Essential session storage is required to sign in. Optional analytics remain off unless you allow them.
Take a PHP (Laravel/Symfony) JSON API to production. Deliver: (1) a RESTful, versioned API with token authentication (Sanctum/Passport or JWT), validation, rate limiting, and consistent error responses; (2) PERFORMANCE — OPcache enabled, an optimized autoloader (composer install --no-dev --optimize-autoloader), Redis/Memcached caching for hot data, and no N+1 queries (verified); (3) static analysis (PHPStan) + PSR-12 enforced in CI, with a passing test suite; (4) DEPLOYMENT via PHP-FPM behind nginx (or a php-fpm Docker image), with .env config, migrations run on deploy, config/route caching, and a zero-downtime strategy; and (5) logging/monitoring (Monolog/PSR-3, no leaked errors in production). Document the setup and how you'd scale it.
Versioned REST API with token auth, validation, rate limiting, consistent errors; secure (no SQLi/XSS, hashed passwords).
OPcache on, optimized autoloader, cache layer, N+1 eliminated (shown); measurable speed.
PHP-FPM+nginx (or Docker); .env + migrations + config/route cache on deploy; zero-downtime; secrets safe.
PHPStan + PSR-12 in CI + passing tests; structured logging, no error leakage; scaling documented.
Use this README structure to make the work reviewable.
DevPath fetches a read-only, size-capped snapshot. Submitted code is never executed.
# A deployed, optimized PHP API ## Goal Take a PHP (Laravel/Symfony) JSON API to production. Deliver: (1) a RESTful, versioned API with token authentication (Sanctum/Passport or JWT), validation, rate limiting, and consistent error responses; (2) PERFORMANCE — OPcache enabled, an optimized autoloader (composer install --no-dev --optimize-autoloader), Redis/Memcached caching for hot data, and no N+1 queries (verified); (3) static analysis (PHPStan) + PSR-12 enforced in CI, with a passing test suite; (4) DEPLOYMENT via PHP-FPM behind nginx (or a php-fpm Docker image), with .env config, migrations run on deploy, config/route caching, and a zero-downtime strategy; and (5) logging/monitoring (Monolog/PSR-3, no leaked errors in production). Document the setup and how you'd scale it. ## Acceptance criteria - [ ] API & security: Versioned REST API with token auth, validation, rate limiting, consistent errors; secure (no SQLi/XSS, hashed passwords). - [ ] Performance: OPcache on, optimized autoloader, cache layer, N+1 eliminated (shown); measurable speed. - [ ] Deployment: PHP-FPM+nginx (or Docker); .env + migrations + config/route cache on deploy; zero-downtime; secrets safe. - [ ] Quality & ops: PHPStan + PSR-12 in CI + passing tests; structured logging, no error leakage; scaling documented. ## Verification - [ ] Document installation and run commands. - [ ] Record automated checks and their exact commands. - [ ] Add representative output, screenshots, or a short demo where useful. - [ ] Confirm failure paths and known constraints. ## Decision log ### Decision title - Context: - Choice: - Alternatives considered: - Tradeoffs: ## Evidence - Link each rubric criterion to the file, test, or artifact that demonstrates it. ## Known limitations - List what is intentionally out of scope and what should be improved next.