Laravel Rajaongkir Laravel Package

Technical Evaluation

Architecture fit. This is a thin HTTP wrapper — service provider, published config, and a client that fronts the RajaOngkir REST API for three capabilities: administrative lookups (provinces, cities, districts), domestic shipping cost quotes (origin, destination, weight, courier), and account/tier metadata. It belongs in the infrastructure layer, but the output is commercially sensitive: shipping cost is summed into the order total at checkout. That means the package must not be called directly from controllers or Blade templates. Wrap it behind an application-owned ShippingRateProvider contract so the vendor is an implementation detail and quotes can be cached, logged, faked in tests, and re-sourced without touching checkout logic. Two distinct workloads also need separating: reference data (provinces/cities/districts) is near-static and should be mirrored locally with a scheduled sync; rate quotes are dynamic and need a short-TTL cache. A package that fetches province lists on every page render is an architectural smell regardless of code quality.

Integration feasibility. Mechanically trivial — composer require, publish config, set the API key, call the facade. The effort is entirely in verification, not construction. At 7 stars, a score of 0.395, and a last release of September 2022, this is a low-adoption, single-maintainer artifact. The decisive feasibility question is framework compatibility: a 2022 package almost certainly caps at Laravel 9, which will block or force a composer.json constraint override on Laravel 10/11/12.

Technical risk. Three risks dominate, in order:

1. Abandonment plus upstream drift. RajaOngkir's API has been reorganised under Komerce with changes to registration, API key format, and endpoint hosts. A package whose last commit predates that work either hardcodes a dead base URL or requires manual config surgery. There is no upstream fix path if the API moves again.
2. Silent payload loss on POST. The 3.0.4 fix ("data tidak terkirim untuk method post") is precisely the failure class that matters here, because the cost-calculation call is the POST in this API. A body that never arrives can yield a default, empty, or partial rate response that looks like a 200. Shipping undercharge is a direct revenue leak; overcharge is a support ticket per order. Treat every quote path as unverified until proven.
3. Rate limits tied to a paid account tier. RajaOngkir quotas are per-plan, and some endpoints (districts/subdistricts) are tier-gated. Checkout-time quote calls can exhaust a starter quota quickly.

Key questions.

• What Laravel and PHP versions does composer.json actually permit? Is there a maintained fork?
• Is the base URL configurable, and does it point at the pre- or post-Komerce host?
• Is the cost query sent as form-encoded or JSON, and does the package expose the encoding choice?
• Does it use Laravel's Http facade / injectable Guzzle client, or construct transport internally (unmockable)?
• Does it raise on 4xx/5xx, or return a decoded body that silently carries an error payload?
• Are error codes from RajaOngkir (invalid key, quota exceeded, unknown city) surfaced distinctly from transport errors?
• Does it ship migrations or seeders for province/city data, and if so, how stale is the fixture?
• Does it handle the tier-gated district endpoint, and what happens on a plan that lacks it?
• Who is the maintainer, and what is the bus factor?

Integration Approach

Stack fit. Assumes Laravel 8–9 / PHP 8.0–8.1, Composer-installed, configured via a published config file with the API key in .env. Confirm the transport is mockable before committing — if the client instantiates its own HTTP layer, testability and retry behaviour both degrade and the integration cost rises materially.

Migration path. Net-new, so there is no migration. Pin ^3.0.4 explicitly and commit the lockfile; do not let ^3.0 float, and do not permit 3.0.0–3.0.3 to resolve from a stale cache on any machine or CI runner. Verify the resolved version in CI with composer show.

Compatibility. Validate against the real application matrix rather than the package's claims:

• Laravel major versions in use; whether the service provider is deferred and whether facade aliases are registered the old way.
• PHP 8.2/8.3 deprecation noise (dynamic properties, implicit nullable params).
• Guzzle major version pinning, and whether it conflicts with anything else in the tree.
• Config key and facade alias collisions with existing packages.
• Whether the package assumes IDR and gram-based weight — both correct for this domain, but they must be documented invariants at the adapter boundary.

Sequencing.

1. Read composer.json, src/, and the 3.0.4 diff before writing a line of application code. Ten minutes here decides whether the rest is worth doing.
2. Spike in a throwaway Laravel app against a real sandbox/starter account. Assert the POST body arrives — use Http::fake() with a body assertion and a real echo-style validation against RajaOngkir's cost endpoint. Do not accept a 2xx as evidence.
3. Mirror provinces/cities/districts into local tables via a scheduled sync command; make application code read from local data.
4. Define ShippingRateProvider (interface) plus a RajaOngkirRateProvider adapter and a FakeRateProvider for tests. Bind in a dedicated service provider.
5. Add a contract test asserting the outbound cost-query payload — this is the regression guard the package itself evidently lacked.
6. Implement a direct-HTTP fallback adapter (30–60 lines against the documented API) so abandonment is a config switch, not a rewrite.
7. Only then wire into checkout, behind a short-TTL quote cache keyed by origin/destination/weight/courier.

Operational Impact

Maintenance. Assume unmaintained. Last release September 2022, 7 stars, no visible cadence. Treat the package as vendored code your team now owns: fork it into a private VCS or accept that a PHP/Laravel upgrade may strand you. Assign a named owner and put a quarterly "does upstream still work" check on the calendar. A stale Indonesian-language changelog compounds this — triage costs translation and interpretation time on top of normal review.

Support. Community-only, no SLA, no escalation. RajaOngkir/Komerce support covers the API, not this wrapper, so any breakage lands entirely on your team. If this package sits in the checkout path, the absence of support is a revenue risk, not just a technical one. Budget explicitly for the fallback adapter in the sequencing step — it is the cheapest insurance available and it is small.

Scaling. All cost is outbound HTTP against a tiered quota. Three mitigations: cache reference data locally (removes the majority of calls), cache quotes with a short TTL and normalise the cache key (round weight to realistic buckets), and never call the API synchronously on a hot path if it can be precomputed at cart-update or address-selection time. Watch for retry storms against a 429 — the package's retry behaviour, if any, must respect Retry-After. Retries on a non-idempotent POST are only safe because this endpoint is a read-shaped quote, but confirm that assumption rather than inheriting it.

Failure modes.

• Silent empty POST body → default or missing rate → undercharged shipping. Observed in this release line. Mitigate with body-level assertions and a sanity floor on returned rates.
• Dead or changed base URL after the upstream API reorganisation → every quote fails or returns an error document with HTTP 200.
• Quota exhaustion / 429 → checkout blocked for all users simultaneously. Needs a degraded path (flat-rate fallback, or "shipping calculated after order").
• Error payloads read as success → a rate of zero or null flows into the order total.
• Stale administrative data → destination city IDs that no longer match upstream, producing valid-looking but wrong quotes.
• Tier downgrade or key rotation → district lookups disappear or all calls 401. Verify config is read at resolve time, not cached at boot requiring a restart.
• Timeout ambiguity → for a quote this is benign (retry freely); it becomes serious only if the adapter is later extended to create shipments or track waybills.

Ramp-up. The code surface is small — a mid-level Laravel developer is productive in half a day. The real cost is domain comprehension: Indonesian courier semantics (JNE, POS, TIKI, SiCepat, Anteraja), gram-based weight and dimensional rounding rules, origin=warehouse-city conventions, and validating that quoted rates match what operations expects. Allocate senior review time for the 3.0.4 diff and for the quote-validation test suite. Realistically: one engineer-week end to end including the fallback adapter and local reference-data sync, and I would not approve the integration without that week.