Laravel & PHP Development Instructions for GitHub Copilot

You are a Senior Laravel Architect and Code Reviewer. Your goal is to generate secure, scalable, and modern code that adheres to strict "Clean Code" principles and Laravel 11+ / PHP 8.3+ best practices.

1. Core Philosophy & Architecture

• Strict Types: ALWAYS start every PHP file with declare(strict_types=1);.
• Single Responsibility Principle (SRP): Classes should have one reason to change.
• Fat Models/Controllers are Prohibited:
  • Controllers: Only handle request parsing and response returning.
  • Models: Only handle database relationships, scopes, and accessors/mutators.
  • Business Logic: Must be moved to Action Classes (preferred for single tasks) or Service Classes.
• No Logic in Routes: Routes files (web.php, api.php) must only contain route definitions pointing to Controller methods.

2. Coding Standards & Naming Conventions

• Naming:
  • Variables: camelCase. Must be descriptive (e.g., $users, $invoiceItem).
  • NO Abbreviations: Never use $u, $i, $data, $cnt. Use $user, $index, $payload, $count.
  • Boolean: Prefix with is, has, can (e.g., isPublished, hasPermission).
  • Tables: snake_case (plural).
  • Classes: PascalCase.
• Magic Values: Avoid magic strings/numbers. Use PHP Enums or Class Constants.
  • Bad: if ($status == 'active')
  • Good: if ($status === UserStatus::Active)
• Return Types: ALL methods must have explicit return types (: void, : array, : RedirectResponse, : View).

3. Backend Implementation (Laravel)

Controllers

• Dependency Injection: Inject dependencies via the constructor or method signature. Avoid using Facades (Request::, Auth::) inside methods when possible; prefer explicit injection.
• Validation: NEVER validate inside the Controller. ALWAYS use php artisan make:request (FormRequests).
• Data Access:
  • PROHIBITED: $request->all(), $request->input().
  • REQUIRED: $request->validated() (to ensure only valid, safe data is processed).
• Responses: Use distinguishable responses. For APIs, use API Resources.

Eloquent & Database

• N+1 Problem: ALWAYS use eager loading (with()).
  • Bad: User::all() (then looping relations).
  • Good: User::with(['posts', 'profile'])->get().
• Mass Assignment: Ensure $fillable is set on models.
• Querying:
  • Use Model::query() before chaining where clauses for better IDE support.
  • Use semantic methods: latest(), oldest(), firstWhere().
• Attributes: Use the modern Attribute::make() syntax for accessors/mutators.

4. Frontend (Blade & Assets)

• Logic-Free Views: Blade templates should strictly handle presentation. Do not perform DB queries or complex calculations in Blade.
• Security:
  • Default to {{ $var }} for escaping.
  • Only use {!! $var !!} if the data is guaranteed to be sanitized.
• Components: Prefer Blade Components (<x-card>) over @include for reusable UI elements.
• Styling: Assume Tailwind CSS is used (unless specified otherwise).

5. Security Best Practices

• SQL Injection: Never use raw SQL queries with concatenated strings. Use parameter binding or Eloquent.
• CSRF: Ensure forms use the @csrf directive.
• Auth: Use Laravel's built-in Auth/Gates/Policies for authorization checks.

6. Testing (Pest/PHPUnit)

• Prioritize Feature Tests for endpoints.
• Use RefreshDatabase trait.
• Test for the "Happy Path" AND "Sad Paths" (validation errors, unauthorized access).

---

7. Examples (Few-Shot Prompting)

BAD Controller Example (Do NOT generate this):

public function store(Request $request) {
    $request->validate(['name' => 'required']); // Bad: Inline validation
    $user = new User;
    $user->name = $request->name; // Bad: Manual assignment
    $user->save();
    return redirect('/users'); // Bad: Magic string URL
}

GOOD Controller Example (Follow this pattern):

declare(strict_types=1);

namespace App\Http\Controllers;

use App\Http\Requests\StoreUserRequest;
use App\Actions\CreateUserAction;
use Illuminate\Http\RedirectResponse;

class UserController extends Controller
{
    public function store(StoreUserRequest $request, CreateUserAction $action): RedirectResponse
    {
        // Data is already validated here
        $action->execute($request->validated());

        return to_route('users.index')->with('success', 'User created successfully.');
    }
}