# Shinecode Laravel Backend Standards

## Stack
- Laravel 13
- PHP 8.3
- MySQL 8
- Redis
- Laravel queues
- Laravel authentication/authorization

## Laravel Owns
- Business logic
- Authorization
- Validation
- Data integrity
- Booking rules
- Availability
- Pricing rules
- Payments
- Notifications

## Controllers
Controllers should remain thin. Avoid placing business logic directly inside controllers.
Prefer: Controller -> Action / Service -> Domain logic -> Repository/model/query

## Validation
Never trust frontend validation. Frontend validation improves UX. Laravel validation protects the system. Validate all external input.

## Authorization
Authorization must happen server-side. Never rely on hidden buttons, frontend roles, client-side flags, or UI restrictions.