- What is phpsa/laravel-api-controller used for?
- It provides a reusable base controller for building RESTful APIs in Laravel. It is designed to simplify common CRUD endpoints and standardize JSON responses so API controllers need less repetitive boilerplate. It fits conventional Laravel resource CRUD services that already use controllers, routing, API Resources, FormRequests, and Policies.
- How do I install phpsa/laravel-api-controller in a Laravel app?
- The typical integration is to run composer require phpsa/laravel-api-controller, publish any package configuration, and extend the package base controller from your API controllers. The assessment describes this as a configuration-and-convention integration rather than an architectural one. Check the package README and composer constraints for the exact publish and setup commands for your Laravel version.
- Which Laravel and PHP versions are supported by phpsa/laravel-api-controller?
- The provided context does not specify the exact supported Laravel and PHP version matrix for version 7.4.0. Before adopting it, confirm the package's illuminate/* and PHP constraints in composer.json against your pinned Laravel version and runtime. Also review the release notes and tests for any behavioral changes to the default single-guard path.
- How does phpsa/laravel-api-controller reduce boilerplate for CRUD APIs?
- It gives you a shared base controller that standardizes common RESTful CRUD behavior and JSON responses. That can reduce repeated controller code for conventional resource endpoints. The benefit is strongest when your API surface is broad and follows Laravel's normal controller, Eloquent, Resource, FormRequest, and Policy conventions.
- Does phpsa/laravel-api-controller support custom auth guards for multi-guard Laravel APIs?
- Version 7.4.0 adds custom auth guard support in the controller and resource layer. That makes the package more plausible for multi-guard applications, such as separate admin and consumer APIs, than earlier single-guard-only usage. However, the exact behavior must be verified because the context says guard resolution details are not explicit.
- How is the custom auth guard configured in v7.4.0?
- The context identifies several possibilities but does not confirm whether the guard is set by a controller property, config map, resource method, or container binding. It is also unclear whether configuration is per-action or per-controller. Verify against the package source and documentation before relying on it, and configure guards explicitly rather than depending on defaults.
- What happens if a guard is not configured or is misspelled?
- The key risk is a silent fallback to the default guard when a guard is unset or misspelled. If that happens, requests could authenticate as the wrong principal and authorization could silently succeed or fail in the wrong direction, including cross-tenant data exposure. Confirm that missing or invalid guard configuration fails closed, and add tests for that behavior before production use.
- Does phpsa/laravel-api-controller work with Sanctum or Passport token guards?
- The context says guard-awareness makes the package plausibly viable for multi-guard apps, but it does not confirm correct composition with Sanctum or Passport token guards. You should test token authentication, tenant-per-guard setups, and resource-level authorization paths directly. Also verify whether policy and gate resolution, authorizeResource, form-request authorize(), and API Resource conditional fields all honor the same guard.
- Is phpsa/laravel-api-controller suitable for DDD, action classes, or GraphQL-first APIs?
- It is a poor fit for teams using action or command classes, DDD-style aggregates, non-Eloquent repositories, or GraphQL-first APIs. The package's main value is convention over configuration for REST CRUD in idiomatic Laravel services. In those alternative architectures, most of its base-controller benefits are bypassed.
- How should I evaluate phpsa/laravel-api-controller before using it in production?
- Treat it as a lightly maintained dependency and consider isolating it behind an internal base class. Review the release diff rather than only the changelog, and verify multi-guard integration tests, fail-closed guard behavior, and coverage of policy, gate, form-request, and API Resource authorization paths. Run focused staging tests for your Laravel version, auth guards, and tenant model before adopting it.