[13.x] feat: convert QueryException to ModelNotFoundException in implicit route binding

[calebdw]

Hello!

When implicit route model binding encounters a QueryException (e.g., from integer overflow or type mismatch), convert it to a ModelNotFoundException instead of letting the 500 propagate. This ensures invalid route parameters like /users/99999999999999999999 return a 404 rather than a 500.

This has been the biggest pain, without this you have to add ->whereNumber() on every route OR you litter the AppServiceProvider with 50+ calls like Route::pattern('user', '[0-9]+');. Even with this, we've still had exceptions where the parameter was all digits but it exceeded the column int size so we had to add even more checks to prevent the exception.

Ultimately, a model was not found so end user should always receive a 404 instead of a 500.

The QueryException is still reported, but developers now have the ability to disable reporting, for example:

class AppServiceProvider extends ServiceProvider
{
    public function register(): void
    {
        Model::reportRouteModelBindingExceptions(! $this->app->isProduction());
    }
}

Thanks!

[shaedrich]

Is this intentional? 🤔

[calebdw]

Is this intentional? 🤔

Is what intentional? 🧐 I intentionally submitted this PR if that's what you're asking about 🙃

[shaedrich]

No, sorry, should have included the quote, I was looking at 😬 😅

This ensures […] a 404 rather than a 500.

[calebdw]

Lol, I'm not sure. I was trying to keep this PR simple, but if folks want the exception then I can add a way to configure it

[shaedrich]

I guess, that would be great—thanks 👍🏻

[taylorotwell]

I wonder if this would be hard to debug what is going on, especially if you expect to be getting a model back, you get some query error (maybe a global scope), but now it's masked as a 404. It feels like the current behavior is pretty helpful in local development, but maybe not ideal in prod (though you would still want the original error).

[calebdw]

Yeah, I could see maybe having some configuration options, maybe something like:

Model::throwRouteModelBindingExceptions();
// and / or maybe just this
Model::reportRouteModelBindingExceptions();

I think from the end user perspective they should always receive a 404 instead of a 500 in production

[shaedrich]

Nice! 👍🏻

[calebdw]

@taylorotwell, I've updated to report the QueryException, with the option of disabling reporting

[taylorotwell]

Hmm, let me think about this one - I'm not confident we're totally landing on the right solution.