Scoped route binding in apiResource routes no longer working

[joe-pritchard]

• Laravel Version: 9.14.1
• PHP Version: 8.1.2
• Database Driver & Version:

Description:

I've recently updated Laravel from 9.13.0 to 9.14.1 and I have a series of nested apiResource routes defined like so:
$router->apiResource('/product/{product}/image', ImageController::class)->scoped();

I've found that when I request an image that doesn't belong to the product id specified in the URL, I get a 404 like I'd expect in v9.13.0, but in v9.14.1 the request falls through to the controller incorrectly... I may be doing something wrong but it has been working until today.

Steps To Reproduce:

Define a scoped API resource like the one above.
Request a URL where the child model is not owned by the parent model.

Expected: The app throws a 404
Actual: The app calls the controller

I've made a new laravel project to demonstrate: https://github.com/joe-pritchard/scoped-resource-bug

There's a test in there at Tests\Feature\Models\ChildTest which shows the issue. The test fails, but it will pass if you downgrade the laravel/framework dependency to 9.13.0

[rachediabdenacer]

i have exactly the same problem,
the problem appeared when I updated the laravel/framework version from 9.4.1 to 9.14.1

[korkoshko]

@ksassnowski ping! Can you watch it? I think the problem is because of this PR

[ksassnowski]

I’ll have a look at this. Seems like that change had quite a few unforeseen knock-on effects. Sorry about that!

[ksassnowski]

OK so the fix itself could get a little tricky, but there's at least a temporary workaround for now. If you explicitly define the binding field when calling scoped on an api resource, it works as expected.

So instead of

Route::apiResource('/product/{product}/image', ImageController::class)->scoped();

do this

Route::apiResource('/product/{product}/image', ImageController::class)->scoped([
    // Or whatever the route key for `Image` should be
    'image' => 'id',
]);

[driesvints]

@ksassnowski if there's no way we can fix this except through a workaround we probably best revert the PR for now and re-add the changes in Laravel 10.

[ksassnowski]

I actually have a solution and am finishing up the PR right now

[ksassnowski]

Here's the PR #42571