Marketplace
Bazar
Laravel 10 classifieds marketplace from the FreeLancer/bazar_P tree (same project as bazar_p on case-insensitive systems): Blade storefront with Laravel UI authentication, deep category navigation (sub through sub4), listings and product detail pages, mazad (auction listing) browsing, and an `/admin` dashboard for countries, cities, nested taxonomies, advertisements, sliders, contacts, and notifications. Parallel mobile JSON API under `/api` split into `guest-api.php` (login, register, password reset, catalog, home search, advertisements by geography) and `auth-api.php` (token-guarded profile, favourites, balance, post or list user ads, Firebase device token) with shared `lang` and `InitRequest` middleware.
Problem
What was broken
A classifieds product has to serve both casual web visitors and mobile apps without duplicating business rules: category trees, listing quality, user balances, and staff moderation must stay consistent whether the client is Blade or JSON.
Solution
How we fixed it
`RouteServiceProvider` wires four concerns: authenticated API controllers (`routes/auth-api.php` behind `auth:api` and the `api` token guard), public API controllers (`routes/guest-api.php`), an admin namespace under prefix `admin` with `admin` middleware, and the main `routes/web.php` site plus `Auth::routes()` from Laravel UI. Controllers stay namespaced under `App\Http\Controllers\Api`, `Admin`, and `Site` so web, admin, and mobile surfaces share the same models and validation.
Challenges
What made this hard
Very deep category trees (four sub-levels) complicate admin AJAX endpoints and mobile payloads—keeping N+1 queries under control matters on listing grids. Web and API must agree on soft-deletes or visibility flags so an item hidden in admin does not still appear in cached mobile responses.
Architecture
How the system is shaped
API Structure
Guest API uses POST endpoints for home, search, hierarchical categories, and `Advertisement` queries (country, city, single ad, offers). Authenticated API posts cover profile updates, favourites, user advertisements, notifications, and Firebase token updates. CORS config includes `api/*` paths for mobile origins.
Data Flow
Listing publish or edit flows through form or API controllers into advertisement rows tied to category and geography keys; admin CRUD updates taxonomy and homepage sliders that both web and API readers consume on next request.
Backend Decisions
Chose Laravel’s built-in `token` API guard instead of bolting on Passport for this scope; centralized `InitRequest` on API groups for shared mobile headers or context; kept admin routes prefix-isolated from public URLs to reduce accidental exposure.
Decisions
Why this stack and shape
Laravel 10 baseline with `laravel/ui` for rapid auth scaffolding and `laravelcollective/html` where forms benefit from helpers; Guzzle available for outbound HTTP when integrations land; PHPUnit 10 for regression safety on critical paths.