Validating Input Cleanly with Form Requests: Security & Business Rules

<?php

declare(strict_types=1);

namespace App\Http\Requests;

use Illuminate\Foundation\Http\FormRequest;
use Illuminate\Validation\Rule;

class StoreHospitalQuoteRequest extends FormRequest
{
    public function authorize(): bool {
        return $this->user()?->can('create-quotes') ?? false;
    }

    protected function prepareForValidation(): void {
        if ($this->has('client_email')) {
            $this->merge(['client_email' => strtolower(trim((string)$this->client_email))]);
        }
    }

    public function rules(): array {
        return [
            'client_name' => ['required', 'string', 'max:255'],
            'client_email' => ['nullable', 'email:rfc,dns'],
            'currency' => ['required', Rule::in(['KES', 'USD', 'EUR'])],
            'items' => ['required', 'array', 'min:1'],
            'items.*.description' => ['required', 'string'],
            'items.*.price' => ['required', 'numeric', 'min:0.01'],
        ];
    }
}