Add ability to exclude routes

Let’s say I have some super secret endpoints (/admin/whatever), I’d like to be able to exclude them from the routes that are exposed via the generated JSON.

Maybe this can be achieved by adding a middleware, like how aaronlord/laroute does it.

As an extension of this, it’d be neat if I could use route groups to only expose certain routes to a “named” group, so I could use @routes('admin') in my blade file(s) to only expose routes in the admin group.

[mattstauffer]

In case y’all weren’t thinking this, I’d consider using Laravel’s regex matcher that allows for shortcuts like “api.*”" – the thing that is sourced by “Str::is”

[DanielCoulbourne]

@mikemand and @ctf0

Okay I have a compromise for you guys. I don’t like publishing a config file by default, but I don’t mind having an optional config file.

What if we publish all routes by default, then add support for optional config('ziggy.whitelist') and config('ziggy.blacklist') settings.

That way average users who don’t care won’t have to worry about black/white-listing routes, but if someone wants to do that, they have the option of just creating a config/ziggy.php file and adding one of those settings?

I’m thinking the setting could be an array of regular expressions, i.e. -

$whitelist = [
    /^auth./,         // matches for 'auth.login', 'auth.register' etc...
    /bank.vault/      // only matches the specified route.
];

This way it would be relatively simple to target entire route namespaces, or “any delete endpoint” or whatever.

How does that sit with y’all?