# Business rules — laravelReactjs

Evidence date: 2026-10-10.

Source: `git@bitbucket.org:overdrive/laravelreactjs.git`, `master` at `7e1ef64` (2019-04-05).

There is no business-rules document in the source repository. The rules below are taken from code and config. Rules that depend on framework behaviour around that code are marked **Inferred**. Nothing here is a confirmed business policy from a product owner.

No route creates a project, a task, or a user. Rules on the auth controllers apply only if those controllers are reached.

## Access

### BR-001 — The welcome page is public

`GET /` has no `auth` middleware. Any caller receives the welcome view.

Provenance: **Implemented**. Evidence: `routes/web.php`, `app/Http/Kernel.php`.

### BR-002 — The API user route requires the API guard

`GET /api/user` uses middleware `auth:api`. The guard driver is `token` and `hash` is `false`.

Provenance: **Implemented**. Evidence: `routes/api.php`, `config/auth.php`.

**Inferred.** With `hash` false, a stored token would be compared as plaintext. The `users` migration has no `api_token` column, so this rule has no row it can match.

### BR-003 — API calls are rate limited

The `api` middleware group includes `throttle:60,1` (60 requests per minute).

Provenance: **Implemented**. Evidence: `app/Http/Kernel.php`.

Web routes do not use `throttle`.

### BR-004 — Email verification resend would be rate limited

`VerificationController` applies `throttle:6,1` to `verify` and `resend`, and `signed` to `verify`. The controller is not routed.

Provenance: **Implemented** on an unrouted class. Evidence: `app/Http/Controllers/Auth/VerificationController.php`.

### BR-005 — No role or policy splits users

`AuthServiceProvider` registers no policies. `User` has no role attribute. The `users` table has no role column.

Provenance: **Implemented** absence. There is no authorisation rule beyond the guards above.

### BR-006 — Guest middleware would send an authenticated user to `/home`

`RedirectIfAuthenticated` redirects to `/home` when the guard already has a user. Login and register constructors attach `guest`. Those routes are not registered, and `/home` does not exist.

Provenance: **Implemented** in middleware and controllers. Not exercised.

## Registration and passwords

These rules live on `RegisterController`. No HTTP route calls it.

### BR-007 — Registration fields

| Field | Rule |
|---|---|
| `name` | Required string, maximum 255 characters |
| `email` | Required string, email format, maximum 255 characters, unique in `users.email` |
| `password` | Required string, minimum 8 characters, must match the confirmation field |

Provenance: **Implemented**. Evidence: `app/Http/Controllers/Auth/RegisterController.php`.

### BR-008 — Passwords are stored as hashes

`RegisterController::create` passes the password through `Hash::make`. The hash driver is `bcrypt`. Rounds default to 10 (`BCRYPT_ROUNDS`, default 10). PHPUnit sets `BCRYPT_ROUNDS` to 4 for the test process.

Provenance: **Implemented**. Evidence: `RegisterController`, `config/hashing.php`, `phpunit.xml`.

### BR-009 — Password and remember token are hidden from serialisation

`User::$hidden` is `password` and `remember_token`. A JSON user from `GET /api/user` would omit them if authentication ever succeeded.

Provenance: **Implemented**. Evidence: `app/User.php`.

### BR-010 — Mass assignment on users

Only `name`, `email`, and `password` are fillable. `email_verified_at` is not fillable.

Provenance: **Implemented**. Evidence: `app/User.php`.

### BR-011 — Password reset tokens last 60 minutes

`config/auth.php` sets `passwords.users.expire` to 60. The table is `password_resets`. Email is indexed. The reset controllers are not routed.

Provenance: **Implemented** configuration.

### BR-012 — Validation errors do not flash passwords

`Handler::$dontFlash` lists `password` and `password_confirmation`.

Provenance: **Implemented**. Evidence: `app/Exceptions/Handler.php`.

## Projects and tasks

### BR-013 — A project row has no business attributes

The `projects` table stores `id`, `created_at`, and `updated_at` only. `App\Project` adds no fillable list, casts, or relationship.

Provenance: **Implemented**. Evidence: `database/migrations/2019_03_29_132057_create_projects_table.php`, `app/Project.php`.

Eloquent's default guarding would reject mass assignment of any other attribute. There is no other column to assign. **Inferred** from Eloquent's default `$guarded = ['*']` on `Model`, which these classes do not override.

### BR-014 — A task row has no business attributes

Same shape as projects, on table `tasks` and model `App\Task`.

Provenance: **Implemented**. Evidence: `database/migrations/2019_03_29_131937_create_tasks_table.php`, `app/Task.php`.

### BR-015 — Projects and tasks are not tied to a user

No foreign key, no `user_id`, and no Eloquent relationship links `users`, `projects`, and `tasks`.

Provenance: **Implemented** absence.

**Unknown / Requires Confirmation:** whether a project should belong to a user, and whether a task should belong to a project. The code does not say.

## Sessions, CSRF, and mail

### BR-016 — Web requests start a file session

Committed env sets `SESSION_DRIVER=file` and `SESSION_LIFETIME=120` (minutes). The `web` group starts the session.

Provenance: **Implemented**. Evidence: `.env`, `.env.example`, `app/Http/Kernel.php`.

### BR-017 — State-changing web requests require a CSRF token

`VerifyCsrfToken` has an empty `$except` list. `GET /` does not change state. Axios will attach `X-CSRF-TOKEN` when a `csrf-token` meta tag is present. The welcome page does not emit that tag.

Provenance: **Implemented**.

### BR-018 — Email verification is not required of users

`User` does not implement `MustVerifyEmail`. The import is unused. A `Registered` listener for `SendEmailVerificationNotification` is registered anyway.

Provenance: **Implemented**. **Inferred:** the framework sends that notification only for models that implement the interface, so registration would not send it.

### BR-019 — Broadcast channel membership

`routes/channels.php` allows `App.User.{id}` only when the authenticated user's id equals the channel id. `App\Providers\BroadcastServiceProvider` is commented out in `config/app.php`, so this file is not loaded. The Echo client is commented out.

Provenance: **Implemented** as an unused file. Not an active rule.

## Data that is not a business rule

- `DatabaseSeeder` does not insert users, projects, or tasks. The commented `UsersTableSeeder` class is not in the repository.
- `UserFactory` builds a fake user with `email_verified_at` set to `now()` and a password hash whose source comment says `password`. That factory is the Laravel skeleton factory. No seeder calls it.
- Welcome-page links to Laravel marketing sites are theme copy, not product rules.
- `APP_DEBUG=true` in the committed env is a local framework setting, not a product rule about who may see errors.

## Conflicts

None between a written business policy and the code: there is no written policy in the repository.

The README title "Laravel React Tut" implies a tutorial product. The running behaviour is the Laravel welcome page plus unused models. That gap is **Unknown / Requires Confirmation**, not a rule the code enforces.