Update

Author: walkor

README.md

@@ -205,6 +205,32 @@ class UserController
 }
 ```
 
+### Validation Data Source
+
+```php
+use support\validation\annotation\Validate;
+
+class UserController
+{
+    #[Validate(
+        rules: ['email' => 'required|email'],
+        in: ['query', 'body', 'path']
+    )]
+    public function send()
+    {
+        return json(['code' => 0, 'msg' => 'ok']);
+    }
+}
+```
+
+Use `in` to specify where validation data comes from:
+
+* **query** – HTTP query parameters from `$request->get()`
+* **body** – HTTP body from `$request->post()`
+* **path** – Path/route parameters from `$request->route->param()`
+
+`in` can be a string or array; when it's an array, values are merged in order and later sources override earlier ones. When `in` is omitted, it defaults to the equivalent of `['query', 'body', 'path']`.
+
 ## Parameter-Level Validation (Param)
 
 ### Basic Usage
@@ -224,6 +250,23 @@ class MailController
 }
 ```
 
+### Validation Data Source
+
+Parameter-level validation also supports the `in` parameter to specify data source:
+
+```php
+use support\validation\annotation\Param;
+
+class MailController
+{
+    public function send(
+        #[Param(rules: 'required|email', in: ['body'])] string $from
+    ) {
+        return json(['code' => 0, 'msg' => 'ok']);
+    }
+}
+```
+
 ### Rules Support String or Array
 
 ```php

README.zh-CN.md

@@ -206,6 +206,32 @@ class UserController
 }
 ```
 
+### 验证数据来源
+```php
+use support\validation\annotation\Validate;
+
+class UserController
+{
+    #[Validate(
+        rules: ['email' => 'required|email'],
+        in: ['query', 'body', 'path']
+    )]
+    public function send()
+    {
+        return json(['code' => 0, 'msg' => 'ok']);
+    }
+}
+```
+
+通过`in`参数来指定数据来源，其中：
+
+* **query** http请求的query参数，取自 `$request->get()`
+* **body** http请求的包体，取自 `$request->post()`
+* **path** http请求的路径参数，取自 `$request->route->param()`
+
+`in`可为字符串或数组；为数组时按顺序合并，后者覆盖前者。未传递`in`时默认等效于 `['query', 'body', 'path']`。
+
+
 ## 参数级验证（Param）
 
 ### 基本用法
@@ -225,6 +251,24 @@ class MailController
 }
 ```
 
+### 验证数据来源
+
+类似的，参数级也支持`in`参数指定来源
+
+```php
+use support\validation\annotation\Param;
+
+class MailController
+{
+    public function send(
+        #[Param(rules: 'required|email', in: ['body'])] string $from
+    ) {
+        return json(['code' => 0, 'msg' => 'ok']);
+    }
+}
+```
+
+
 ### rules 支持字符串或数组
 
 ```php

src/Tests/ValidateMiddlewareTest.php

@@ -195,6 +195,56 @@ public function testParamInPathReadsFromPathOnly(): void
         $this->assertTrue($called);
     }
 
+    public function testValidateInWithValidatorQueryBodyOrderPass(): void
+    {
+        $request = $this->makeRequest(
+            controller: InWithValidatorQueryBodyController::class,
+            action: 'send',
+            query: ['id' => 1],
+            body: ['id' => 2]
+        );
+
+        $called = false;
+        (new Middleware())->process($request, function () use (&$called) {
+            $called = true;
+            return 'ok';
+        });
+
+        $this->assertTrue($called);
+    }
+
+    public function testValidateInWithValidatorBodyQueryOrderFail(): void
+    {
+        $request = $this->makeRequest(
+            controller: InWithValidatorBodyQueryController::class,
+            action: 'send',
+            query: ['id' => 1],
+            body: ['id' => 2]
+        );
+
+        $this->expectException(ValidationException::class);
+        $this->expectExceptionMessage('ID invalid');
+        (new Middleware())->process($request, fn () => 'ok');
+    }
+
+    public function testValidateInWithValidatorPathPass(): void
+    {
+        $request = $this->makeRequest(
+            controller: InWithValidatorPathController::class,
+            action: 'send',
+            query: ['id' => 1],
+            routeParams: ['id' => 7]
+        );
+
+        $called = false;
+        (new Middleware())->process($request, function () use (&$called) {
+            $called = true;
+            return 'ok';
+        });
+
+        $this->assertTrue($called);
+    }
+
     public function testValidateInUnsupportedValueThrows(): void
     {
         $request = $this->makeRequest(
@@ -1144,6 +1194,48 @@ public function send(Request $request): void
     }
 }
 
+final class InWithValidatorId2Validator extends Validator
+{
+    protected array $rules = [
+        'id' => 'required|integer|in:2',
+    ];
+
+    protected array $messages = [
+        'id.in' => 'ID invalid',
+    ];
+}
+
+final class InWithValidatorId7Validator extends Validator
+{
+    protected array $rules = [
+        'id' => 'required|integer|in:7',
+    ];
+}
+
+final class InWithValidatorQueryBodyController
+{
+    #[Validate(in: ['query', 'body'], validator: InWithValidatorId2Validator::class)]
+    public function send(Request $request): void
+    {
+    }
+}
+
+final class InWithValidatorBodyQueryController
+{
+    #[Validate(in: ['body', 'query'], validator: InWithValidatorId2Validator::class)]
+    public function send(Request $request): void
+    {
+    }
+}
+
+final class InWithValidatorPathController
+{
+    #[Validate(in: 'path', validator: InWithValidatorId7Validator::class)]
+    public function send(Request $request): void
+    {
+    }
+}
+
 final class ParamController
 {
     public function send(