ExternalReadonly
in package
FinalYes
Property that an external client (marker `$meta['__external']`) must not write, i.e. a server-controlled field such as `paid`, `banned` or `approvedAt`.
The marker is set only by SaveTrait::actionSave(),
which strips fields collected by
OrmEntityHydrator::getExternalReadonlyFields() before hydration. On
update the entity keeps its DB value; on insert the default or server-set value fills in.
The internal path (ApiBridge::internalCall) has no marker, so admin and cron may still write
these fields.
Usage:
#[ExternalReadonly]
protected bool $paid = false;
Attributes
- #[Attribute]
- \Attribute::TARGET_PROPERTY