Laravel memiliki sistem validasi yang sangat powerful.

Validasi di controller:

public function store(Request $request)
{
    $validated = $request->validate([
        "name" => "required|string|max:255",
        "email" => "required|email|unique:users",
        "age" => "nullable|integer|min:1|max:150",
        "role" => "required|in:admin,editor,user",
    ]);

    $user = User::create($validated);
    return response()->json($user, 201);
}

Rule yang sering dipakai:

Error response otomatis (422):

{
    "message": "The name field is required.",
    "errors": {
        "name": ["The name field is required."],
        "email": ["The email has already been taken."]
    }
}

Form Request — Ekstrak Validasi dari Controller

Kalau rules-nya panjang atau dipakai di beberapa controller method, pindahkan ke Form Request class. Controller jadi bersih dan validasi lebih mudah di-test.

php artisan make:request StoreUserRequest

// app/Http/Requests/StoreUserRequest.php
namespace App\Http\Requests;

use Illuminate\Foundation\Http\FormRequest;

class StoreUserRequest extends FormRequest
{
    // Authorization — siapa yang boleh pakai request ini
    public function authorize(): bool
    {
        return auth()->check() && auth()->user()->can("create-user");
    }

    // Aturan validasi
    public function rules(): array
    {
        return [
            "name" => ["required", "string", "max:255"],
            "email" => ["required", "email", "unique:users"],
            "age" => ["nullable", "integer", "min:1", "max:150"],
            "role" => ["required", Rule::in(["admin", "editor", "user"])],
        ];
    }

    // (Opsional) custom error messages
    public function messages(): array
    {
        return [
            "email.unique" => "Email ini sudah terdaftar. Silakan login.",
        ];
    }

    // (Opsional) pre-process input sebelum validasi
    protected function prepareForValidation(): void
    {
        $this->merge([
            "email" => strtolower(trim($this->email ?? "")),
        ]);
    }
}

Kemudian di controller, type-hint FormRequest-nya — Laravel otomatis memvalidasi sebelum method body dijalankan:

public function store(StoreUserRequest $request)
{
    // Kalau validasi gagal, auto-return 422 — kode ini tidak tereksekusi
    // Kalau authorize() return false, auto-return 403

    $user = User::create($request->validated());  // hanya field yang divalidasi
    return response()->json($user, 201);
}

Keuntungan Form Request vs inline $request->validate():

Rule of thumb: kalau validasi ≤3 rules dan hanya dipakai sekali, inline OK. Begitu lebih dari itu atau dipakai di 2+ method, pindahkan ke Form Request.