Weave Code
Router Laravel Package
poshtive/router
Convention-based route discovery for Laravel controllers. Public methods become routes automatically, with PHP attributes for HTTP verb overrides, middleware, where constraints, prefixes, and model-bound parameters. Supports Laravel 12/13 and PHP 8.3.
Laravel Router - Automatic router for Laravel
Frequently asked questions about Router
- How do I install poshtive/router in a Laravel application?
- Install it with composer require poshtive/router and optionally publish the config using php artisan vendor:publish --provider="Poshtive\Router\RouterServiceProvider" --tag="config". The README declares PHP ^8.3 and Laravel components ^12.0|^13.0. Verify Composer resolution first, because the technical review flagged a Laravel ^13.0 constraint that can fail on current production stacks.
- Does poshtive/router work with Laravel 12 and Laravel 13?
- The README lists Laravel components ^12.0|^13.0, so Laravel 12 is inside the declared range when running PHP 8.3 or newer. Laravel 13 is not a shipping release line, so a ^13.0-only constraint would make Composer resolution fail on standard applications today. Check the actual composer.json before planning adoption.
- Why does poshtive/router register my public controller helper methods as routes?
- Discovery treats every public method on a discovered controller as an endpoint; there is no required #[Route] gate. Public authorization shims, formatting utilities, and trait-provided helpers therefore become reachable GET routes by default. Keep discovered controllers actions-only and use DoNotDiscover or a strict allowlist/denylist discipline to limit exposure.
- How are HTTP verbs and URIs derived by poshtive/router?
- Routes are derived from filesystem path, class name, method name, and method signature, for example UserController::index becomes GET /user and show(User $user) uses a model-bound parameter. Explicit overrides come from PHP attributes such as #[Route(method: 'POST')] or #[Route(method: ['PUT', 'PATCH'])]. Note that #[Route(uri: 'profile')] on UserController yields GET /profile, not GET /user/profile, because uri escapes the derived controller prefix.
- Can poshtive/router silently shadow an existing route?
- Yes. strict defaults to false, so duplicate VERB plus URI collisions are logged only when available and registration continues with last-write-wins resolution. A controller added in the wrong directory can quietly steal traffic from an existing endpoint. Setting strict to true turns collisions into exceptions, but that can also fail application boot.
- Is poshtive/router safe to use in production?
- Treat it as high risk for production systems. Boot-time discovery means one bad controller, duplicate route, or child-controller rule violation can throw and return 500 responses on every route, including health checks and auth. Public-method exposure, silent route shadowing, and implicit middleware inheritance make security review harder. It is a poor fit when URLs are externalized to bookmarks, SEO, mobile clients, partners, or webhooks.
- How does middleware inheritance affect authentication in poshtive/router?
- Middleware can come from group config, class-level #[Route(middleware: ...)], parent-class inheritance, and IgnoreParentMiddleware. Determining whether an endpoint is authenticated requires traversing the controller class hierarchy plus attributes instead of grepping a route file. This is an auditability regression on the highest-risk dimension of a Laravel application.
- What is the child-controller rule for model-bound parameters in poshtive/router?
- All methods inside a nested controller folder such as User/ must have at least one Eloquent Model parameter, or registration fails and throws. That convention supports model-bound parameters and nested resources, but it becomes a boot-time failure if a contributor adds an incompatible controller. Review nested controller signatures carefully before enabling strict mode.
- How can I test which routes poshtive/router registers?
- Run php artisan route:list to inspect the final route table, including verbs, URIs, names, and middleware. Add automated tests that assert expected routes exist and that public helper methods are not exposed. The package reports PHPUnit 11 with Orchestra Testbench 10/11 coverage, but your own route-table assertions are still essential.
- What are alternatives to poshtive/router, and how is it maintained?
- Use Laravel's native declarative routing with route files, Route::resource, and grouped routes for cacheable, reviewable route tables. Attribute-driven packages such as spatie/laravel-route-attributes require explicit attributes instead of discovering every public method. Maintenance diligence is difficult here: the repository is poshtive/laravel-router, CI badges point at qoqn/laravel-router, and it has no stars, dependents, or clear security disclosure path.
Weaver
How can I help you explore Laravel packages today?