sarala-io / sarala-laravel

src/Query/ApiRequestInspector.php

<?php

declare(strict_types=1);

namespace Sarala\Query;

use Illuminate\Http\Request;
use Illuminate\Support\Str;
use Sarala\Exceptions\UnauthorizedIncludeException;
use Sarala\Http\Requests\ApiRequestAbstract;

class ApiRequestInspector
{
    /** @var ApiRequestAbstract */
    private $request = null;

    public function __construct(array $parameters)
    {
        $this->setRequestReceivedAtApiEndpoint($parameters);
    }

    public function inspect()
    {
        $this->sanitizeIncludes();
    }

    private function setRequestReceivedAtApiEndpoint(array $parameters)
    {
        foreach ($parameters as $parameter) {
            if ($parameter instanceof Request) {
                $this->request = $parameter;

$parameter is of type Illuminate\Http\Request, but the property $request was declared to be of type Sarala\Http\Requests\ApiRequestAbstract. Are you sure that you always receive this specific sub-class here, or does it make sense to add an instanceof check?

            }
        }
    }

    private function sanitizeIncludes()
    {
        $this->request->includes()->each(function ($params, $field) {

The method includes() does not exist on Sarala\Http\Requests\ApiRequestAbstract. Since you implemented __call, consider adding a @method annotation.

            if (! $this->isIncludeAllowed($field)) {
                throw new UnauthorizedIncludeException($field, $this->request->allowedIncludes());
            }
        });
    }

    private function isIncludeAllowed($field): bool
    {
        foreach ($this->request->allowedIncludes() as $allowedInclude) {
            if (Str::startsWith($allowedInclude, $field)) {
                return true;
            }
        }

        return false;
    }
}