Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.

npw's avatar
Level 1

Strict Mode issue with fillable and (non)related models?

Has anyone else come across this?

Basically i'm trying out Strict Mode (love it!), and whilst re-running my tests after enabling, i'm getting failures due to MassAssignmentExceptions. These failures are asking me to:

Add fillable property [roles] to allow mass assignment on [App\Models\User].

Now i'm using Spatie Permissions for role management, so there is no roles attribute in the User Model/Table, so it shouldn't be in there (and it blows if you add it). So i'm a bit confused as to the advice being given by the exception/test.

Have other occurrences of the same issue, where the test is telling me to add attributes to fillable that don't exist on the model in question.

0 likes
11 replies
Sinnbeck's avatar

I use the same but haven't seen this error before (I use strict mode and the package). Can you see what exact code is causing the error ?

npw's avatar
Level 1

@Sinnbeck do you have a relationship defined for the roles/permissions on your User model by any chance? (will dig a bit deeper and let you know).

npw's avatar
Level 1

@Sinnbeck Upon further investigation, it appears that because I am validating 'Roles' in my StoreUserFormRequest, that strict mode thinks it should be in the fillable? If I remove it from the Form Request validation the problem goes away (obviously).

Not sure if this is a problem with how I am doing things (likely), or with how strict mode is attempting to assess what should be present. I thought that the FormRequest would be the correct place to validate that information, but maybe my assumption was incorrect.

npw's avatar
Level 1

@Sinnbeck i can...

<?php

namespace App\Http\Requests\User;

use App\Actions\Fortify\PasswordValidationRules;
use App\Enum\User\Permissions;
use Carbon\Carbon;
use Illuminate\Foundation\Http\FormRequest;
use Illuminate\Support\Facades\Gate;
use Illuminate\Support\Facades\Hash;
use Illuminate\Support\Str;

class StoreUserRequest extends FormRequest
{
    use PasswordValidationRules;

    /**
     * Determine if the user is authorized to make this request.
     *
     * @return bool
     */
    public function authorize()
    {
        return Gate::allows(Permissions::UserManagement());
    }

    /**
     * Get the validation rules that apply to the request.
     *
     * @return array
     */
    public function rules()
    {
        return [
            'first_name' => ['required', 'string', 'max:255'],
            'last_name' => ['required', 'string', 'max:255'],
            'email' => ['required', 'string', 'email', 'max:255', 'unique:users'],
            'can_log_in' => ['required', 'boolean'],
            'roles' => ['nullable'],
            'password' => ['required'],
            'password_expires_at' => ['required'],
            'audit_reason' => ['required', 'array', 'min:1'],
            'audit_reason.notes' => ['required', 'min:2'],
            'site_id' => ['required'],
        ];
    }

    protected function prepareForValidation()
    {
        //convert boolean 'can_log_in' too false if checkbox not checked.
        if (! ($this->has('can_log_in'))) {
            $this->merge(['can_log_in' => 0]);
        }
    }
}

Sinnbeck's avatar
Sinnbeck
Best Answer
Level 102

@npw Do you use the validated data directly then? Cause that would indeed cause that error :)

User::create($request->validated());
1 like
npw's avatar
Level 1

@Sinnbeck <facepalm.gif> argh of course, it is working exactly as it should be then. I need to invest in a rubber duck. Apologies, and thank you for your patience!

Please or to participate in this conversation.