[9.x] Ability to disable route scope bindings (#44528)

* wip it

* use method to determine scope bindings

* test withoutScopeBindings() method

* fix reference to scope_bindings

* wip

* drop redundant attribute

* formatting

* Fix test

Co-authored-by: Taylor Otwell <[email protected]>

Author: stevethomas

src/Illuminate/Routing/ImplicitRouteBinding.php

@@ -46,7 +46,9 @@ public static function resolveForRoute($container, $route)
                         ? 'resolveSoftDeletableRouteBinding'
                         : 'resolveRouteBinding';
 
-            if ($parent instanceof UrlRoutable && ($route->enforcesScopedBindings() || array_key_exists($parameterName, $route->bindingFields()))) {
+            if ($parent instanceof UrlRoutable &&
+                ! $route->preventsScopedBindings() &&
+                ($route->enforcesScopedBindings() || array_key_exists($parameterName, $route->bindingFields()))) {
                 $childRouteBindingMethod = $route->allowsTrashedBindings() && in_array(SoftDeletes::class, class_uses_recursive($instance))
                             ? 'resolveSoftDeletableChildRouteBinding'
                             : 'resolveChildRouteBinding';

src/Illuminate/Routing/Route.php

@@ -1155,6 +1155,18 @@ public function scopeBindings()
         return $this;
     }
 
+    /**
+     * Indicate that the route should not enforce scoping of multiple implicit Eloquent bindings.
+     *
+     * @return $this
+     */
+    public function withoutScopedBindings()
+    {
+        $this->action['scope_bindings'] = false;
+
+        return $this;
+    }
+
     /**
      * Determine if the route should enforce scoping of multiple implicit Eloquent bindings.
      *
@@ -1165,6 +1177,16 @@ public function enforcesScopedBindings()
         return (bool) ($this->action['scope_bindings'] ?? false);
     }
 
+    /**
+     * Determine if the route should prevent scoping of multiple implicit Eloquent bindings.
+     *
+     * @return bool
+     */
+    public function preventsScopedBindings()
+    {
+        return isset($this->action['scope_bindings']) && $this->action['scope_bindings'] === false;
+    }
+
     /**
      * Specify that the route should not allow concurrent requests from the same session.
      *

src/Illuminate/Routing/RouteRegistrar.php

@@ -26,6 +26,7 @@
  * @method \Illuminate\Routing\RouteRegistrar scopeBindings()
  * @method \Illuminate\Routing\RouteRegistrar where(array $where)
  * @method \Illuminate\Routing\RouteRegistrar withoutMiddleware(array|string $middleware)
+ * @method \Illuminate\Routing\RouteRegistrar withoutScopedBindings()
  */
 class RouteRegistrar
 {

src/Illuminate/Support/Facades/Route.php

@@ -31,6 +31,7 @@
  * @method static \Illuminate\Routing\RouteRegistrar scopeBindings()
  * @method static \Illuminate\Routing\RouteRegistrar where(array $where)
  * @method static \Illuminate\Routing\RouteRegistrar withoutMiddleware(array|string $middleware)
+ * @method static \Illuminate\Routing\RouteRegistrar withoutScopedBindings()
  * @method static \Illuminate\Routing\Router|\Illuminate\Routing\RouteRegistrar group(\Closure|string|array $attributes, \Closure|string $routes)
  * @method static \Illuminate\Routing\ResourceRegistrar resourceVerbs(array $verbs = [])
  * @method static string|null currentRouteAction()

tests/Integration/Routing/ImplicitModelRouteBindingTest.php

@@ -183,7 +183,7 @@ public function testEnforceScopingImplicitRouteBindingsWithRouteCachingEnabled()
 use Illuminate\Tests\Integration\Routing\ImplicitBindingUser;
 use Illuminate\Tests\Integration\Routing\ImplicitBindingPost;
 
-Route::group(['scoping' => true], function () {
+Route::group(['scope_bindings' => true], function () {
     Route::get('/user/{user}/post/{post}', function (ImplicitBindingUser \$user, ImplicitBindingPost \$post) {
         return [\$user, \$post];
     })->middleware(['web']);
@@ -203,7 +203,7 @@ public function testWithoutEnforceScopingImplicitRouteBindings()
 
         config(['app.key' => str_repeat('a', 32)]);
 
-        Route::group(['scoping' => false], function () {
+        Route::group(['scope_bindings' => false], function () {
             Route::get('/user/{user}/post/{post}', function (ImplicitBindingUser $user, ImplicitBindingPost $post) {
                 return [$user, $post];
             })->middleware(['web']);

tests/Routing/RoutingRouteTest.php

@@ -1741,6 +1741,23 @@ public function testImplicitBindings()
         $this->assertSame('taylor', $router->dispatch(Request::create('foo/taylor', 'GET'))->getContent());
     }
 
+    public function testImplicitBindingsWhereScopedBindingsArePrevented()
+    {
+        $router = $this->getRouter();
+
+        $router->get('foo/{test_team}/{user:id}', [
+            'middleware' => SubstituteBindings::class,
+            'uses' => function (RoutingTestTeamWithoutUserModel $testTeam, RoutingTestUserModel $user) {
+                $this->assertInstanceOf(RoutingTestTeamWithoutUserModel::class, $testTeam);
+                $this->assertInstanceOf(RoutingTestUserModel::class, $user);
+
+                return $testTeam->value.'|'.$user->value;
+            },
+        ])->withoutScopedBindings();
+
+        $this->assertSame('1|4', $router->dispatch(Request::create('foo/1/4', 'GET'))->getContent());
+    }
+
     public function testParentChildImplicitBindings()
     {
         $router = $this->getRouter();