Essential session storage is required to sign in. Optional analytics remain off unless you allow them.
Build a fuller Laravel app and harden it for production (a multi-user SaaS-style app, a marketplace). Requirements: (1) authentication (a starter kit) plus AUTHORIZATION via Gates/Policies (make:policy, $user->can / @can); (2) OFFLOAD slow work to a queued JOB (ShouldQueue + dispatch, processed by queue:work) — e.g. email via a Mailable ->queue(); (3) SECURITY: rely on Laravel's defaults — @csrf, Blade {{ }} auto-escaping, PDO-bound Eloquent (no whereRaw with user input), $fillable — and keep the APP_KEY and secrets in .env (out of source), with APP_DEBUG=false in production; (4) a test suite (feature + unit, RefreshDatabase, fakes for mail/queue); (5) a deploy story — PHP-FPM behind nginx (or Octane), config:cache/route:cache, migrate --force, a queue worker, and the scheduler cron. Document the security and deploy choices.
Authentication + Gates/Policies authorization; slow work offloaded to a queued job (ShouldQueue + queue:work).
Laravel defaults relied on (@csrf, Blade escaping, PDO-bound Eloquent, $fillable); APP_KEY/secrets in .env; APP_DEBUG=false in prod.
Feature + unit tests with RefreshDatabase and Mail/Queue fakes; a credible deploy story — PHP-FPM/Octane, config:cache, migrate --force, worker + scheduler.
Use this README structure to make the work reviewable.
DevPath fetches a read-only, size-capped snapshot. Submitted code is never executed.
# A production-ready, secure Laravel app
## Goal
Build a fuller Laravel app and harden it for production (a multi-user SaaS-style app, a marketplace). Requirements: (1) authentication (a starter kit) plus AUTHORIZATION via Gates/Policies (make:policy, $user->can / @can); (2) OFFLOAD slow work to a queued JOB (ShouldQueue + dispatch, processed by queue:work) — e.g. email via a Mailable ->queue(); (3) SECURITY: rely on Laravel's defaults — @csrf, Blade {{ }} auto-escaping, PDO-bound Eloquent (no whereRaw with user input), $fillable — and keep the APP_KEY and secrets in .env (out of source), with APP_DEBUG=false in production; (4) a test suite (feature + unit, RefreshDatabase, fakes for mail/queue); (5) a deploy story — PHP-FPM behind nginx (or Octane), config:cache/route:cache, migrate --force, a queue worker, and the scheduler cron. Document the security and deploy choices.
## Acceptance criteria
- [ ] Feature depth: Authentication + Gates/Policies authorization; slow work offloaded to a queued job (ShouldQueue + queue:work).
- [ ] Security hardening: Laravel defaults relied on (@csrf, Blade escaping, PDO-bound Eloquent, $fillable); APP_KEY/secrets in .env; APP_DEBUG=false in prod.
- [ ] Tests & deployment: Feature + unit tests with RefreshDatabase and Mail/Queue fakes; a credible deploy story — PHP-FPM/Octane, config:cache, migrate --force, worker + scheduler.
## Verification
- [ ] Document installation and run commands.
- [ ] Record automated checks and their exact commands.
- [ ] Add representative output, screenshots, or a short demo where useful.
- [ ] Confirm failure paths and known constraints.
## Decision log
### Decision title
- Context:
- Choice:
- Alternatives considered:
- Tradeoffs:
## Evidence
- Link each rubric criterion to the file, test, or artifact that demonstrates it.
## Known limitations
- List what is intentionally out of scope and what should be improved next.