# Technical documentation — laravelReactjs

Evidence date: 2026-10-10.

Source: `git@bitbucket.org:overdrive/laravelreactjs.git`, `master` at `7e1ef64` (2019-04-05, Jaco Brits, "Test possible code"). Parent commit `f2c77b9` (2019-04-04) is the Bitbucket README only.

The scan-host copies of `sonar-project.properties` and `sonarqube_scan.bat` are not in this revision.

Secrets are described by name and by whether they are empty or set. Values are not copied.

## Architecture

Monolithic Laravel 5.8 application. HTTP enters `public/index.php` (or `server.php`, which includes that file when the path is not a real file under `public/`). `RouteServiceProvider` maps:

| File | Middleware | Prefix | Namespace |
|---|---|---|---|
| `routes/web.php` | `web` | none | `App\Http\Controllers` |
| `routes/api.php` | `api` | `api` | `App\Http\Controllers` |

`routes/console.php` registers the `inspire` closure. `routes/channels.php` is not loaded, because `App\Providers\BroadcastServiceProvider` is commented out in `config/app.php`.

Application code under `app/` is small. Most of the 7,936 tracked files are `vendor/`.

```text
public/index.php
  bootstrap/app.php
    app/Http/Kernel.php          HTTP
    app/Console/Kernel.php       Artisan
    app/Exceptions/Handler.php
  routes/web.php    GET /
  routes/api.php    GET /api/user
```

No domain services, jobs, events (beyond the skeleton `Registered` listener), notifications, policies, or form requests exist under `app/`.

## Application structure

```text
app/
  Console/Kernel.php
  Exceptions/Handler.php
  Http/Controllers/Controller.php
  Http/Controllers/Auth/          five skeleton auth controllers
  Http/Kernel.php
  Http/Middleware/                stock middleware, CSRF except list empty
  Providers/                      App, Auth, Broadcast (not registered), Event, Route
  Project.php                     empty model
  Task.php                        empty model
  User.php
bootstrap/
config/                           Laravel 5.8 config set
database/factories/UserFactory.php
database/migrations/              users, password_resets, tasks, projects
database/seeds/DatabaseSeeder.php
public/                           index.php, .htaccess, web.config, compiled css/js
resources/js/                     bootstrap.js, app.js, components/Example.js
resources/lang/en/                auth, pagination, passwords, validation
resources/sass/                   app.scss, _variables.scss
resources/views/welcome.blade.php
routes/
storage/                          gitignore placeholders only
tests/Feature/ExampleTest.php
tests/Unit/ExampleTest.php
vendor/                           committed
```

`app/Console/Commands/` is absent. `Kernel::commands()` still calls `$this->load(__DIR__.'/Commands')`.

There is no `HomeController` and no auth Blade views. Laravel's `make:auth` output is not what this tree contains. The auth controllers match the 5.8 application skeleton, which ships them before routes are registered.

## Frameworks and languages

| Layer | Choice | Evidence |
|---|---|---|
| Language | PHP `^7.1.3` | `composer.json` |
| Framework | `laravel/framework` `5.8.*` | `composer.json` |
| HTTP proxy headers | `fideloper/proxy` `^4.0` | `composer.json`, `TrustProxies` |
| REPL | `laravel/tinker` `^1.0` | `composer.json` |
| UI library | React `^16.2.0`, React DOM `^16.2.0` | `package.json` |
| CSS | Bootstrap `^4.0.0`, Sass | `package.json`, `resources/sass/app.scss` |
| HTTP client in the browser | Axios `^0.18` | `package.json`, `resources/js/bootstrap.js` |
| Bundler | Laravel Mix `^4.0.7` (Webpack) | `package.json`, `webpack.mix.js` |
| Tests | PHPUnit `^7.5` | `composer.json`, `phpunit.xml` |

`composer.json` `name` is `laravel/laravel`, license `MIT`, description "The Laravel Framework." That is the skeleton metadata. It is not a separate licence file from Overdrive.

Other require-dev packages: `beyondcode/laravel-dump-server`, `filp/whoops`, `fzaninotto/faker`, `mockery/mockery`, `nunomaduro/collision`.

Frontend packages are all under `devDependencies`. `package.json` is `"private": true`.

## Databases

Default connection: `env('DB_CONNECTION', 'mysql')`.

Committed `.env` and `.env.example` set:

| Key | Value in both files |
|---|---|
| `DB_CONNECTION` | `mysql` |
| `DB_HOST` | `127.0.0.1` |
| `DB_PORT` | `3306` |
| `DB_DATABASE` | `homestead` |
| `DB_USERNAME` | `homestead` |

`DB_PASSWORD` is also identical in both files and is the Laravel example value, not a separately chosen production password. It is not repeated here.

`config/database.php` also defines `sqlite`, `pgsql`, and `sqlsrv`. Nothing switches the app to them. MySQL `database` falls back to `forge` only when `DB_DATABASE` is unset. The committed env sets it.

Migrations:

| File | Table | Columns beyond the framework defaults |
|---|---|---|
| `2014_10_12_000000_create_users_table.php` | `users` | `name`, unique `email`, nullable `email_verified_at`, `password`, `rememberToken`, timestamps, big integer `id` |
| `2014_10_12_100000_create_password_resets_table.php` | `password_resets` | indexed `email`, `token`, nullable `created_at` |
| `2019_03_29_131937_create_tasks_table.php` | `tasks` | `id`, timestamps |
| `2019_03_29_132057_create_projects_table.php` | `projects` | `id`, timestamps |

No foreign keys. No `jobs` or `failed_jobs` tables. No seed data. `UserFactory` exists for tests and is not called by `DatabaseSeeder`.

Eloquent models live in the `App` namespace (Laravel 5.8 layout), not `App\Models`.

## HTTP surface

| Method | Path | Middleware | Action |
|---|---|---|---|
| GET | `/` | `web` | Closure returns `view('welcome')` |
| GET | `/api/user` | `api`, `auth:api` | Closure returns `$request->user()` |

Global middleware: `CheckForMaintenanceMode`, `ValidatePostSize`, `TrimStrings`, `ConvertEmptyStringsToNull`, `TrustProxies`.

`TrimStrings` and maintenance mode are the skeleton classes. They were not customised (empty exception lists on maintenance and trim, aside from the stock password trim exceptions in `TrimStrings`).

Auth controllers exist for login, registration, forgot password, reset, and verification. They are not referenced from `routes/web.php`. Their `$redirectTo` is `/home`. That path is not registered.

`public/.htaccess` and `public/web.config` are the skeleton rewrite files. `public/robots.txt` and `public/favicon.ico` are present. `public/js/app.js` is a one-line Webpack bundle (about 337 KB) that contains the example component text. `public/css/app.css` is compiled Sass/Bootstrap (about 128 KB). The welcome view uses inline CSS and does not link either file.

## Frontend build

`webpack.mix.js`:

```text
mix.react('resources/js/app.js', 'public/js')
   .sass('resources/sass/app.scss', 'public/css')
```

npm scripts: `dev`, `development`, `watch`, `watch-poll`, `hot`, `prod`, `production`. They call Webpack through `node_modules/laravel-mix`. `node_modules/` is gitignored and is not in the commit, so those scripts need an install before they can run. The compiled output is already committed.

`resources/js/bootstrap.js` sets `window._`, jQuery, Popper, Bootstrap, and Axios. The Echo import and `window.Echo = new Echo({ broadcaster: 'pusher' ...})` block is commented out.

`Example.js` mounts only when an element id `example` exists. No view provides it.

`resources/sass/app.scss` imports Nunito from Google Fonts, Sass variables, Bootstrap, and a `.navbar-laravel` rule. The welcome page loads Nunito itself and does not use this stylesheet.

## Auth

| Item | Setting |
|---|---|
| Default guard | `web` (session, provider `users`) |
| API guard | `token`, provider `users`, `hash` false |
| Provider model | `App\User` |
| Passwords | provider `users`, table `password_resets`, expire 60 minutes |
| Password hash | bcrypt, rounds `env('BCRYPT_ROUNDS', 10)` |
| User fillable | `name`, `email`, `password` |
| User hidden | `password`, `remember_token` |
| User casts | `email_verified_at` => `datetime` |
| MustVerifyEmail | Imported, not implemented |
| Policies | None |
| Cipher | `AES-256-CBC` |
| Key | `env('APP_KEY')` |

`EventServiceProvider` maps `Illuminate\Auth\Events\Registered` to `SendEmailVerificationNotification`.

`LoginController` uses `AuthenticatesUsers` and allows `logout` through the `guest` middleware. `RegisterController` validates name, email, and password as documented in `business-rules.md`.

The token guard's usual column, `api_token`, is not on `users`. **Inferred:** `GET /api/user` cannot authenticate until that column (or a custom token lookup) exists.

## Queues, scheduling, mail, storage

| Concern | State |
|---|---|
| Queue | `QUEUE_CONNECTION=sync`. No job classes. Database queue config names table `jobs`, which has no migration |
| Schedule | `Kernel::schedule` is empty. The `inspire` hourly line is commented out |
| Mail | `MAIL_DRIVER=smtp`, host `smtp.mailtrap.io`, port `2525`, username and password `null`. No mailable class |
| Cache | `file` |
| Session | `file`, lifetime 120 minutes |
| Logs | `LOG_CHANNEL=stack`, stack channel `daily`, 14 days, `storage/logs/laravel.log` |
| Filesystem default | `env('FILESYSTEM_DRIVER', 'local')`, root `storage/app` |
| Cloud disk | `s3`, keys from `AWS_*`. Those keys are empty in the committed env |
| Public disk | `storage/app/public`, URL `APP_URL/storage` |

`config/services.php` lists Mailgun, Postmark, SES, SparkPost, and Stripe. No env keys for them are in `.env.example`. No application code reads them.

Broadcast driver in env is `log`. It is unused while the app broadcast provider is disabled.

## Environment

`.gitignore` contains one line: `node_modules`.

Tracked files that a stock Laravel 5.8 gitignore would exclude:

- `.env`
- `vendor/`
- `public/js/app.js` and `public/css/app.css` are normal to commit for some teams; they are tracked here

`.env` and `.env.example` have the same keys. Every value matches except `APP_KEY`: empty in the example, set in `.env` (length 51, the usual `base64:` form). The rest are Laravel's published local example (`APP_ENV=local`, `APP_DEBUG=true`, `APP_URL=http://localhost`, database name `homestead`).

**Security note.** A generated application key is in git history on `master`. Anyone who can read the repository can read it. This document does not repeat it. Whether it was ever used outside this clone is **Unknown / Requires Confirmation**. Rotation is a human decision.

`APP_DEBUG=true` with `APP_ENV=local` means detailed error pages if this env file is the one loaded.

Redis is configured at `127.0.0.1:6379` with password `null` and is not referenced by application code. Pusher app id, key, and secret are empty; cluster is `mt1`. `MIX_PUSHER_APP_KEY` and `MIX_PUSHER_APP_CLUSTER` alias those values. The client that would read them is commented out.

## Deployment and infrastructure

Not in git:

- Dockerfile, docker-compose, Homestead.yaml, Vagrantfile
- `bitbucket-pipelines.yml` or other CI
- `appspec.yml`, CodeDeploy scripts, Terraform, serverless config
- `sonar-project.properties`, `sonarqube_scan.bat` (named only by the onboarding scan)
- A process manager, queue worker, or scheduler cron

`server.php` documents itself as the way to emulate Apache rewrites with PHP's built-in server. `public/.htaccess` and `public/web.config` are alternatives. Which one is used in any environment is **Unknown**.

No monitoring agent, health route, or error tracker (Sentry, Bugsnag, Slack log channel) is configured beyond the file log. A `slack` log channel may exist in stock `config/logging.php`; the default channel is `stack` → `daily`. Nothing sets a Slack webhook in `.env`.

## Development and testing

Install PHP dependencies is optional for the committed tree because `vendor/` is present. Regenerating it would use `composer.lock`.

Install JS dependencies with npm using `package-lock.json`. They are not committed.

Tests, from `phpunit.xml`:

- Suites `Unit` (`tests/Unit`) and `Feature` (`tests/Feature`).
- Bootstrap `vendor/autoload.php`.
- Coverage whitelist `app/`.
- Forced env: `APP_ENV=testing`, `BCRYPT_ROUNDS=4`, `CACHE_DRIVER=array`, `MAIL_DRIVER=array`, `QUEUE_CONNECTION=sync`, `SESSION_DRIVER=array`.
- Feature example asserts `GET /` returns 200.
- Unit example asserts `true`.
- `RefreshDatabase` is imported in both example tests and is not used as a trait. The feature test does not need a database.

`CreatesApplication` is the skeleton trait. No other tests exist.

Artisan scripts in `composer.json`: `post-autoload-dump` runs package discover; `post-root-package-install` copies `.env.example` to `.env` if `.env` is missing; `post-create-project-cmd` runs `key:generate`. Those ran, or were copied already-run, before commit `7e1ef64`: `.env` exists and `APP_KEY` is set.

## Security summary

| Topic | What the tree shows |
|---|---|
| Application key in git | Set in committed `.env` |
| Debug | `APP_DEBUG=true` in that file |
| CSRF | On for web routes. No exceptions. Only web route is GET `/` |
| API auth | Token guard, plaintext comparison (`hash` false), column missing |
| Rate limit | API 60/minute. Verification controller 6/minute, unrouted. Web unlimited |
| Password rules | Min 8 and confirmed, on an unrouted controller. bcrypt |
| Mass assignment | User fillable list is explicit. Project and Task keep Eloquent's default guard |
| Policies | None |
| Captcha | None |
| Dependencies committed | `vendor/` and lockfiles are in the 2019 commit and have not been updated in git |

## Discrepancies

| Item | Documentation / scan | Repository at `7e1ef64` |
|---|---|---|
| Sonar files | Task scan listed `sonar-project.properties` and `sonarqube_scan.bat` at the root | Not in git |
| README product | "Laravel React Tut" plus an external article | Running page is the Laravel welcome screen |
| Auth | Controllers, `/home` redirects, verification listener | No auth routes, no home view, `User` is not `MustVerifyEmail` |
| React | Mix entry and compiled bundle | No page mounts the component |
| Projects and tasks | Models and migrations | No columns, relationships, or UI |
| `.gitignore` | One line, `node_modules` | `.env` and `vendor/` are tracked |

## Unknown / requires confirmation

- Whether any host still runs this application, and which env file it loads.
- Whether the committed `APP_KEY` was used for real data and must be rotated.
- Whether the Pusher article is the intended build.
- Whether `projects` and `tasks` were going to gain columns after 2019-03-29.
- Whether the Sonar files existed only on the scan machine.
- Whether `vendor/` was committed on purpose.