Laravel Trainer

Why MVC exists and what a Laravel project actually contains. Creating a project, reading the folder structure without guessing, and using the Artisan command line for generation, inspection and maintenance — the tool you will use in every subsequent module.

Topics: MVC and what a non-MVC PHP application costs you · Creating a Laravel project and the folder structure · Composer, autoloading and the vendor directory · The Artisan CLI: make, list, tinker and route commands · The service container and dependency resolution · Facades and what they actually resolve to

• Assignments: (1) Create a project and map every top-level directory to its responsibility; (2) Generate a controller, model and migration with Artisan and inspect what was written
• Capstone: Stand up a project skeleton with a working route, controller, model and view you keep for the rest of the course

The view layer. Layouts, partials, control structures and data display in Blade, its automatic XSS escaping and when you have to bypass it, then Blade components for genuine reuse. Finishes with the asset pipeline — Vite in current versions, Laravel Mix in the projects you may still be maintaining.

Topics: Why templating engines exist · Layouts, sections and stacks · Displaying data and Blade's XSS protection · Partials and includes · Control structures: conditionals, loops, directives · Blade components, slots and attribute merging · View composers · Asset compilation with Vite and Laravel Mix · Versioned assets and cache busting

• Assignments: (1) Convert a repeated block of markup into a Blade component with slots; (2) Wire an asset build and prove cache busting works after a change
• Capstone: Build a layout, navigation and component set that every later page in the project reuses

How a request actually travels through Laravel — public entry point, kernel, middleware stack, router, controller, response. Then the routing features that keep a growing route file readable: named routes, parameters, groups, prefixes and route-model binding.

Topics: The Laravel request lifecycle end to end · Defining GET and POST routes · Named routes and URL generation · Route parameters, optional parameters and constraints · Route groups, prefixes and middleware groups · Route-model binding, implicit and explicit · Middleware: writing, registering and ordering · Route caching and what breaks it

• Assignments: (1) Restructure a flat route file into groups with shared middleware and prefixes; (2) Write a middleware that rejects a request and prove the ordering matters
• Capstone: Design the full route map for the course project, named and grouped, with route-model binding throughout

Handling input safely. Extracting data from GET and POST requests, dependency injection versus facades for the request object, CSRF protection and why it exists, validation rules and form request classes, and the session flash messages that make validation errors visible to the user.

Topics: Extracting data from GET and POST requests · Dependency injection vs facades for the Request · Response types: views, redirects, JSON, files · Cross-site request forgery and Laravel's CSRF token · Validation rules and custom rules · Form request classes and authorisation inside them · Displaying validation errors and the old input helper · Session flash messages

• Assignments: (1) Move inline validation out of a controller into a form request class; (2) Break CSRF protection deliberately, observe the failure, then restore it
• Capstone: Deliver a form that validates server-side, repopulates old input, reports errors clearly and is CSRF-protected

Where logic belongs. Controller responsibilities and how Laravel resolves them, resource controllers, keeping business rules in models and services rather than controllers, and the configuration and environment system that lets one codebase run in development, staging and production.

Topics: Controllers, resource controllers and single-action controllers · How Laravel locates and resolves a controller · Model responsibilities and keeping controllers thin · Configuration files and the config helper · The .env file, environment variables and what must never be committed · Configuring database connections per environment · Config caching and its consequences · Service classes and the container

• Assignments: (1) Refactor a fat controller into a service class with injected dependencies; (2) Run the same codebase against two environments by configuration alone
• Capstone: Restructure the project so every business rule lives outside the controller and every environment difference lives in configuration

The persistence layer. Migrations as version control for the schema, the Eloquent ORM for reading and writing models, Tinker for exploring both interactively, and the query builder for the cases where Eloquent is the wrong tool.

Topics: Migrations: creating, running, rolling back and squashing · Schema builder: columns, indexes, foreign keys · Eloquent models, conventions and overriding them · Creating, updating and deleting models · Retrieving single models and collections · Collections and their methods · The query builder and raw expressions · Tinker as an exploration tool · Soft deletes, querying and restoring

• Assignments: (1) Write a migration set that builds the project schema from empty; (2) Solve the same query three ways — Eloquent, query builder, raw — and compare
• Capstone: Model the project's data layer with migrations, models and soft deletes, provable by rebuilding the database from scratch

The complete create, read, update, delete cycle wired to real forms. Form markup and method spoofing, storing submitted data, mass assignment and why fillable and guarded exist, edit and update actions, and deletion including related records.

Topics: Form markup, method spoofing and the CSRF field · Storing submitted data · Mass assignment, fillable and guarded · Edit forms and update actions · Deleting models and deleting through forms · Cascading deletes vs model events · Redirects, flash messages and the post-redirect-get pattern · File uploads, the Storage facade and validating uploaded files

• Assignments: (1) Implement full CRUD for one resource with validation and flash messaging; (2) Add an image upload with size, type and dimension validation, plus deletion of the stored file
• Capstone: Ship a complete resource management screen with create, edit, delete, upload and confirmation flows

The module that decides whether the application is fast. Every relationship type including polymorphic, then the performance work: lazy versus eager loading, querying relationship existence and absence, counting related models, and local and global query scopes.

Topics: One-to-one relationships: migration, assignment, querying · One-to-many relationships and inverse relations · Many-to-many, pivot tables and pivot data · Polymorphic relations: one-to-one, one-to-many and many-to-many · Model traits for shared relationship behaviour · Lazy loading vs eager loading and the N+1 problem · Querying relationship existence, absence and counts · Local query scopes · Global query scopes and the problems they cause · Nested eager loading

• Assignments: (1) Find and fix an N+1 query on a real listing page and record the query count before and after; (2) Replace three repeated query fragments with local scopes
• Capstone: Build a reporting page over a many-to-many and a polymorphic relation that renders in a constant number of queries

Who the user is, and what they are allowed to do — two separate problems that get conflated. Registration, login, guards, remember-me and logout; then authorisation with gates and policies, enforced in controllers, routes and Blade templates alike.

Topics: How registration and login work in Laravel · Guards, providers and the authentication configuration · Custom registration and login forms · Remember-me, logout and CSRF token expiry · Retrieving the authenticated user and protecting routes · The RedirectIfAuthenticated middleware · Gates and the authorize helper · Policies, policy discovery and authorizeResource · Gate or policy — choosing between them · Admin overrides and permission checks in Blade

• Assignments: (1) Write a policy that permits owners and administrators but nobody else, and test all three cases; (2) Protect a route, a controller action and a Blade block with the same authorisation rule
• Capstone: Deliver a complete authorisation model for the project where every action is permitted by an explicit rule

Tests that give real confidence. Configuring a test environment and database, feature tests for controller actions, testing creation, update, deletion and failure paths, and using model factories and seeders so tests and local development both start from realistic data.

Topics: Test configuration, environments and the test database · Writing a first feature test · Testing database interactions and refreshing state · Testing store, update and delete actions · Testing for failure and validation errors · Testing routes that require authentication · Model factories, states and callbacks · Seeders, individual seeder classes and seeding relations · Foreign keys and the SQLite not-null trap · Running the suite against MySQL rather than SQLite

• Assignments: (1) Write factories and a seeder that produce a realistic dataset in one command; (2) Add feature tests covering the happy path, the validation failure and the unauthorised case for one resource
• Capstone: Deliver a test suite that fails when authorisation, validation or a relationship is broken

Everything that should not happen inside the request. Cache stores and tags with Redis behind them, queued jobs with delays, retries, rate limits and named queues, model observers and events for decoupling, mailables including markdown mail, and localisation for multi-language applications.

Topics: Cache stores, the Cache facade and cache tags · Redis as a cache and queue backend · Queue configuration, jobs and running workers · Delayed jobs, retries and failed jobs · Rate limiting, named queues and prioritisation · Model observers, events, listeners and subscribers · Mailable classes, markdown mail and attachments · Previewing mail in the browser · Localisation, translation files and locale middleware · Logging and the Laravel Debugbar

• Assignments: (1) Move an outbound email into a queued job and prove the request returns before it sends; (2) Deliberately fail a job, inspect the failed_jobs table and retry it
• Capstone: Take the slowest action in the project, queue it, add retries and failure handling, and measure the response time change

Serving clients that are not Blade views. Model serialisation and hiding attributes, API resources and resource collections, pagination, token authentication, correct error responses, and testing JSON contracts. Then real integrations: social login and a payment provider, both of which teach credential handling and failure paths.

Topics: How model serialisation works and hiding attributes · API routes, controllers and versioning · API resources, resource collections and response wrapping · Conditional and relation-aware serialisation · Pagination and custom pagination parameters · Token authentication with Sanctum · Handling 404 and validation errors as JSON · Authorisation in an API context · Testing API endpoints and asserting JSON structure · Social login with Laravel Socialite · Consuming a third-party HTTP API with the HTTP client · Payment provider integration: orders, capture, cancellation and webhooks

• Assignments: (1) Expose one resource as a tested, paginated, token-authenticated JSON API; (2) Integrate one external provider and handle its failure and cancellation paths, not just the success path
• Capstone: Deliver an API that a mobile client could consume — authenticated, paginated, documented and covered by tests