Why is Eloquent's $visible, $hidden, etc not static?

Have you had a look into Resources? Sounds like the exact use case for that (considering you return the models from an API).

We're currently on Laravel 5.3, which I don't think has Resources.

We implemented our own class-level visibility logic and overrode the existing visibility methods such as makeVisible, but that's obviously a deviation from Eloquent's intent. That's why I want to understand the reasoning behind the non-static properties. If I could understand the reasoning, I would be able to make a better decision on how to move forward.

I'm not sure about the official philosophy but I could totally think of reasons for different visibility on a per model basis. I work on a project where one party can "unlock" their contact data for conversations so I could use that logic to make the contact data visible depending on that "unlock status" (although I have solved that differently).

I'd say it gives you a lot more flexibility on a per-model basis with the drawback of more work for a few people.

You could have a public model which extends the base model and overloads visibility?

or check if user is auth within the model constructor?

by the way, you seem to have invented a cool new word 'Medology'

Thanks, @ftiersch, that's a good real-world example.

@snapey, yeah, that's exactly what we did. I just want to make sure we're not going down a bad path. Thanks, "Medology" is the old name of my employer, so I can't take credit for that XD.

Every "Model" class extends the Illuminate\Database\Eloquent\Model (BaseModel) class, which is abstract. This class offers certain functionality that needs those variables out of the box. (In the latter versions, this functionality is grouped into traits). If the variables were declared static, then all your model classes that inherited from the BaseModel class would have to use the same values for these variables, because now they would belong to the BaseModel class, not to the instance of the objects created from the class. Yes, they could be changed at runtime, but you would have an even bigger headache, because you would really have to remember to change the values every time when the out-of-the-box underlying code needed to use them. For instance, you would have to change them every time your objects are sent over the wire in their JSON representation. A user may have a hidden password field, but credit card may have the exp_date, billing_zip and CVV fields hidden. You would be faced with the inspection of the class name every time you wanted to send the JSON representation of your models over the wire; in this case you would throw away all that functionality that comes out of the box and get for free.

That's not a problem at all. You can either use late static binding to access the extending model's static $visible array or if you're using a PHP version that doesn't have late static binding, you can use a function that returns the concrete model's static $visible array.

Our implementation uses the late static binding approach.

If the model instance specific visibility is functionality that's desired, it would be pretty trivial to create a hybrid approach where the class-level visibility list is either overridden or extended by the instance-level visibility list.

Here's an rough example of how you'd use late static binding to accomplish this:

<?php namespace App\Model;

use Illuminate\Database\Eloquent\Model as BaseModel;

class Model extends BaseModel
{
    /** @var array The attributes that should be visible in model class. */
    protected static $class_visible = [];

    /**
     * Make the given class, typically hidden, attributes visible.
     *
     * Class-level variant of the non-static makeVisible() method.
     *
     * @param array|string $attributes The class attributes to make visible.
     */
    public static function makeClassVisible($attributes)
    {
        if (!empty(static::$class_visible)) {
            static::addClassVisible($attributes);
        }
    }

    /**
     * Get the visible attributes for the class.
     *
     * Class-level variant of the non-static getVisible() method.
     *
     * @return array
     */
    public static function getClassVisible()
    {
        return static::$class_visible;
    }

    /**
     * Set the visible attributes for the model.
     *
     * Class-level variant of the non-static setVisible() method.
     *
     * @param array $visible The attributes to set visible.
     */
    public static function setClassVisible(array $visible)
    {
        static::$class_visible = $visible;
    }

    /**
     * Add visible attributes for the class.
     *
     * Class-level variant of the non-static addVisible() method.
     *
     * @param array|string|null $attributes The attributes to add in the class_visible array.
     */
    public static function addClassVisible($attributes = null)
    {
        $attributes = is_array($attributes) ? $attributes : func_get_args();
        static::$class_visible = array_merge(static::$class_visible, $attributes);
    }

    /**
     * {@inheritdoc}
     *
     * Overridden to use the static 'getClassVisible' method instead of 'getVisible'.
     */
    protected function getArrayableItems(array $values)
    {
        if (count(static::getClassVisible()) > 0) {
            $values = array_intersect_key($values, array_flip(static::getClassVisible()));
        }
        if (count($this->getHidden()) > 0) {
            $values = array_diff_key($values, array_flip($this->getHidden()));
        }
        return $values;
    }
}

class User extends Model {
  protected static $class_visible [
    'visible_property_1',
    'visible_property_2',
    'visible_property_3',
  ];
}

class CreditCard extends Model {
  protected static $class_visible [
    'visible_property_a',
    'visible_property_b',
    'visible_property_c',
  ];
}