[Bug]: getModel() returns string, not instance of Model (Breaks instanceof checks)

[timothyoesch]

What happened?

The methods getAllowedFields(), getAllowedSorts(), getAllowedFilters() and getAllowedIncludes() always return an empty array, even though I have implemented the corresponding HasAllowed contracts on the model.

I'd posit that's the case, because the getModel() method returns a string of the model name, not an instance of the model.

// Http/Handlers.php:136
public function getAllowedFields(): array
    {
        $model = static::getModel();
        // Returns string not instance of model

        if($model instanceof HasAllowedFields) {
            return $model::getAllowedFields();
        }
        // ...
}

How to reproduce the bug

Create an api service for an existing resource, implement the HasAllowedFilters contract on your model adding the function getAllowedFilters returning the array of the filterable attributes and try filtering through the API. The response will always be

{
    "message": "Requested filter(s) `ATTRIBUTES` are not allowed. Allowed filter(s) are ``.",
    ...
}

Package Version

3.3.2

PHP Version

8.2.20

Laravel Version

11.15.0

Which operating systems does with happen with?

Linux

Notes

No response

[timothyoesch]

Could this potentially be fixed thusly? Or do I not see an issue casting the model names into instances of the model through app()?

public function getAllowedFields(): array
{
    $model = app(static::getModel());

    if($model instanceof HasAllowedFields) {
            return $model::getAllowedFields();
    }

    // ...
}