ahmed-rashad-alnaggar@users.noreply.github.com>

* Add CHART_WIDGET_EMPTY_STATE constant to WidgetsIconAlias

Signed-off-by: ahmed-rashad-alnaggar <131385452+ahmed-rashad-alnaggar@users.noreply.github.com>

* Add 'empty' state message in Arabic localization

Signed-off-by: ahmed-rashad-alnaggar <131385452+ahmed-rashad-alnaggar@users.noreply.github.com>

* Add empty state message for chart data

Signed-off-by: ahmed-rashad-alnaggar <131385452+ahmed-rashad-alnaggar@users.noreply.github.com>

* Format type hints in filament style

Signed-off-by: ahmed-rashad-alnaggar <131385452+ahmed-rashad-alnaggar@users.noreply.github.com>

* Add empty state icon for chart widgets alias

Signed-off-by: ahmed-rashad-alnaggar <131385452+ahmed-rashad-alnaggar@users.noreply.github.com>

* Add chart widget's empty state section

Signed-off-by: ahmed-rashad-alnaggar <131385452+ahmed-rashad-alnaggar@users.noreply.github.com>

* Update chart-widget.blade.php

Signed-off-by: ahmed-rashad-alnaggar <131385452+ahmed-rashad-alnaggar@users.noreply.github.com>

* resolve conflicts

Signed-off-by: ahmed-rashad-alnaggar <131385452+ahmed-rashad-alnaggar@users.noreply.github.com>

* Update chart-widget.blade.php

* refactor

* cleanup

* Update ChartWidget.php

* follow aspect ratio and height settings

---------

Signed-off-by: ahmed-rashad-alnaggar <131385452+ahmed-rashad-alnaggar@users.noreply.github.com>
Co-authored-by: Dan Harrin <git@danharrin.com>
2026-07-08 12:19:25 +01:00
Dan Harrin cb9f9e2e6b Update 03-ai.md 2026-06-07 12:20:45 +01:00
Lalhmangaihenga 2d2bc95841 include RestrictsFileUploadsToSchemaComponents to example (#19899) 2026-05-25 16:52:47 +01:00
ukeloopandDan Harrin c377ec636f Improve Str::sanitizeUrl to reject malformed javascript URLs (#19892)
* Improve Str::sanitizeUrl to reject malformed javascript URLs

* cleanup

* Update SupportServiceProvider.php

* Update UrlSanitizerTest.php

* Update 06-security.md

---------

Co-authored-by: Dan Harrin <git@danharrin.com>
2026-05-21 18:58:17 +01:00
7f3e6ffbeb security: Prevent 2FA concurrent recovery code reuse (#19891)
* security: 2FA concurrent recovery code reuse

* Update AppAuthentication.php

* Merge commit from fork

* security: also serialise recovery code verification on SQLite

The `lockForUpdate()` row lock does not exist on SQLite — Laravel's SQLite
query grammar compiles `compileLockForUpdate()` to an empty string — so the
transaction provides no mutual exclusion there. Two concurrent requests still
both read the full recovery code set before either commits, and the losing
write resurrects the just-consumed code.

Verified against a true `pcntl_fork()` race on v5.6.4: the transaction-only
fix is bypassed 6/6 runs on SQLite while holding 7/7 on MySQL.

Wrap the transaction in a per-user `Cache::lock()` so verification is
serialised regardless of database driver. The DB transaction and row lock are
kept for drivers that support them. Re-verified: combined fix holds 6/6 on
SQLite and 5/5 on MySQL.

* cleanup

---------

Co-authored-by: StarPlatinu <thanhnolove21@gmail.com>
Co-authored-by: Dan Harrin <git@danharrin.com>

---------

Co-authored-by: ThanhVu <72287279+StarPlatinu@users.noreply.github.com>
Co-authored-by: StarPlatinu <thanhnolove21@gmail.com>
2026-05-21 18:47:17 +01:00
Dan Harrin 6555a9eb1f Additional security docs / hardening 2026-05-21 18:10:05 +01:00
Dan Harrin f7500b1b19 security: Temporary file uploads available on auth pages (#19886)
* security: Temporary file uploads available on auth pages

* Update Register.php

* Update RestrictsFileUploadsToSchemaComponentsTest.php
2026-05-21 11:28:42 +01:00
Dan Harrin db0dc4f4aa security: Introduce Str::sanitizeUrl() helper method (#19868) 2026-05-20 14:23:06 +01:00
Dan Harrin 5b4c8c3920 fix: Re-authorize during Livewire hydration (#19841) 2026-05-10 20:39:22 +01:00
Dan Harrin 926db5727c task: Refactor color contrast resolution (#19774) 2026-05-01 10:28:09 +01:00
Dan Harrin 61853ee76b fix: Invalid file path validation (#19759) 2026-04-23 11:43:22 +01:00
Dan Harrin d2a690d274 Clean up file path protection feature docs & naming 2026-04-21 12:02:12 +01:00
Omar AlnabrisandDan Harrin 49bfa189e9 Evaluate badge color with badge state (#19706)
* Evaluate badge color with badge state

* missing places

* docs

* simplify

* cleanup

* Update HasBadge.php

* fix assertions

---------

Signed-off-by: Dan Harrin <git@danharrin.com>
Co-authored-by: Dan Harrin <git@danharrin.com>
2026-04-20 13:36:26 +01:00
630af63d01 Loading indicator refactor (#19721)
* Refactor loading indicator to use a bindable contract

* chore: fix code style

* cleanup

* consistency

* chore: fix code style

---------

Signed-off-by: Shaharyar Ahmed <shery.codes@gmail.com>
Co-authored-by: Shaharyar Ahmed <shaharyar@DESKTOP-U23GP1D.localdomain>
Co-authored-by: Shaharyar-WebDev <Shaharyar-WebDev@users.noreply.github.com>
Co-authored-by: Dan Harrin <git@danharrin.com>
Co-authored-by: danharrin <danharrin@users.noreply.github.com>
2026-04-20 13:27:00 +01:00
MarcelandDan Harrin a4f07a54c4 Add page header heading render hook (#19702)
* Add page header heading render hook

* cleanup

---------

Co-authored-by: Dan Harrin <git@danharrin.com>
2026-04-20 13:26:34 +01:00
Omar AlnabrisandDan Harrin b8c80cdee8 Support dynamic navigation visibility (#19701)
* support dynamic navigation visibility

* clean up and test and docs

* simplify

---------

Co-authored-by: Dan Harrin <git@danharrin.com>
2026-04-20 13:26:23 +01:00
11ef6c6a88 Add deferred badge loading for relation manager tabs (#19464)
* feat: add deferred badge loading for relation manager tabs

Extends the deferred tab badge loading introduced in PR #19336 to
relation manager tabs, fixing two upstream issues:

1. `RelationManager::getTabComponent()` was evaluating `getBadge()`
   eagerly before the deferred mechanism could intercept it.
2. `HasRelationManagers::getRelationManagersContentComponent()` built
   `Tabs::make()` with no key, causing `callSchemaComponentMethod()` to
   receive null when the async badge fetch fired.

Changes:
- Add `protected static bool $deferBadge = false` to `RelationManager`
  with an overrideable `isBadgeDeferred()` method for per-record control
- Add fluent `->deferBadge()` and `isBadgeDeferred()` to `RelationGroup`
- Add `->key('relationManagerTabs')` to the `Tabs` built in
  `HasRelationManagers`
- Add docs and tests

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* cleanup

---------

Co-authored-by: buzkall <buzkall@users.noreply.github.com>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: Dan Harrin <git@danharrin.com>
2026-04-20 13:24:09 +01:00
Dan Harrin a0ebc37890 task: Easier HTML sanitizer extension (#19680) 2026-04-11 12:59:07 +01:00
Dan Harrin bdc28be91a Add security comments to reduce false-positive rate of security reports 2026-04-09 12:31:28 +01:00
Cranberry 003797e037 Fix formatting in avatar documentation (#19612)
Signed-off-by: Cranberry <20140992+cranberry3148@users.noreply.github.com>
2026-04-03 16:00:13 +01:00
Dan Harrin 4d78fbfa37 Update 06-deleting-records.md 2026-03-23 13:06:17 +00:00
Dan Harrin 09aaea6d5d docs: More screenshots (#19548)
* screenshots

* fix cut off sidebar

* Screenshots

* Screenshots

* retake

* fix loading data issue

* retake

* screenshots

* Update custom-toolbar.jpg

* retake

* ss

* retake

* ss

* ss

* ss

* ss

* ss

* ss

* ss

* ss

* Update dashboard.jpg

* ss

* Update openable.jpg

* ss

* ss

* ss

* Update database.sqlite

* Update database.sqlite

* ss

* ss

* ss

* ss

* ss

* ss

* clean up

* cs
2026-03-23 08:29:46 +00:00
Dan Harrin 373943d001 Add more security docs 2026-03-20 09:06:00 +00:00
Cole ShirleyandDan Harrin a1726a3419 [4.x] Allow hiding specific error notifications (#19400)
* allow hiding error notifications

* update docs

* Rename

* add support for disabling error notifications

* clean up

* Update 05-panel-configuration.md

* Update 05-panel-configuration.md

---------

Co-authored-by: Dan Harrin <git@danharrin.com>
2026-03-17 18:42:19 +00:00
Dan Harrin 8916fe5c0d feature: Global search resource opt-in (#19513) 2026-03-17 17:22:29 +00:00
Dan Harrin 021745b93e Update 01-overview.md 2026-03-04 10:37:29 +01:00
0d12e3f5ab feat: add controls slot to callout component (#19263)
* Add support for callout control actions.

* Update documentation

* chore: fix code style

* cleanup

* screenshots

* better example

---------

Co-authored-by: gehrisandro <gehrisandro@users.noreply.github.com>
Co-authored-by: Dan Harrin <git@danharrin.com>
2026-02-28 23:13:41 +01:00