Analyzer::Php::Laravel

Route::any('/x', …): capture 1 is the path; the verbs are implied.

Every write to a variable: assignment (also through a subscript or a compound operator), a foreach / destructuring target, a reference, a mutating builtin or unset.

The built-in auth / auth:sanctum / auth.basic aliases.

What an if (!user) block does to refuse: abort, throw, redirect, or answer 401/403.

The match/addRoute routes behind a fluent prelude. Capture 1 is the prelude, capture 2 the verb specification, capture 3 the path.

The static routes behind a fluent prelude. Capture 1 is the prelude, capture 2 the kind, capture 3 the path.

The same, behind a fluent prelude — Route::middleware('auth')->prefix('v1')->get('/x', …). Capture 1 is the whole prelude (a ->-separated chain of calls; the inner [^;]*? keeps each call's argument list inside one statement), capture 2 the verb, capture 3 the path.

config('portfolio.path') / config('x.y', 'default').

A config value the scan can read: a literal, or env('X', 'literal') (what the app serves when the variable is unset). explode(',', env('X', 'api')) (a one-name list's default) reads as that name. ponytail: a comma-separated default stays unread (middleware names such as throttle:60,1 hold commas).

Any class type hint: a FormRequest need not be named *Request (login(LoginUser $request)), form_request_hint? decides.

Route::controller(X::class) in a group's chain, or the 'controller' => X::class group attribute.

Route::namespace('X') in a group's chain, or the 'namespace' => 'X' attribute.

A refusal that is about the caller's identity by its own words.

Framework classes whose definition lives in vendor/.

A lookup before the check ($post = Post::find($id);) answers nothing. Only calls known to read count: anything else may have side effects.

Route::match(['get', 'post'], '/x', …) or Route::addRoute('QUERY', '/x', …): capture 1 is the verb specification (array literal or string literal), capture 2 the path.

The names a ->middleware(...) call or 'middleware' => attribute gives: an array, or one or more strings / Foo::class arguments.

What a handle() that can refuse the caller does: abort / throw / answer with 401 or 403, throw an auth exception, authenticate (which throws AuthenticationException), or send the guest to the login page.

->middleware($middleware) / 'middleware' => $middleware: a variable handed whole as the list.

A request-shape check (CORS origin, preflight method, host), not a check on who the caller is.

A route's path argument, quotes included (laravel_path_arg folds it): a string literal, or literals and simple expressions joined with . ('/a/' . config('x.y'), '/c/' . $prefix). One capture.

One piece of a PATH_ARG: a literal, a variable or a call.

$this->authorize('view', $post) / Gate::authorize(...): the gate answers 403 for a signed-out caller unless the policy takes a nullable user, so it stands in front of the handler like a user check, but a policy can open it.

Hoisted patterns for extract_resource_route_calls / extract_resource_action_filter — both call sites pass literal names ("resource"/"apiResource", "only"/"except"), and the previous Regex.new interpolation recompiled the pattern on every call (per file, and per resource statement respectively).

Route::resource('photos', 'PhotoController'): the quoted controller second argument, a string action like 'PhotoController@index'.

A route file's URL prefix comes from where the app loads it, not from the file: Route::prefix('api')->group(base_path('routes/api.php')) in a RouteServiceProvider (Laravel <= 10, including the older Route::group(['prefix' => 'api'], function () { require ... })), or ->withRouting(api: __DIR__.'/../routes/api.php', apiPrefix: 'v2') in bootstrap/app.php (Laravel 11+, apiPrefix defaulting to api), whose then: closure registers further groups the same way.

Any Route::…('path', … registration, whatever verb or chain precedes it. Used only to locate handler-closure bodies up front; the six scans above are what actually decide which registrations become endpoints.

Why a refusal is not unconditional: it only happens under an environment or config check.

rules() composed from a helper's array, ...$this->folderRules() or array_merge([...], $this->folderRules()): the helper's keys, from the class or a trait it uses.

Resolver::resolve($request): a static method of an app class (one the project's PSR-4 autoload maps, never a vendor class) handed the request as its first argument reads it under its own parameter name.

Route::view / redirect / permanentRedirect: capture 1 is the kind and capture 2 the path. Laravel registers a view with match(['GET', 'HEAD']) and a redirect with any.

A FormRequest is the request: $this->input('x') in its own methods reads input, and so does $this->helper('x') when the helper (on the class or a trait it uses) hands its first parameter to such a read.

A route call (or a call chained on one) whose string argument still interpolates a variable after substitution: an inner loop that was not expanded, or a value the body computes.

A handler that refuses an anonymous caller before doing anything: a top-level abort_if(!$request->user(), 403) / abort_unless(auth()->check(), 404), or if (!Auth::check()) { abort(403); } (also on a $user = $request->user() it read first), before it does anything else.

Validating the input first refuses rather than serves (422).

Route::get('/x', …) and friends: the verb is capture 1, the path capture 2.

Livewire Volt full-page components: Volt::route('/users', 'users.index') registers a GET route. Capture 1 is the path.

->where('path', '.*') and its shorthands, chained after the route. Laravel matches the placeholder against the regex, so .* lets one placeholder span slashes and [0-9]+ makes /x/new fall through to the next route; the URL keeps the constraint as {path:.*} (Laravel is in URLPath::REGEX_PLACEHOLDER_TECHS).

Instance-side view of the same declaration. The per-file rescues live on this base class, which has no way to name the analyzer that is running inside them, so a skipped file could not be attributed to a tech. Deriving it from analyzer_for keeps the name written exactly once.