Write the input contract before the UI
For a new cart feature, name the allowed product identifier and quantity fields, maximum lines, permitted quantity range and policy for duplicate products. The application should obtain prices and discounts from its authorised business records. This is authored design advice, not a claim that a particular store currently accepts manipulated prices.
- Specify which products this user or organisation may select.
- State who owns rounding, discount and quantity-limit decisions.
- Treat an exists check as existence only, not permission to buy another organisation's product.
Restrict the nested shape
Laravel documents allowed array keys and nested/wildcard rules. Define both the collection and each line's allowed shape, then use the selected validated fields. Unknown keys such as a supplied price or discount need an explicit rejection or removal policy. Validating the container as an array alone does not validate every nested business field.
- Check missing, zero, negative, fractional and excessive quantities against the agreed contract.
- Load eligible product facts on the server instead of trusting a submitted subtotal.
- Keep validation failure feedback separate from forbidden-resource feedback.
A synthetic acceptance list
An authored test uses two invented eligible products and one product unavailable to that user. Assert a valid line succeeds with the server's declared total; an added price key follows the rejection policy; invalid quantities create no order; and an unavailable product is denied. Test stock reservation separately: valid input alone does not prevent overselling.
- Do not charge a real account or create a posted invoice in the preview.
- The listed cases are unexecuted criteria, not a security audit or proof of production enforcement.
Non-fit, safety and priced route
A small cart-input feature qualifies for ship-one-feature-with-running-preview, from £750, only if it stays outside payment and personal-data handling changes. Pricing that touches the payment path, or any change to customer-data handling, needs a separate security review and separately agreed scope before quoting; synthetic fixtures or disabled live gateways do not remove that exclusion. For a qualifying feature, agree exact criteria, a fixed quote, an existing isolated, private, access-controlled and time-limited preview route, and two revision rounds. Payment for the work follows passing checks and the buyer's sign-off; the offer does not cover an entire commerce platform, tax engine or stock architecture. If an existing live system may allow price manipulation or unauthorised resource access, stop and use its security/disclosure process; do not send exploit details through the ordinary bug enquiry.
- Send the proposed invented line shape and expected rejection results, not code, customer records or credentials.
- Independent review and authorised publication remain separate from these candidate criteria.
Sources and limits
- Laravel 12.x validation: arrays and validated input; MIT-licensed documentation Checked 2026-10-11.
- Array rules can restrict allowed keys; nested fields use dot notation and wildcard rules.
- The reference recommends always specifying allowed array keys.
- Form Request authorization is separate from validation.
- safe and validated expose accepted input rather than establish business authority.
- Laravel 12.x resource authorization Checked 2026-10-11.
- An authenticated user is not necessarily authorised to act on a particular resource.
- Current bounded feature/preview offer Checked 2026-10-11.