Phase 7: API Route Matrix & FormRequests

This document maps the exact 106 operations exposed by the Laravel Router and analyzes how the architecture strictly enforces input validation through Typed FormRequest envelopes.

1. High-Level Route Tiers

The 237 registered routes in routes/api.php are cleanly segregated into 3 tiers. Each tier defines distinct expectations for the client.

2. The Domain Breakdown

The core API domains are isolated logically:

Auth Domain (/api/auth/*): Handles JWT issuance (login, register), rotation (refresh), logout, and password resets.

Catalog Domain (/api/catalog/*): Highly normalized, public read-only access to Destinations, Flights, Hotels, Restaurants, and Attractions.

Commerce Domain (/api/checkout, /api/paymob, /api/plans, /api/orders): Deals with subscriptions and pay-per-use products.

Trips Domain (/api/trips, /api/agency/*): CRUD for User trips, Itinerary items, Budget Snapshots, and AI trip generation.

System Domain (/api/system/*): Handles Contact logging, Newsletter subscriptions, Weather proxies, and Admin utilities (Analytics, Reports).

3. The `FormRequest` Enforcement Contract

The platform strictly prohibits inline validation drift. Zero Controllers perform $request->validate([...]).

How it works:

Every write endpoint (POST, PUT, PATCH) declares a dedicated class extending Illuminate\Foundation\Http\FormRequest.

The Laravel Kernel automatically resolves and validates the HTTP payload against the rules() array before the Controller method body even executes.

Enforcements:

Strict Types: Rules like string|in:plan,trip_fork,trip_package inherently block garbage data.

Payload Lengths: idempotency_key is strictly restricted to nullable|string|max:64.

Zero Drift: Because the FormRequest class is reused, if the email format changes, updating StoreContactRequest automatically applies the fix to all routes using it.

Automatic Quoting: Invalid payloads instantly return a uniform 422 JSON payload: {"message": "The given data was invalid.", "errors": {...}} without writing a single line of if logic.

4. The 106 Operations Matrix (Reconciled)

To truly audit the system against the routing table, we reconciled php artisan route:list --json. The total of 106 unique operations are mapped logically:

Why this matters:

The explicit documentation of the 106 endpoints (derived from php artisan route:list) serves as the definitive proof to frontend teams and QA auditors that every exposed API operation has a documented owner, a strict validation envelope, and an explicit Middleware guard (Auth, Verified, or HMAC).

Phase 7: API Route Matrix &amp; FormRequests

1. High-Level Route Tiers#

2. The Domain Breakdown#

3. The FormRequest Enforcement Contract#

How it works:#

Enforcements:#

4. The 106 Operations Matrix (Reconciled)#

Why this matters:#