padosoft-laravel-scaffoldinglisted

Use this skill when adding something new to a Laravel application — an endpoint, a controller, a service, a CRUD backend, a queued job, a test — "make me the API for X", "add the CRUD for Y", "I need a service that does Z" — and whenever a piece added earlier is half-wired: a route that answers 404, a policy that is never called, a request class that validates nothing because the controller reads `all()`, a job that is dispatched but has no queue configured. It lists the files each piece touches, in order. Do not use it to review existing code (padosoft-laravel-conventions) or for the security review.
padosoft/skills · ★ 1 · API & Backend · score 80

Install: claude install-skill padosoft/skills

# Laravel scaffolding The code is the easy part. What gets forgotten is the **wiring**: the route, the policy, the binding, the test — each of which fails in its own quiet way. The conventions the generated code must follow are in **`padosoft-laravel-conventions`**; the checks it must survive are in **`padosoft-laravel-security-review`**. --- ## 0. Ask first, in one batch - **what**: endpoint, controller, service, CRUD, job, test; - **which domain/module** it belongs to — and whether that module exists; - **who may call it**: guest, authenticated, a role, an owner. This answer decides the policy, and it is the one most often left implicit; - **the shape of input and output**, and whether the response is shared with a frontend that already expects a shape; - **synchronous or queued**, and if queued, on which connection and queue. If the answer to "who may call it" is "the authenticated user", ask the follow-up: *any* authenticated user, or only the owner of the record? That distinction is the whole of `SEC-IDOR-001`. ## 1. Endpoint / controller — the file list | # | File | Skipping it means | |---|---|---| | 1 | The route, in the right route file and group | 404, or worse: the route exists without the group's middleware | | 2 | `FormRequest` | Validation lives in the controller, or nowhere | | 3 | DTO | An untyped array crosses every boundary | | 4 | Controller | — | | 5 | Service / action | The logic is in the controller and is not testable without HTTP | | 6 | Po