Mobile Backend
Spot
Laravel 8 JSON backend for Spot (MyWork/GiltchFix/Spot—the repo path is often spoken as glitchfix/Spot): voice-room social product with a large `/api` surface including Agora mic orchestration, room membership and moderation, chat, friends or follows or blocks, gifts and coins or diamonds, VIP, leaderboards, and staff operator endpoints; separate `/api/user` auth routes; `apiLocale` plus Fruitcake CORS for mobile; Pusher, Kreait Firebase PHP, and Stripe in composer; localized Blade dashboard at `{lang}/dashboard` for admins.
Problem
What was broken
Voice-first communities need server-side truth for who is on mic, who may speak, and who is banned—if those rules live only in the client, moderation and monetization collapse the first time someone ships a patched APK.
Solution
How we fixed it
Centralized Laravel controllers under the `Api` namespace expose hundreds of stateful endpoints: room lifecycle and Agora mic slots, chat history retrieval, social graph (friends, followers, blocks), virtual economy (gifts, coins, diamonds, charge levels), reporting, and parallel admin tools for suspensions and room operations. `RouteServiceProvider` mounts `routes/api.php`, `routes/user.php` under `api/user`, `routes/web.php` (minimal marketing plus Stripe wiring), and `routes/admin.php` for the localized dashboard.
Challenges
What made this hard
Mic state and room membership must stay consistent under concurrent takes and admin mutes; large route files need discipline when adding endpoints so mobile versioning does not break silently; balancing Firebase or Pusher usage with Laravel queues depends on hosting constraints not visible from routes alone.
Architecture
How the system is shaped
API Structure
`routes/api.php` is grouped with `apiLocale` and namespaces `Api\…` controllers covering user profiles, rooms, Agora mic orchestration, chat, items, VIP, events, and admin maintenance actions. `routes/user.php` isolates login, signup, confirmCode, and logout for the mobile auth flow. `routes/admin.php` serves `{lang}/dashboard` with `admin:admin` and `locale` middleware for operator CRUD on users, rooms, bans, notifications, and related resources.
Data Flow
Mobile app → HTTPS JSON → Laravel validation and authorization → Eloquent or query builder writes to MySQL (rooms, members, messages, ledgers). Agora-related endpoints persist mic ownership and mute flags the SDK expects; Pusher or Firebase can fan out side effects depending on deployment configuration.
Backend Decisions
Kept voice and moderation flows on the server even when it meant verbose route tables; used explicit operator endpoints for bans and room kicks instead of implicit client-side toggles. CORS middleware targets known app origins; Stripe remains server-initiated via web routes for payment experiments without exposing secrets to clients.
Decisions
Why this stack and shape
Laravel 8 monolith with class-style Stripe controller on web routes for payment tests; legacy route string targets remain alongside newer syntax where refactors stopped; Pusher and Kreait Firebase chosen from composer to support realtime and push without rewriting the core API.