backend-development-rules

Create an interface like ProductRepository and an implementation ProductRepositoryImplement extending the Eloquent base class, then do the same for services. The RepositoryAutoBindProvider handles binding automatically, so no manual container registration is needed.

Call helpers()->permissionHelper()->validatePermission() with a PermissionEnum case at the start of the service method. Catch UnauthorizedHttpException for 401 responses and AccessDeniedHttpException for 403 responses separately.

This convention defaults to non-backed enums with UPPER_SNAKE_CASE case names, using the ->name property as the string value. Use backed enums only when explicitly required, such as matching specific database values.

Yes, controllers must return service responses via toJson() and include Scribe annotations like @group, @bodyParam, and @response scenarios. This generates accurate API documentation directly from controller docblocks.

Thin controllers only map HTTP requests to service calls, keeping business logic testable in services and data access in repositories. Typical controller methods stay around 15-25 lines with validation delegated to Form Requests.

Very small applications or prototypes with minimal data logic may not justify the extra interface and implementation layers. The pattern pays off in larger codebases needing testability, consistency, and clear separation of concerns.