fix: update csrfHard

Author: mychidarko

src/Blade.php

@@ -186,14 +186,14 @@ public function __call(string $method, array $params)
     }
 
     /**
-     * Called when @csrf is rendered without the leafs/csrf module installed.
+     * Called when @csrfHard is rendered without the leafs/csrf module installed.
      * A CSRF directive that silently outputs nothing leaves forms unprotected
      * while looking protected, so this fails loudly instead: an exception in
      * debug, a logged warning in production.
      */
     public static function csrfModuleMissing()
     {
-        $message = '@csrf was rendered but the leafs/csrf module is not installed, so this form is NOT protected. Run `leaf install csrf` or `composer require leafs/csrf`, or remove the @csrf directive.';
+        $message = '@csrfHard was rendered but the leafs/csrf module is not installed, so this form is NOT protected. Run `leaf install csrf` or `composer require leafs/csrf`, or switch to @csrf if protection should stay optional here.';
 
         $debug = true;
 

tests/blade.test.php

@@ -135,11 +135,15 @@
     expect($out)->toContain('public');
 });
 
-test('@csrf throws loudly when the csrf module is missing', function () {
-    template('csrf-missing', '<form>@csrf</form>');
+test('@csrf stays silent without the module; @csrfHard fails loudly', function () {
+    template('csrf-missing', '[@csrf]');
+    template('csrf-hard-missing', '<form>@csrfHard</form>');
 
+    // @csrf is an activation contract: scaffolds carry it, and it renders
+    // nothing until leafs/csrf is installed. @csrfHard is the strict variant.
     // Must run before the module-present test below, which defines a global csrf().
-    expect(fn () => blade()->render('csrf-missing'))
+    expect(blade()->render('csrf-missing'))->toBe('[]');
+    expect(fn () => blade()->render('csrf-hard-missing'))
         ->toThrow(Exception::class, 'leafs/csrf module is not installed');
 });