# Backend structure

This Laravel application follows the API-only backend structure used by the
ICT360 React frontend.

```text
backend/
├── app/
│   ├── Http/
│   │   ├── Controllers/
│   │   │   └── Api/
│   │   │       └── Admin/
│   │   ├── Requests/
│   │   │   ├── Admin/
│   │   │   └── Auth/
│   │   └── Resources/
│   ├── Models/
│   ├── Services/
│   ├── Policies/
│   ├── Mail/
│   ├── Jobs/
│   ├── Notifications/
│   ├── Rules/
│   └── Providers/
├── routes/
│   ├── api.php
│   ├── web.php
│   └── console.php
├── database/
│   ├── migrations/
│   ├── seeders/
│   └── factories/
├── storage/
├── config/
└── .env
```

## Responsibilities

- API controllers translate HTTP requests into application calls and responses.
- Form requests own reusable validation and authorization rules.
- API resources define public JSON representations.
- Services contain reusable business and storage workflows.
- Models contain Eloquent configuration and relationships.
- Policies are the location for record-level authorization when roles require it.
- Jobs handle queueable work; mail classes define server-side email delivery.
- Notifications are reserved for Laravel notification channels.
- Custom upload validation rules live in `app/Rules`.

The `Api/Admin` controller namespace is protected at the route layer with
`auth:sanctum`. Public API controllers remain in `Api` without the `Admin`
namespace. Legacy compatibility controllers are retained until every existing
client has migrated to the canonical REST endpoints.