Why it matters: create() bypasses explicit assignment and hides mass assignment logic, making code less transparent about which fields are being set. Using new Model() followed by explicit propertyassignment makes dependencies and validation clearer, improving testability and reducing accidental mass assignment vulnerabilities.
Why it matters: Controllers should orchestrate, not implement business rules. Logic in controllers couples your business rules to HTTP concerns, making them untestable without mocking the entire request/response cycle. Extract to Services/Actions for reusability across jobs, commands, and queues.
Why it matters: Models should be authentication-agnostic; calling Auth::user() couples them to the framework and HTTP context. Pass the authenticated user explicitly as a parameter, allowing models