Laravel Backend Interview Preparation - Complete Guide 2025

🏗️ 26. Namespaces

Namespace = way to group related classes to avoid name collisions

Real-world analogy: Just like you organize files in folders on your computer, namespaces organize classes in your code. You can have multiple files named "photo.jpg" if they're in different folders!

Q: What happens if two classes have the same name?

Without namespaces, PHP would throw a fatal error. With namespaces, you can have:
• App\Models\User (database model)
• App\Http\Resources\User (API resource)
• Both named "User" but in different namespaces!

Q: How do you use a class from another namespace?

Three ways:
1. Full path: $user = new \App\Models\User();
2. Import with use: use App\Models\User; $user = new User();
3. Alias: use App\Models\User as UserModel;

namespace App\Http\Controllers;
            
            use App\Models\User;        // Import User model
            use Illuminate\Http\Request; // Import Request class
            
            class UserController {
                public function index() {
                    $users = User::all();   // No need for full path
                    return view('users', compact('users'));
                }
            }

PSR-4 Autoloading: Laravel follows PSR-4 standard where namespace structure matches folder structure. App\Http\Controllers\UserController lives in app/Http/Controllers/UserController.php

Use: Organize code, avoid conflicts, PSR-4 autoloading, better IDE support

💉 1. Dependency Injection (DI)

DI = passing dependencies into class instead of creating them inside

Think of it like: Instead of a chef buying ingredients during cooking, someone else brings all ingredients to the chef beforehand. The chef can focus on cooking!

Q: Why is DI better than creating dependencies inside the class?

Testability: You can easily mock dependencies in tests
Flexibility: Easy to swap implementations (dev vs production)
Loose Coupling: Classes don't depend on concrete implementations
Single Responsibility: Class focuses on its job, not creating dependencies

Q: How does Laravel's Service Container work?

Laravel automatically resolves dependencies by reading constructor type hints:
1. Sees UserService $userService in constructor
2. Creates or finds UserService instance
3. Injects it when creating the controller
4. Works recursively for nested dependencies!

// Bad: Creating dependencies inside
            class UserController {
                public function __construct() {
                    $this->userService = new UserService();  // ❌ Hard to test
                    $this->emailService = new EmailService(); // ❌ Tight coupling
                }
            }
            
            // Good: Dependencies injected
            class UserController {
                public function __construct(
                    UserService $userService,      // ✅ Laravel injects automatically
                    EmailService $emailService    // ✅ Easy to mock in tests
                ) {
                    $this->userService = $userService;
                    $this->emailService = $emailService;
                }
            }

Testing Made Easy: With DI, you can inject mock objects in tests: $mockService = Mockery::mock(UserService::class);

Use: When class depends on other services, for testability, loose coupling

2. ORM vs Raw SQL

ORM (Eloquent) = PHP objects for DB queries
Raw SQL = direct SQL queries

Real-world analogy: ORM is like ordering food in your native language from a waiter who translates to the kitchen. Raw SQL is like going directly to the kitchen and speaking the chef's language.

Q: When should you use ORM vs Raw SQL?

Use ORM when:
• Standard CRUD operations
• Working with relationships
• Rapid development needed
• Team has mixed SQL skills

Use Raw SQL when:
• Complex reporting queries
• Performance is critical
• Using database-specific features
• Bulk operations

Q: What's the N+1 problem with ORM?

When you loop through models and access relationships, ORM makes 1 query + N additional queries:
$users = User::all(); // 1 query
foreach($users as $user) { echo $user->profile->name; } // N queries
Solution: Eager loading: User::with('profile')->get();

// ORM - Easy and readable
            $users = User::where('active', 1)
                         ->where('created_at', '>', now()->subDays(30))
                         ->with('profile', 'orders')
                         ->orderBy('name')
                         ->get();
            
            // Raw SQL - More control and potentially faster
            $users = DB::select("
                SELECT u.*, p.avatar, COUNT(o.id) as order_count
                FROM users u
                LEFT JOIN profiles p ON u.id = p.user_id  
                LEFT JOIN orders o ON u.id = o.user_id
                WHERE u.active = 1 AND u.created_at > ?
                GROUP BY u.id
                ORDER BY u.name
            ", [now()->subDays(30)]);

Hybrid Approach: Use ORM for most operations, Raw SQL for complex queries. Laravel makes it easy to mix both!

3. Redis Caching

Redis = in-memory fast key-value store with advanced features

Think of Redis as: A super-fast filing cabinet that keeps everything in memory (RAM) instead of on disk. It's like having your most-used files on your desk instead of in a filing cabinet across the room.

Q: Why is Redis faster than database caching?

In-Memory: Data stored in RAM (microseconds access) vs disk (milliseconds)
Simple Operations: Key-value lookups vs complex SQL queries
No Disk I/O: No reading from/writing to disk
Optimized: Built specifically for caching and speed

Q: What data structures does Redis support?

Strings: Simple key-value pairs
Lists: Ordered collections (queues, recent items)
Sets: Unique values (tags, categories)
Hashes: Field-value pairs (user profiles)
Sorted Sets: Ordered by score (leaderboards)
Streams: Event logs and messaging

Q: When should you use Redis vs other caching?

Use Redis when:
• High-traffic applications
• Real-time features (chat, live updates)
• Session management across multiple servers
• Queue processing
• Complex caching scenarios

Use File/DB cache when:
• Simple applications
• Limited server resources
• Single server setup

// Basic Redis operations in Laravel
            Cache::put('user:1', $user, 3600); // Store for 1 hour
            $user = Cache::get('user:1');       // Retrieve
            
            // Advanced: Using Redis directly
            Redis::set('views:page:1', 100);
            Redis::incr('views:page:1');        // Atomic increment
            $views = Redis::get('views:page:1');
            
            // Lists for queues
            Redis::lpush('queue:emails', json_encode($emailData));
            $job = Redis::rpop('queue:emails');
            
            // Sets for unique tracking
            Redis::sadd('online:users', $userId);
            $onlineUsers = Redis::smembers('online:users');
            
            // Hashes for complex objects
            Redis::hmset('user:1', [
                'name' => 'John',
                'email' => 'john@example.com',
                'last_seen' => now()
            ]);
            
            // Expiration
            Redis::expire('temp:data', 300); // Expire in 5 minutes

Laravel Configuration: Set CACHE_DRIVER=redis and SESSION_DRIVER=redis in .env for optimal performance!

Use: Session storage, queues, real-time data, high-traffic caching, leaderboards

4. JWT vs Passport vs OAuth

JWT = lightweight, stateless tokens
Passport = Laravel's full OAuth2 server implementation
OAuth = authorization protocol for 3rd-party access

Simple analogy: JWT is like a driver's license (self-contained ID), Passport is like a bank's ID system (full authentication server), OAuth is like using your Google account to sign into other apps.

Q: How does JWT authentication work?

1. Login: User sends credentials, server creates JWT with user data
2. Storage: Client stores JWT (localStorage, cookie)
3. Requests: Client sends JWT in Authorization header
4. Verification: Server verifies signature without database lookup
Structure: header.payload.signature (Base64 encoded)

Q: When should you choose each authentication method?

Choose JWT when:
• Building simple APIs or SPAs
• Need stateless authentication
• Microservices architecture
• Mobile app authentication

Choose Passport when:
• Need OAuth2 server functionality
• Multiple client applications
• Need refresh tokens and scopes
• Want built-in token management

Choose OAuth when:
• Social media login (Google, Facebook)
• Third-party API integration
• Don't want to handle passwords

Q: What are the security considerations?

JWT Security:
• Store securely (httpOnly cookies, not localStorage)
• Use short expiration times
• Can't revoke until expiry
• Payload is readable (don't store sensitive data)

Passport Security:
• Tokens stored in database (can revoke)
• Supports refresh tokens
• Built-in rate limiting
• Scopes for permission control

// JWT with tymon/jwt-auth
            // Login
            public function login(Request $request) {
                $credentials = $request->only('email', 'password');
                
                if (!$token = JWTAuth::attempt($credentials)) {
                    return response()->json(['error' => 'Unauthorized'], 401);
                }
                
                return response()->json(['token' => $token]);
            }
            
            // Protected route
            public function getUser() {
                return response()->json(JWTAuth::parseToken()->authenticate());
            }
            
            // Laravel Passport
            // Install: php artisan passport:install
            Route::middleware('auth:api')->get('/user', function (Request $request) {
                return $request->user();
            });
            
            // OAuth client credentials
            $client = Http::withHeaders([
                'Authorization' => 'Bearer ' . $accessToken,
            ])->get('https://api.github.com/user');
            
            // Passport scopes
            Route::get('/orders', function () {
                // Access token has both "check-status" and "place-orders" scopes
            })->middleware(['auth:api', 'scope:check-status,place-orders']);

Laravel Sanctum: Consider Laravel Sanctum for simple token authentication - it's lighter than Passport but more secure than basic JWT implementations!

Use: API authentication, SPA auth, mobile apps, third-party integrations

🔍 5. EXPLAIN Command

EXPLAIN = SQL command to analyze query execution plan and performance

Think of EXPLAIN as: A GPS route planner for your SQL queries. It shows you exactly which path your database will take to get your data, helping you spot traffic jams (slow operations) before they happen.

Q: What information does EXPLAIN show you?

Query Execution Plan: The step-by-step path the database takes
Index Usage: Which indexes are being used (or not used)
Join Methods: How tables are being joined together
Row Estimates: How many rows will be examined
Cost Analysis: Relative expense of different operations
Scan Types: Full table scan vs index scan vs unique scan

Q: How do you use EXPLAIN in Laravel?

Raw SQL: DB::select('EXPLAIN SELECT * FROM users WHERE email = ?', ['john@example.com'])
Query Builder: DB::table('users')->where('email', 'john@example.com')->explain()
Eloquent: User::where('email', 'john@example.com')->explain()
Advanced: EXPLAIN ANALYZE for actual execution statistics

Q: What should you look for in EXPLAIN output?

⚠️ Red Flags:
• Full Table Scan: Examining every row in a large table
• High Row Count: Millions of rows being examined
• No Index Usage: Missing or unused indexes
• Cartesian Products: Unintended cross joins

✅ Good Signs:
• Index seeks instead of scans
• Low row counts
• Efficient join algorithms
• Constant time lookups

// Laravel EXPLAIN examples
            // Basic EXPLAIN
            $explain = DB::table('users')
                ->where('email', 'john@example.com')
                ->explain();
            dd($explain);
            
            // EXPLAIN with Eloquent relationship
            $explain = User::with('posts')
                ->where('active', 1)
                ->explain();
            
            // Raw EXPLAIN for complex queries
            $results = DB::select("
                EXPLAIN ANALYZE 
                SELECT u.name, COUNT(p.id) as post_count
                FROM users u
                LEFT JOIN posts p ON u.id = p.user_id
                WHERE u.created_at > '2023-01-01'
                GROUP BY u.id
                HAVING post_count > 5
            ");
            
            // MySQL specific - EXPLAIN FORMAT=JSON
            $json_explain = DB::select("
                EXPLAIN FORMAT=JSON
                SELECT * FROM users 
                WHERE email = 'john@example.com'
            ");
            
            // Performance monitoring in Laravel
            if (config('app.debug')) {
                DB::listen(function ($query) {
                    if ($query->time > 1000) { // Queries taking > 1 second
                        Log::warning('Slow query detected', [
                            'sql' => $query->sql,
                            'bindings' => $query->bindings,
                            'time' => $query->time
                        ]);
                    }
                });
            }

Pro Debugging: Use Laravel Debugbar or Telescope to automatically see EXPLAIN output for all your queries during development!

Use: Query optimization, index tuning, performance debugging, finding bottlenecks

🔥 6. N+1 Problem

N+1 = loading relations in loop causes many queries

The problem: If you have 100 users, you'll make 101 queries (1 for users + 100 for each user's profile). This kills performance!

Q: How do you identify N+1 problems?

Tools to detect:
• Laravel Debugbar - shows all queries
• Telescope - Laravel's debugging assistant
• DB::enableQueryLog() - log all queries
• Look for loops accessing relationships without eager loading

Q: What are different solutions for N+1?

1. Eager Loading: User::with('profile')->get()
2. Lazy Eager Loading: $users->load('profile')
3. Constraining Eager Loads: User::with(['posts' => fn($q) => $q->published()])
4. Prevent Lazy Loading: Model::preventLazyLoading() in AppServiceProvider

// ❌ N+1 Problem - Makes 1 + N queries
            $users = User::all();                    // 1 query
            foreach($users as $user) {
                echo $user->profile->name;           // N queries (one per user)
                echo $user->posts->count();          // N more queries!
            }
            
            // ✅ Solution 1: Eager Loading - Makes only 3 queries
            $users = User::with(['profile', 'posts'])->get(); // 3 queries total
            foreach($users as $user) {
                echo $user->profile->name;           // No additional query
                echo $user->posts->count();          // No additional query
            }
            
            // ✅ Solution 2: Lazy Eager Loading - Load after fetching
            $users = User::all();
            $users->load(['profile', 'posts']);     // Loads relationships for all users
            
            // ✅ Solution 3: Constrained Eager Loading
            $users = User::with([
                'posts' => function($query) {
                    $query->where('published', true)->latest()->take(5);
                }
            ])->get();

Prevention: Add Model::preventLazyLoading(!app()->isProduction()) in AppServiceProvider to catch N+1 issues during development!

Use: Whenever loading models with relationships, always consider eager loading

🎨 8. Design Patterns in Laravel

Design Patterns = proven solutions to common programming problems

Think of design patterns as: Architectural blueprints for code. Just like architects use proven building designs, developers use proven code structures to solve recurring problems efficiently and elegantly.

Q: What are the main design patterns used in Laravel?

🔄 Singleton: One instance only (Config, Cache)
🏭 Factory: Create objects (Model Factories, View Factory)
👀 Observer: React to events (Model Events, Listeners)
📦 Repository: Data access abstraction layer
🎭 Facade: Simple interface to complex subsystems
🛡️ Strategy: Swap algorithms (Auth Guards, Cache Drivers)
🎯 Decorator: Add behavior (Middleware)
📋 Command: Encapsulate requests (Artisan Commands)
🔗 Chain of Responsibility: Middleware pipeline

Q: When would you use the Repository pattern?

Use Repository when:
• You want to separate business logic from data access
• You need to swap data sources (MySQL → MongoDB)
• You want to write testable code with mock data
• You're working with complex queries
• You follow Domain-Driven Design (DDD)

Benefits: Testability, maintainability, separation of concerns

Q: How does the Observer pattern work in Laravel?

Model Events: Automatically trigger when model actions occur
Event Listeners: Classes that respond to specific events
Use Cases: Send emails, update caches, log activities, sync data
Benefits: Decoupled code, automatic triggers, clean separation

// Repository Pattern Example
            interface UserRepositoryInterface {
                public function find($id);
                public function create(array $data);
                public function getActiveUsers();
            }
            
            class EloquentUserRepository implements UserRepositoryInterface {
                public function find($id) {
                    return User::find($id);
                }
                
                public function create(array $data) {
                    return User::create($data);
                }
                
                public function getActiveUsers() {
                    return User::where('active', true)->get();
                }
            }
            
            // Bind in ServiceProvider
            $this->app->bind(UserRepositoryInterface::class, EloquentUserRepository::class);
            
            // Observer Pattern - Model Events
            class User extends Model {
                protected static function boot() {
                    parent::boot();
                    
                    static::creating(function ($user) {
                        $user->uuid = Str::uuid();
                    });
                    
                    static::created(function ($user) {
                        event(new UserRegistered($user));
                    });
                }
            }
            
            // Factory Pattern - Model Factory
            class UserFactory extends Factory {
                public function definition() {
                    return [
                        'name' => $this->faker->name(),
                        'email' => $this->faker->unique()->safeEmail(),
                        'password' => Hash::make('password'),
                    ];
                }
                
                public function admin() {
                    return $this->state(['role' => 'admin']);
                }
            }
            
            // Strategy Pattern - Cache Drivers
            // Laravel swaps cache implementations based on config
            Cache::put('key', 'value', 60); // Could use Redis, File, Database, etc.
            
            // Facade Pattern - Simple interface
            Cache::get('key');           // Instead of app('cache')->get('key')
            Mail::send($view, $data);    // Instead of app('mailer')->send($view, $data)

Interview Tip: Don't just memorize pattern names - understand the PROBLEMS they solve and give real Laravel examples where you've used them!

Use: Clean architecture, testable code, maintainability, separation of concerns

9. Traits vs Facades

Traits = PHP mechanism to share code between classes, Facades = Laravel's static interface to services

Simple analogy: Traits are like copy-pasting useful methods into multiple classes. Facades are like having a remote control for your services - simple buttons that do complex things behind the scenes.

Q: When should you use Traits vs Facades?

Use Traits when:
• You want to share methods between multiple classes
• You need to add behavior to models (like soft deletes)
• You want to avoid inheritance issues
• You're building reusable functionality

Use Facades when:
• You want clean, expressive syntax
• You're accessing Laravel services
• You need static-like interface
• You want IDE autocompletion

Q: How do Facades work internally?

1. Static call: Cache::get('key')
2. __callStatic magic method: Intercepts the call
3. Service resolution: Resolves 'cache' from container
4. Method forwarding: Calls get() on actual cache instance
Benefits: Clean syntax + dependency injection + testability

Q: What are the pros and cons of each?

Traits Pros: Code reuse, multiple inheritance, explicit
Traits Cons: Can cause naming conflicts, harder to test

Facade Pros: Clean syntax, testable, IDE support
Facade Cons: Hides dependencies, Laravel-specific

// Traits Example
            trait Timestamps {
                public function touch() {
                    $this->updated_at = now();
                    $this->save();
                }
                
                public function formatDate($field) {
                    return $this->$field->format('Y-m-d H:i:s');
                }
            }
            
            class User extends Model {
                use Timestamps; // Now has touch() and formatDate() methods
            }
            
            class Post extends Model {
                use Timestamps; // Same methods available here too
            }
            
            // Using the trait
            $user = User::find(1);
            $user->touch(); // Updates updated_at
            echo $user->formatDate('created_at');
            
            // Facades Example - Static-like syntax
            Cache::put('users', $users, 3600);
            $users = Cache::get('users');
            Mail::to($user)->send(new WelcomeMail());
            DB::table('users')->where('active', 1)->count();
            
            // Behind the scenes, this is happening:
            app('cache')->put('users', $users, 3600);
            app('cache')->get('users');
            app('mailer')->to($user)->send(new WelcomeMail());
            
            // Creating custom Facade
            class CustomCache extends Facade {
                protected static function getFacadeAccessor() {
                    return 'custom-cache'; // Service container binding
                }
            }
            
            // Usage
            CustomCache::store('data', $value);
            
            // Trait with multiple inheritance issues
            trait A { public function test() { return 'A'; } }
            trait B { public function test() { return 'B'; } }
            
            class MyClass {
                use A, B {
                    B::test insteadof A; // Resolve conflict
                    A::test as testA;    // Alias the other
                }
            }

Testing Tip: Use Cache::shouldReceive('get') to mock Facade calls in tests, or inject real dependencies for more explicit testing!

Use: Code reuse (Traits), clean service access (Facades), API design, testing

⏳ 10. Queuing System

Queues = run slow tasks asynchronously in background workers

Think of queues as: A restaurant kitchen where orders (jobs) are placed on a ticket rail (queue) and cooks (workers) process them one by one. Customers don't wait in the kitchen - they get a receipt and their food comes when ready.

Q: How does Laravel's queue system work?

1. Dispatch Job: Add job to queue using dispatch(new ProcessOrder($order))
2. Queue Storage: Job stored in database, Redis, SQS, or other drivers
3. Queue Worker: php artisan queue:work continuously processes jobs
4. Job Execution: Worker picks up job and runs the handle() method
5. Completion: Job marked as completed or failed

Q: What are the different queue drivers and when to use each?

Database: Good for development, simple setup, but not scalable
Redis: Fast, feature-rich, supports job priorities and delays
Amazon SQS: Managed service, highly scalable, good for AWS infrastructure
Sync: Runs jobs immediately (for testing/development)
Beanstalkd: Lightweight, good performance, less popular

Recommendation: Redis for most applications, SQS for AWS deployments

Q: How do you handle job failures and retries?

Automatic Retries: Set $tries property on job class
Retry Delay: Use retryAfter() method for backoff strategy
Failed Jobs Table: php artisan queue:failed-table to track failures
Failed Job Handler: Implement failed() method for cleanup
Manual Retry: php artisan queue:retry all or specific job ID

Q: What's the difference between Jobs, Queues, and Workers?

Job: A class that defines work to be done (SendEmail, ProcessPayment)
Queue: A storage mechanism that holds jobs waiting to be processed
Worker: A long-running process that picks up and executes jobs
Queue Name: Logical separation of jobs (emails, reports, critical)
Connection: The queue driver/service being used (Redis, database, SQS)

// Creating a Job
            php artisan make:job ProcessOrderPayment
            
            // app/Jobs/ProcessOrderPayment.php
            class ProcessOrderPayment implements ShouldQueue {
                use Dispatchable, InteractsWithQueue, Queueable, SerializesModels;
                
                public $tries = 3;           // Retry 3 times on failure
                public $backoff = [10, 30, 60]; // Wait 10s, then 30s, then 60s
                public $timeout = 120;       // Job timeout after 2 minutes
                
                public function __construct(
                    public Order $order,
                    public PaymentMethod $paymentMethod
                ) {}
                
                public function handle(PaymentService $paymentService) {
                    try {
                        $result = $paymentService->charge(
                            $this->order->total,
                            $this->paymentMethod
                        );
                        
                        $this->order->update(['status' => 'paid', 'payment_id' => $result->id]);
                        
                        // Dispatch follow-up jobs
                        dispatch(new SendOrderConfirmation($this->order));
                        dispatch(new UpdateInventory($this->order));
                        
                    } catch (PaymentException $e) {
                        // This will trigger a retry
                        throw $e;
                    }
                }
                
                public function failed(\Throwable $exception) {
                    // Cleanup on permanent failure
                    $this->order->update(['status' => 'payment_failed']);
                    
                    // Notify admin
                    dispatch(new NotifyAdminPaymentFailure($this->order, $exception));
                }
            }
            
            // Dispatching Jobs
            // Immediate dispatch
            ProcessOrderPayment::dispatch($order, $paymentMethod);
            
            // Delayed dispatch
            ProcessOrderPayment::dispatch($order, $paymentMethod)
                ->delay(now()->addMinutes(5));
            
            // Specific queue
            ProcessOrderPayment::dispatch($order, $paymentMethod)
                ->onQueue('payments');
            
            // Chain jobs (one after another)
            Bus::chain([
                new ProcessOrderPayment($order, $paymentMethod),
                new SendOrderConfirmation($order),
                new UpdateInventory($order),
            ])->dispatch();
            
            // Batch jobs (run in parallel, track completion)
            Bus::batch([
                new ProcessPayment($order1),
                new ProcessPayment($order2),
                new ProcessPayment($order3),
            ])->then(function (Batch $batch) {
                // All jobs completed successfully
                dispatch(new GenerateDailyReport());
            })->catch(function (Batch $batch, \Throwable $e) {
                // First batch job failure
            })->finally(function (Batch $batch) {
                // Always executed
            })->dispatch();
            
            // Queue Workers
            php artisan queue:work                    // Process default queue
            php artisan queue:work --queue=critical,emails  // Specific queues
            php artisan queue:work --tries=3          // Override retry attempts
            php artisan queue:work --timeout=300      // Job timeout
            php artisan queue:work --memory=512       // Memory limit
            
            // Monitoring Commands
            php artisan queue:monitor redis:default,redis:emails --max=100
            php artisan queue:failed                  // List failed jobs
            php artisan queue:retry all              // Retry all failed jobs
            php artisan queue:flush                  // Delete all failed jobs
            
            // Supervisor Configuration (Production)
            [program:laravel-worker]
            process_name=%(program_name)s_%(process_num)02d
            command=php /path/to/artisan queue:work redis --sleep=3 --tries=3 --max-time=3600
            autostart=true
            autorestart=true
            stopasgroup=true
            killasgroup=true
            user=www-data
            numprocs=8
            redirect_stderr=true
            stdout_logfile=/path/to/worker.log
            stopwaitsecs=3600

Production Best Practice: Use Supervisor or systemd to manage queue workers in production. Always monitor queue size and processing times with tools like Laravel Horizon!

Use: Email sending, file processing, API calls, image resizing, report generation, payment processing

11. Middleware

Middleware = filters that run before and after HTTP requests

Think of middleware as: Security guards at different checkpoints. Each guard checks specific things (ID, bag scan, metal detector) before letting you into the building. If any check fails, you're stopped before reaching your destination.

Q: What types of middleware does Laravel provide?

Built-in Middleware:
• auth - Check if user is authenticated
• guest - Ensure user is NOT authenticated
• throttle - Rate limiting
• verified - Email verification required
• can - Authorization policies
• csrf - CSRF token validation
• cors - Cross-Origin Resource Sharing

Q: How do you create custom middleware?

1. Generate: php artisan make:middleware CheckAge
2. Implement: Add logic in handle() method
3. Register: Add to app/Http/Kernel.php
4. Use: Apply to routes or route groups

Before vs After: Run logic before request hits controller or after response is generated

Q: What's the difference between global, route, and group middleware?

Global Middleware: Runs on every request (like CORS)
Route Middleware: Applied to specific routes
Group Middleware: Applied to route groups (like admin routes)
Controller Middleware: Applied in controller constructor

// Creating custom middleware
            php artisan make:middleware CheckAge
            
            // app/Http/Middleware/CheckAge.php
            public function handle($request, Closure $next) {
                if ($request->age <= 200) {
                    return redirect('home');
                }
                
                return $next($request); // Continue to next middleware/controller
            }
            
            // Register in app/Http/Kernel.php
            protected $routeMiddleware = [
                'age' => \App\Http\Middleware\CheckAge::class,
            ];
            
            // Using middleware
            Route::get('admin/profile', function () {
                //
            })->middleware('age');
            
            // Multiple middleware
            Route::get('admin/users', function () {
                //
            })->middleware(['auth', 'verified', 'age']);
            
            // Middleware with parameters
            Route::get('admin/settings', function () {
                //
            })->middleware('throttle:60,1'); // 60 requests per minute
            
            // Group middleware
            Route::middleware(['auth', 'verified'])->group(function () {
                Route::get('/dashboard', function () {
                    //
                });
                Route::get('/profile', function () {
                    //
                });
            });
            
            // Controller middleware
            class UserController extends Controller {
                public function __construct() {
                    $this->middleware('auth');
                    $this->middleware('verified')->except('show');
                }
            }
            
            // Middleware that runs after response
            public function handle($request, Closure $next) {
                $response = $next($request);
                
                // Log response time after request is processed
                Log::info('Response time: ' . (microtime(true) - LARAVEL_START));
                
                return $response;
            }

Performance Tip: Middleware order matters! Put expensive middleware (like auth) after cheaper ones (like CORS) to fail fast and save resources.

Use: Authentication, authorization, rate limiting, logging, CORS, input validation

🔄 12. Request Lifecycle

Request Lifecycle = complete journey from HTTP request to response

Think of it as: A package delivery system where your request goes through multiple checkpoints (entry point, security, routing, processing, packaging) before reaching its final destination and returning with a response.

Q: What are the detailed steps in Laravel's request lifecycle?

1. Entry Point: All requests hit public/index.php
2. Autoloader: Composer autoloader loads all classes
3. Application Bootstrap: Creates Laravel application instance
4. HTTP Kernel: app/Http/Kernel.php handles the request
5. Service Providers: Register and boot application services
6. Global Middleware: Run middleware that applies to all routes
7. Route Matching: Find matching route for the request
8. Route Middleware: Execute route-specific middleware
9. Controller/Closure: Execute the route handler
10. Response: Generate and send HTTP response

Q: How do Service Providers work in the lifecycle?

Registration Phase: All providers' register() methods called
Booting Phase: All providers' boot() methods called
Deferred Providers: Only loaded when their services are needed
Order Matters: Providers in config/app.php array order

Key Providers: EventServiceProvider, RouteServiceProvider, AuthServiceProvider

Q: What happens during the HTTP Kernel processing?

Request Creation: Symfony Request object created from globals
Middleware Pipeline: Request passes through middleware stack
Route Dispatching: Router finds and executes matching route
Response Generation: Controller returns response object
Middleware Response: Response passes back through middleware
Terminate: Cleanup operations after response sent

Q: How does Route Resolution work?

Route Collection: All routes loaded into RouteCollection
Method Matching: Filter routes by HTTP method (GET, POST, etc.)
URI Matching: Match request URI against route patterns
Parameter Binding: Extract route parameters and model binding
Controller Resolution: Instantiate controller with dependencies
Method Injection: Inject dependencies into controller method

// public/index.php - Entry Point
            require_once __DIR__.'/../vendor/autoload.php';
            
            $app = require_once __DIR__.'/../bootstrap/app.php';
            $kernel = $app->make(Illuminate\Contracts\Http\Kernel::class);
            
            $response = $kernel->handle(
                $request = Illuminate\Http\Request::capture()
            );
            
            $response->send();
            $kernel->terminate($request, $response);
            
            // app/Http/Kernel.php - HTTP Kernel
            class Kernel extends HttpKernel {
                // Global middleware - runs on EVERY request
                protected $middleware = [
                    \App\Http\Middleware\TrustProxies::class,
                    \Fruitcake\Cors\HandleCors::class,
                    \App\Http\Middleware\PreventRequestsDuringMaintenance::class,
                    \Illuminate\Foundation\Http\Middleware\ValidatePostSize::class,
                    \App\Http\Middleware\TrimStrings::class,
                    \Illuminate\Foundation\Http\Middleware\ConvertEmptyStringsToNull::class,
                ];
                
                // Route middleware groups
                protected $middlewareGroups = [
                    'web' => [
                        \App\Http\Middleware\EncryptCookies::class,
                        \Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse::class,
                        \Illuminate\Session\Middleware\StartSession::class,
                        \Illuminate\View\Middleware\ShareErrorsFromSession::class,
                        \App\Http\Middleware\VerifyCsrfToken::class,
                        \Illuminate\Routing\Middleware\SubstituteBindings::class,
                    ],
                    'api' => [
                        'throttle:api',
                        \Illuminate\Routing\Middleware\SubstituteBindings::class,
                    ],
                ];
            }
            
            // Service Provider Example
            class CustomServiceProvider extends ServiceProvider {
                // Called during registration phase
                public function register() {
                    $this->app->singleton(PaymentService::class, function ($app) {
                        return new PaymentService($app['config']['payment.key']);
                    });
                }
                
                // Called after all providers registered
                public function boot() {
                    // Database is available here
                    if ($this->app->environment('production')) {
                        URL::forceScheme('https');
                    }
                    
                    // Custom validation rules
                    Validator::extend('phone', function ($attribute, $value, $parameters, $validator) {
                        return preg_match('/^[\+]?[1-9][\d]{0,15}$/', $value);
                    });
                }
            }
            
            // Middleware Pipeline Example
            class CheckAge {
                public function handle($request, Closure $next) {
                    // Before: Runs before the controller
                    if ($request->age <= 18) {
                        return redirect('home');
                    }
                    
                    $response = $next($request); // Pass to next middleware/controller
                    
                    // After: Runs after the controller
                    $response->headers->set('X-Age-Verified', 'true');
                    
                    return $response;
                }
                
                public function terminate($request, $response) {
                    // Cleanup after response sent to browser
                    Log::info('Request completed', [
                        'url' => $request->url(),
                        'time' => microtime(true) - LARAVEL_START
                    ]);
                }
            }
            
            // Route Model Binding
            Route::get('/users/{user}', function (User $user) {
                // Laravel automatically finds User::find($id)
                return $user;
            });
            
            // Custom Route Model Binding
            public function boot() {
                Route::bind('user', function ($value) {
                    return User::where('slug', $value)->firstOrFail();
                });
            }
            
            // Controller with Dependency Injection
            class UserController extends Controller {
                public function __construct(
                    private UserService $userService,
                    private LoggerInterface $logger
                ) {}
                
                public function show(User $user, Request $request) {
                    // $user automatically injected via route model binding
                    // $request injected via method injection
                    
                    $this->logger->info('User profile viewed', ['user_id' => $user->id]);
                    
                    return view('users.show', compact('user'));
                }
            }

Performance Tip: Use php artisan route:cache and php artisan config:cache in production to speed up the bootstrap process!

Use: Understanding for debugging, performance optimization, middleware development, custom providers

13. Sanctum vs Passport

Sanctum = simple token auth
Passport = full OAuth2 server

Sanctum for SPA/mobile apps, Passport for complex API authentication

🎯 15. Events & Listeners

Events = things that happen in your app, Listeners = reactions to those events

Real-world analogy: Events are like a school bell ringing (something happens), and Listeners are like students and teachers who react to that bell - some go to class, some head to lunch, some start packing up. Each responds differently to the same event.

Q: Why use Events and Listeners instead of direct method calls?

🔗 Decoupling: Your main code doesn't need to know about all the side effects
📈 Scalability: Easy to add new listeners without changing existing code
🧪 Testability: Test each listener independently
⚡ Performance: Can queue listeners for background processing
🔄 Reusability: Same event can trigger multiple listeners
🛠️ Maintainability: Each listener has a single responsibility

Q: What's the difference between Events and Model Events?

Custom Events: You create and fire manually for business logic
Model Events: Automatically fired by Eloquent (created, updated, deleted)
Examples:
• Custom: OrderPlaced, PaymentProcessed, UserBanned
• Model: User created, Post updated, Comment deleted

Q: How do you create and register Events and Listeners?

1. Create Event: php artisan make:event UserRegistered
2. Create Listener: php artisan make:listener SendWelcomeEmail --event=UserRegistered
3. Register in EventServiceProvider: Map events to listeners
4. Fire Event: event(new UserRegistered($user))
5. Auto-discovery: Laravel can auto-discover listeners

// 1. Create Event
            php artisan make:event UserRegistered
            
            // app/Events/UserRegistered.php
            class UserRegistered {
                public $user;
                
                public function __construct(User $user) {
                    $this->user = $user;
                }
            }
            
            // 2. Create Listeners
            php artisan make:listener SendWelcomeEmail --event=UserRegistered
            php artisan make:listener CreateUserProfile --event=UserRegistered
            php artisan make:listener SendAdminNotification --event=UserRegistered
            
            // app/Listeners/SendWelcomeEmail.php
            class SendWelcomeEmail {
                public function handle(UserRegistered $event) {
                    Mail::to($event->user->email)->send(new WelcomeMail($event->user));
                }
            }
            
            // 3. Register in EventServiceProvider
            protected $listen = [
                UserRegistered::class => [
                    SendWelcomeEmail::class,
                    CreateUserProfile::class,
                    SendAdminNotification::class,
                ],
            ];
            
            // 4. Fire the event
            class AuthController extends Controller {
                public function register(Request $request) {
                    $user = User::create($request->validated());
                    
                    // This triggers ALL the listeners above
                    event(new UserRegistered($user));
                    
                    return redirect()->home();
                }
            }
            
            // Queued Listeners (background processing)
            class SendWelcomeEmail implements ShouldQueue {
                public function handle(UserRegistered $event) {
                    // This runs in the background via queue
                    Mail::to($event->user->email)->send(new WelcomeMail($event->user));
                }
            }
            
            // Model Events (automatic)
            class User extends Model {
                protected static function boot() {
                    parent::boot();
                    
                    static::created(function ($user) {
                        event(new UserRegistered($user));
                    });
                    
                    static::deleting(function ($user) {
                        event(new UserDeleting($user));
                    });
                }
            }
            
            // Event Broadcasting (real-time)
            class OrderShipped implements ShouldBroadcast {
                public $order;
                
                public function broadcastOn() {
                    return new PrivateChannel('orders.' . $this->order->user_id);
                }
            }

Performance Tip: Use ShouldQueue interface on listeners to process them in the background for better user experience!

Use: User registration flows, order processing, notifications, logging, cache invalidation

17. Mass Assignment Protection

Mass Assignment = bulk filling model attributes

Protected by $fillable or $guarded to prevent security issues

class User extends Model {
                protected $fillable = ['name', 'email'];
                // or
                protected $guarded = ['id', 'password'];
            }

18. Policies and Gates

Gates = closures for authorization
Policies = classes for model permissions

Control who can do what: "Can this user edit this post?"

19. Performance Optimization

Cache config/routes/views
Eager load relationships
Queue slow jobs
Optimize queries
Use Redis

These techniques can dramatically improve application speed

20. Migrations

Migrations = version control for DB schema

Track database changes, rollback if needed, share schema with team

php artisan make:migration create_users_table
            php artisan migrate
            php artisan migrate:rollback

21. Jobs vs Queues

Jobs = define tasks to run
Queues = hold jobs to run asynchronously

Jobs are the work, queues are the waiting line

22. Bind vs Singleton

bind() = new instance each time
singleton() = same instance always

Service Container resolution: fresh vs shared instances

23. CSRF Protection

CSRF = Cross-Site Request Forgery

Laravel uses tokens in forms to prevent malicious requests

<form>
                @csrf
                <!-- form fields -->
            </form>

25. Eloquent Relationships

hasMany = One-to-many (User has many Posts)
belongsTo = Inverse relation (Post belongs to User)
belongsToMany = Many-to-many with pivot table

Define how models relate to each other in the database

🏗️ 26. SOLID Principles

SOLID = five design principles for maintainable and scalable code

Think of SOLID as: Building a house with good architectural principles. Each principle ensures your code structure remains stable, flexible, and easy to modify without collapsing the entire system.

Q: What does each SOLID principle mean in Laravel context?

S - Single Responsibility: One class, one job (UserController only handles user HTTP requests)
O - Open/Closed: Open for extension, closed for modification (use interfaces, inheritance)
L - Liskov Substitution: Subclasses should replace parent classes seamlessly
I - Interface Segregation: Many small interfaces better than one large interface
D - Dependency Inversion: Depend on abstractions, not concrete classes

Q: How do you apply Single Responsibility Principle in Laravel?

❌ Violation: Controller that handles HTTP, validation, business logic, and database operations
✅ Good: Separate concerns into Controller (HTTP), FormRequest (validation), Service (business logic), Repository (data access)

Benefits: Easier testing, better maintainability, clearer code organization

Q: How does Dependency Inversion work with Laravel's Service Container?

Principle: Depend on interfaces/abstractions, not concrete implementations
Laravel Implementation: Inject interfaces in constructors, bind implementations in service providers
Benefits: Easy to swap implementations, better testing with mocks, loose coupling
Example: Inject PaymentGatewayInterface instead of StripePaymentGateway

// ❌ SOLID Violations - Fat Controller
            class UserController extends Controller {
                public function store(Request $request) {
                    // Validation in controller (should be in FormRequest)
                    $rules = ['email' => 'required|email|unique:users'];
                    $this->validate($request, $rules);
                    
                    // Business logic in controller (should be in Service)
                    $user = new User();
                    $user->email = $request->email;
                    $user->password = Hash::make($request->password);
                    $user->email_verification_token = Str::random(60);
                    $user->save();
                    
                    // Email sending in controller (should be queued job)
                    Mail::to($user)->send(new WelcomeEmail($user));
                    
                    // Multiple responsibilities in one method!
                    return response()->json(['message' => 'User created']);
                }
            }
            
            // ✅ SOLID Compliant - Single Responsibility
            // 1. FormRequest handles validation
            class CreateUserRequest extends FormRequest {
                public function rules(): array {
                    return [
                        'email' => 'required|email|unique:users',
                        'password' => 'required|min:8|confirmed',
                    ];
                }
            }
            
            // 2. Service handles business logic
            class UserService {
                public function __construct(
                    private UserRepositoryInterface $userRepository,
                    private EmailServiceInterface $emailService
                ) {}
                
                public function createUser(array $userData): User {
                    $user = $this->userRepository->create([
                        'email' => $userData['email'],
                        'password' => Hash::make($userData['password']),
                        'email_verification_token' => Str::random(60),
                    ]);
                    
                    $this->emailService->sendWelcomeEmail($user);
                    
                    return $user;
                }
            }
            
            // 3. Controller only handles HTTP
            class UserController extends Controller {
                public function __construct(private UserService $userService) {}
                
                public function store(CreateUserRequest $request): JsonResponse {
                    $user = $this->userService->createUser($request->validated());
                    
                    return response()->json([
                        'message' => 'User created successfully',
                        'user' => new UserResource($user)
                    ], 201);
                }
            }
            
            // ✅ Open/Closed Principle - Extensible without modification
            interface PaymentGatewayInterface {
                public function charge(float $amount, string $paymentMethod): PaymentResult;
            }
            
            class StripePaymentGateway implements PaymentGatewayInterface {
                public function charge(float $amount, string $paymentMethod): PaymentResult {
                    // Stripe-specific implementation
                    return new PaymentResult($stripeResponse);
                }
            }
            
            class PayPalPaymentGateway implements PaymentGatewayInterface {
                public function charge(float $amount, string $paymentMethod): PaymentResult {
                    // PayPal-specific implementation
                    return new PaymentResult($paypalResponse);
                }
            }
            
            // PaymentService is closed for modification but open for extension
            class PaymentService {
                public function __construct(
                    private PaymentGatewayInterface $gateway
                ) {}
                
                public function processPayment(Order $order): PaymentResult {
                    return $this->gateway->charge(
                        $order->total,
                        $order->payment_method
                    );
                }
            }
            
            // ✅ Interface Segregation - Small, focused interfaces
            interface Readable {
                public function read(int $id): ?Model;
            }
            
            interface Writable {
                public function create(array $data): Model;
                public function update(int $id, array $data): bool;
            }
            
            interface Deletable {
                public function delete(int $id): bool;
            }
            
            // Implement only what you need
            class ReadOnlyUserRepository implements Readable {
                public function read(int $id): ?User {
                    return User::find($id);
                }
            }
            
            class FullUserRepository implements Readable, Writable, Deletable {
                public function read(int $id): ?User { /* implementation */ }
                public function create(array $data): User { /* implementation */ }
                public function update(int $id, array $data): bool { /* implementation */ }
                public function delete(int $id): bool { /* implementation */ }
            }
            
            // ✅ Liskov Substitution - Subclasses work as expected
            abstract class Animal {
                abstract public function makeSound(): string;
                abstract public function move(): string;
            }
            
            class Dog extends Animal {
                public function makeSound(): string { return "Woof!"; }
                public function move(): string { return "Running"; }
            }
            
            class Fish extends Animal {
                public function makeSound(): string { return "Blub"; }
                public function move(): string { return "Swimming"; }
            }
            
            // Both Dog and Fish can replace Animal without breaking code
            function animalShow(Animal $animal): string {
                return $animal->makeSound() . " while " . $animal->move();
            }
            
            // Service Provider bindings for Dependency Inversion
            class AppServiceProvider extends ServiceProvider {
                public function register(): void {
                    // Bind interface to implementation
                    $this->app->bind(
                        PaymentGatewayInterface::class,
                        StripePaymentGateway::class
                    );
                    
                    $this->app->bind(
                        UserRepositoryInterface::class,
                        EloquentUserRepository::class
                    );
                    
                    // Context-based binding
                    $this->app->when(PaymentController::class)
                        ->needs(PaymentGatewayInterface::class)
                        ->give(StripePaymentGateway::class);
                        
                    $this->app->when(RefundController::class)
                        ->needs(PaymentGatewayInterface::class)
                        ->give(PayPalPaymentGateway::class);
                }
            }

Interview Tip: Always give real Laravel examples when discussing SOLID principles. Show how Laravel's architecture (Service Container, Facades, Eloquent) naturally encourages SOLID design!

Use: Clean architecture, maintainable code, easier testing, team collaboration, scalable applications

🎭 27. OOP Concepts

OOP = Encapsulation, Inheritance, Polymorphism, and Abstraction

Think of OOP as: Building with Lego blocks. Each block (object) has a specific purpose, blocks can connect in different ways (inheritance), and you can use the same interface for different blocks (polymorphism).

Q: How is Encapsulation implemented in PHP/Laravel?

Private Properties: Hide internal data from outside access
Public Methods: Controlled way to interact with the object
Getters/Setters: Control how properties are accessed and modified
Laravel Example: Eloquent models encapsulate database operations
Benefits: Data integrity, controlled access, easier maintenance

Q: How does Polymorphism work in Laravel?

Interface Implementation: Different classes implementing same interface
Method Overriding: Child classes providing specific implementations
Laravel Examples: Mail drivers, Cache drivers, Queue drivers
Dynamic Binding: Service container resolves correct implementation at runtime
Benefits: Code flexibility, easy to extend, cleaner architecture

Q: What are Abstract Classes vs Interfaces in PHP?

Abstract Classes: Can have implemented methods, properties, single inheritance
Interfaces: Only method signatures, no implementation, multiple inheritance
When to use Abstract: Shared code between related classes
When to use Interface: Contract definition, unrelated classes with common behavior
Laravel Example: ShouldQueue interface, Model abstract class

// ✅ Encapsulation Example
            class BankAccount {
                private float $balance = 0;
                private string $accountNumber;
                private array $transactionHistory = [];
                
                public function __construct(string $accountNumber) {
                    $this->accountNumber = $accountNumber;
                }
                
                // Controlled access to balance
                public function getBalance(): float {
                    return $this->balance;
                }
                
                // Validation and business logic in methods
                public function deposit(float $amount): bool {
                    if ($amount <= 0) {
                        throw new InvalidArgumentException('Amount must be positive');
                    }
                    
                    $this->balance += $amount;
                    $this->addTransaction('deposit', $amount);
                    
                    return true;
                }
                
                public function withdraw(float $amount): bool {
                    if ($amount > $this->balance) {
                        throw new InsufficientFundsException();
                    }
                    
                    $this->balance -= $amount;
                    $this->addTransaction('withdrawal', $amount);
                    
                    return true;
                }
                
                // Private method - internal implementation
                private function addTransaction(string $type, float $amount): void {
                    $this->transactionHistory[] = [
                        'type' => $type,
                        'amount' => $amount,
                        'timestamp' => now(),
                        'balance_after' => $this->balance
                    ];
                }
                
                // Read-only access to history
                public function getTransactionHistory(): array {
                    return $this->transactionHistory;
                }
            }
            
            // ✅ Inheritance and Polymorphism
            abstract class Vehicle {
                protected string $brand;
                protected float $speed = 0;
                
                public function __construct(string $brand) {
                    $this->brand = $brand;
                }
                
                // Concrete method - inherited by all
                public function getBrand(): string {
                    return $this->brand;
                }
                
                // Abstract method - must be implemented by children
                abstract public function start(): bool;
                abstract public function getMaxSpeed(): float;
                
                // Method that can be overridden
                public function accelerate(float $increment): void {
                    $this->speed = min($this->speed + $increment, $this->getMaxSpeed());
                }
            }
            
            class Car extends Vehicle {
                private bool $engineRunning = false;
                
                public function start(): bool {
                    $this->engineRunning = true;
                    return true;
                }
                
                public function getMaxSpeed(): float {
                    return 200.0; // km/h
                }
                
                // Override parent method with specific behavior
                public function accelerate(float $increment): void {
                    if (!$this->engineRunning) {
                        throw new Exception('Cannot accelerate - engine not running');
                    }
                    
                    parent::accelerate($increment);
                }
            }
            
            class Bicycle extends Vehicle {
                public function start(): bool {
                    return true; // Always ready to go
                }
                
                public function getMaxSpeed(): float {
                    return 50.0; // km/h
                }
            }
            
            // ✅ Interface Implementation (Polymorphism)
            interface Driveable {
                public function drive(float $distance): float;
                public function getFuelEfficiency(): float;
            }
            
            interface Flyable {
                public function takeOff(): bool;
                public function land(): bool;
                public function getAltitude(): float;
            }
            
            class Car extends Vehicle implements Driveable {
                public function drive(float $distance): float {
                    $fuelUsed = $distance / $this->getFuelEfficiency();
                    return $fuelUsed;
                }
                
                public function getFuelEfficiency(): float {
                    return 15.0; // km per liter
                }
            }
            
            class Airplane extends Vehicle implements Driveable, Flyable {
                private float $altitude = 0;
                
                public function drive(float $distance): float {
                    // Airplane can also taxi on ground
                    return $distance / 5.0; // Less efficient on ground
                }
                
                public function getFuelEfficiency(): float {
                    return 3.0; // km per liter
                }
                
                public function takeOff(): bool {
                    $this->altitude = 1000;
                    return true;
                }
                
                public function land(): bool {
                    $this->altitude = 0;
                    return true;
                }
                
                public function getAltitude(): float {
                    return $this->altitude;
                }
            }
            
            // Polymorphism in action
            function calculateTripCost(Driveable $vehicle, float $distance, float $fuelPrice): float {
                $fuelNeeded = $vehicle->drive($distance);
                return $fuelNeeded * $fuelPrice;
            }
            
            $car = new Car('Toyota');
            $airplane = new Airplane('Boeing');
            
            // Same interface, different implementations
            $carCost = calculateTripCost($car, 100, 1.5);
            $planeCost = calculateTripCost($airplane, 100, 2.0);
            
            // ✅ Laravel-specific OOP Examples
            // Eloquent Model (Encapsulation + Inheritance)
            class User extends Model implements MustVerifyEmail {
                // Encapsulated properties
                protected $fillable = ['name', 'email', 'password'];
                protected $hidden = ['password', 'remember_token'];
                protected $casts = ['email_verified_at' => 'datetime'];
                
                // Encapsulated business logic
                public function isAdmin(): bool {
                    return $this->role === 'admin';
                }
                
                public function getFullNameAttribute(): string {
                    return $this->first_name . ' ' . $this->last_name;
                }
                
                // Relationships (composition)
                public function posts(): HasMany {
                    return $this->hasMany(Post::class);
                }
            }
            
            // Service Layer (Composition over Inheritance)
            class UserService {
                public function __construct(
                    private UserRepositoryInterface $repository,
                    private EmailServiceInterface $emailService,
                    private CacheInterface $cache
                ) {}
                
                public function createUser(array $data): User {
                    // Composition: using multiple services
                    $user = $this->repository->create($data);
                    $this->emailService->sendWelcomeEmail($user);
                    $this->cache->forget('users:count');
                    
                    return $user;
                }
            }

Laravel Best Practice: Use Eloquent models for encapsulation, service classes for business logic, and interfaces for contracts. Laravel's architecture naturally encourages good OOP design!

Use: Clean code architecture, reusable components, maintainable systems, team development

🚀 28. PHP 8+ Features

PHP 8+ = modern features for cleaner, faster, and safer code

Think of PHP 8+ as: A major renovation of your development toolkit. Like upgrading from a basic toolbox to a professional workshop with power tools, better safety features, and more precise instruments.

Q: What are the most important PHP 8 features for Laravel developers?

Union Types: Variables can accept multiple types (string|int|null)
Named Arguments: Call functions with parameter names for clarity
Attributes: Replace docblock annotations with native syntax
Constructor Property Promotion: Declare and assign properties in one line
Match Expression: More powerful alternative to switch statements
Nullsafe Operator: Safe navigation through nullable objects (?->)
JIT Compiler: Improved performance for computation-heavy tasks

Q: How do Union Types improve Laravel development?

Method Parameters: Accept multiple types without type juggling
API Responses: Return different data types based on conditions
Model Attributes: Handle mixed data types in Eloquent models
Better Documentation: Self-documenting code without docblocks
IDE Support: Better autocompletion and error detection

Q: How do Attributes replace Laravel annotations?

Route Definitions: Define routes directly on controller methods
Validation Rules: Attach validation to DTO properties
API Documentation: Generate OpenAPI specs from attributes
Dependency Injection: Mark classes for auto-registration
Better Performance: Native PHP parsing vs regex docblock parsing

Q: What are PHP 8.1 and 8.2 improvements?

PHP 8.1: Enums, readonly properties, fibers (async), intersection types
PHP 8.2: Readonly classes, DNF types, sensitive parameter redaction
PHP 8.3: Typed class constants, dynamic class constant fetch, JSON validation
Performance: Each version brings 5-10% performance improvements
Laravel Support: Laravel 10+ requires PHP 8.1+, Laravel 11+ requires PHP 8.2+

// ✅ PHP 8 Union Types
            class PaymentService {
                // Accept multiple types
                public function processPayment(string|int $amount, User|Guest $customer): PaymentResult {
                    $normalizedAmount = is_string($amount) ? (float) $amount : $amount;
                    
                    return match($customer::class) {
                        User::class => $this->processUserPayment($normalizedAmount, $customer),
                        Guest::class => $this->processGuestPayment($normalizedAmount, $customer),
                    };
                }
                
                // Return different types based on condition
                public function getPaymentDetails(int $paymentId): Payment|null {
                    return Payment::find($paymentId);
                }
            }
            
            // ✅ Constructor Property Promotion (PHP 8)
            // Old way (verbose)
            class UserServiceOld {
                private UserRepository $userRepository;
                private EmailService $emailService;
                private LoggerInterface $logger;
                
                public function __construct(
                    UserRepository $userRepository,
                    EmailService $emailService,
                    LoggerInterface $logger
                ) {
                    $this->userRepository = $userRepository;
                    $this->emailService = $emailService;
                    $this->logger = $logger;
                }
            }
            
            // New way (concise)
            class UserService {
                public function __construct(
                    private UserRepository $userRepository,
                    private EmailService $emailService,
                    private LoggerInterface $logger
                ) {}
            }
            
            // ✅ Named Arguments (PHP 8)
            // Old way - positional arguments
            $user = User::create([
                'name' => 'John Doe',
                'email' => 'john@example.com',
                'password' => Hash::make('password'),
                'email_verified_at' => now(),
                'remember_token' => Str::random(10)
            ]);
            
            // New way - named arguments for clarity
            $response = Cache::remember(
                key: "user:{$userId}:profile",
                ttl: 3600,
                callback: fn() => $this->buildUserProfile($userId)
            );
            
            // Named arguments with validation
            $request->validate(
                rules: [
                    'email' => 'required|email',
                    'password' => 'required|min:8'
                ],
                messages: [
                    'email.required' => 'Email is mandatory',
                    'password.min' => 'Password too short'
                ]
            );
            
            // ✅ Match Expression (PHP 8) - More powerful than switch
            class OrderService {
                public function calculateShipping(Order $order): float {
                    return match($order->shipping_method) {
                        'standard' => 5.99,
                        'express' => 12.99,
                        'overnight' => 24.99,
                        'pickup' => 0.00,
                        default => throw new InvalidShippingMethodException()
                    };
                }
                
                public function getOrderStatus(Order $order): string {
                    return match(true) {
                        $order->isPaid() && $order->isShipped() => 'Delivered',
                        $order->isPaid() && !$order->isShipped() => 'Processing',
                        !$order->isPaid() && $order->created_at->lt(now()->subHours(24)) => 'Abandoned',
                        default => 'Pending'
                    };
                }
            }
            
            // ✅ Nullsafe Operator (PHP 8) - Safe navigation
            class UserController {
                public function show(int $userId): JsonResponse {
                    $user = User::find($userId);
                    
                    // Old way - multiple null checks
                    $avatarUrl = null;
                    if ($user && $user->profile && $user->profile->avatar) {
                        $avatarUrl = $user->profile->avatar->url;
                    }
                    
                    // New way - nullsafe operator
                    $avatarUrl = $user?->profile?->avatar?->url;
                    
                    return response()->json([
                        'user' => $user,
                        'avatar_url' => $avatarUrl,
                        'company_name' => $user?->company?->name ?? 'Freelancer'
                    ]);
                }
            }
            
            // ✅ Attributes (PHP 8) - Replace annotations
            use App\Attributes\{Route, Validate, Cache, RateLimit};
            
            class UserController extends Controller {
                #[Route('GET', '/api/users/{id}')]
                #[Cache(ttl: 3600, tags: ['users'])]
                #[RateLimit(requests: 60, window: 'minute')]
                public function show(
                    #[Validate('integer|min:1')] int $id
                ): JsonResponse {
                    $user = User::findOrFail($id);
                    return response()->json(new UserResource($user));
                }
                
                #[Route('POST', '/api/users')]
                #[RateLimit(requests: 10, window: 'minute')]
                public function store(
                    #[Validate(CreateUserRequest::class)] array $data
                ): JsonResponse {
                    $user = User::create($data);
                    return response()->json(new UserResource($user), 201);
                }
            }
            
            // ✅ PHP 8.1 Enums
            enum OrderStatus: string {
                case PENDING = 'pending';
                case PAID = 'paid';
                case SHIPPED = 'shipped';
                case DELIVERED = 'delivered';
                case CANCELLED = 'cancelled';
                
                public function label(): string {
                    return match($this) {
                        self::PENDING => 'Awaiting Payment',
                        self::PAID => 'Payment Received',
                        self::SHIPPED => 'On the Way',
                        self::DELIVERED => 'Delivered',
                        self::CANCELLED => 'Cancelled',
                    };
                }
                
                public function canTransitionTo(OrderStatus $status): bool {
                    return match($this) {
                        self::PENDING => in_array($status, [self::PAID, self::CANCELLED]),
                        self::PAID => in_array($status, [self::SHIPPED, self::CANCELLED]),
                        self::SHIPPED => $status === self::DELIVERED,
                        default => false,
                    };
                }
            }
            
            // Using enums in Laravel
            class Order extends Model {
                protected $casts = [
                    'status' => OrderStatus::class,
                ];
                
                public function markAsShipped(): void {
                    if (!$this->status->canTransitionTo(OrderStatus::SHIPPED)) {
                        throw new InvalidOrderTransitionException();
                    }
                    
                    $this->update(['status' => OrderStatus::SHIPPED]);
                }
            }
            
            // ✅ PHP 8.1 Readonly Properties
            class PaymentResult {
                public function __construct(
                    public readonly string $transactionId,
                    public readonly float $amount,
                    public readonly DateTimeImmutable $processedAt,
                    public readonly bool $successful
                ) {}
                
                // Properties cannot be modified after construction
                // $result->amount = 100; // Error!
            }
            
            // ✅ PHP 8.2 Readonly Classes
            readonly class UserProfileDTO {
                public function __construct(
                    public string $name,
                    public string $email,
                    public ?string $avatar,
                    public DateTimeImmutable $createdAt
                ) {}
                
                // All properties are automatically readonly
                public static function fromModel(User $user): self {
                    return new self(
                        name: $user->name,
                        email: $user->email,
                        avatar: $user->avatar?->url,
                        createdAt: $user->created_at->toDateTimeImmutable()
                    );
                }
            }

Performance Tip: PHP 8+ brings significant performance improvements (10-15% faster than PHP 7.4). Use the latest version in production for better performance and security!

Use: Modern codebases, better type safety, improved performance, cleaner syntax, enhanced developer experience

🧪 Testing & Quality Assurance

Senior Level: Know the difference between unit tests, feature tests, integration tests, and when to use each. Understand TDD/BDD principles and mocking strategies.

What's the difference between Unit Tests and Feature Tests in Laravel?

Unit Tests: Test individual classes/methods in isolation
Feature Tests: Test complete HTTP requests through your application

When to use: • Unit tests for business logic, services, models • Feature tests for API endpoints, web routes, workflows

Show me PHPUnit vs Pest syntax differences

Both are excellent - PHPUnit is traditional, Pest is modern and readable

// ✅ PHPUnit Style (Traditional)
            class UserServiceTest extends TestCase {
                use RefreshDatabase;
                
                public function test_it_creates_user_with_valid_data() {
                    $userData = [
                        'name' => 'John Doe',
                        'email' => 'john@example.com',
                        'password' => 'password123'
                    ];
                    
                    $service = new UserService();
                    $user = $service->createUser($userData);
                    
                    $this->assertInstanceOf(User::class, $user);
                    $this->assertEquals('John Doe', $user->name);
                    $this->assertDatabaseHas('users', ['email' => 'john@example.com']);
                }
                
                public function test_it_throws_exception_with_invalid_email() {
                    $this->expectException(InvalidEmailException::class);
                    
                    $service = new UserService();
                    $service->createUser(['email' => 'invalid-email']);
                }
            }
            
            // ✅ Pest Style (Modern - more readable)
            use App\Services\UserService;
            use App\Models\User;
            
            beforeEach(function () {
                $this->service = new UserService();
            });
            
            test('it creates user with valid data', function () {
                $userData = [
                    'name' => 'John Doe',
                    'email' => 'john@example.com',
                    'password' => 'password123'
                ];
                
                $user = $this->service->createUser($userData);
                
                expect($user)
                    ->toBeInstanceOf(User::class)
                    ->and($user->name)->toBe('John Doe');
                    
                $this->assertDatabaseHas('users', ['email' => 'john@example.com']);
            });
            
            test('it throws exception with invalid email', function () {
                expect(fn() => $this->service->createUser(['email' => 'invalid-email']))
                    ->toThrow(InvalidEmailException::class);
            });

How do you test API endpoints properly?

Test status codes, response structure, authentication, validation, and database changes

// ✅ Comprehensive API Testing
            class ProductApiTest extends TestCase {
                use RefreshDatabase;
                
                public function test_authenticated_user_can_create_product() {
                    $user = User::factory()->create();
                    $productData = [
                        'name' => 'iPhone 15',
                        'price' => 999.99,
                        'category_id' => Category::factory()->create()->id
                    ];
                    
                    $response = $this->actingAs($user, 'sanctum')
                        ->postJson('/api/products', $productData);
                        
                    $response->assertStatus(201)
                        ->assertJsonStructure([
                            'data' => [
                                'id',
                                'name',
                                'price',
                                'category' => ['id', 'name'],
                                'created_at',
                                'updated_at'
                            ]
                        ])
                        ->assertJson([
                            'data' => [
                                'name' => 'iPhone 15',
                                'price' => 999.99
                            ]
                        ]);
                        
                    $this->assertDatabaseHas('products', [
                        'name' => 'iPhone 15',
                        'user_id' => $user->id
                    ]);
                }
                
                public function test_validation_errors_return_422() {
                    $user = User::factory()->create();
                    
                    $response = $this->actingAs($user, 'sanctum')
                        ->postJson('/api/products', [
                            'name' => '', // Invalid - required
                            'price' => -10 // Invalid - must be positive
                        ]);
                        
                    $response->assertStatus(422)
                        ->assertJsonValidationErrors(['name', 'price']);
                }
                
                public function test_unauthenticated_user_cannot_create_product() {
                    $response = $this->postJson('/api/products', [
                        'name' => 'Test Product'
                    ]);
                    
                    $response->assertStatus(401);
                }
            }

How do you mock external services in tests?

Use Laravel's built-in mocking or create fake implementations for external APIs

// ✅ Mocking External Payment Service
            class PaymentServiceTest extends TestCase {
                public function test_successful_payment_processing() {
                    // Mock external payment gateway
                    $mock = $this->mock(PaymentGateway::class);
                    $mock->shouldReceive('charge')
                        ->once()
                        ->with(100.00, 'card_token')
                        ->andReturn([
                            'success' => true,
                            'transaction_id' => 'txn_123456'
                        ]);
                        
                    $service = app(PaymentService::class);
                    $result = $service->processPayment(100.00, 'card_token');
                    
                    $this->assertTrue($result['success']);
                    $this->assertEquals('txn_123456', $result['transaction_id']);
                }
                
                public function test_failed_payment_handling() {
                    $mock = $this->mock(PaymentGateway::class);
                    $mock->shouldReceive('charge')
                        ->andThrow(new PaymentException('Card declined'));
                        
                    $service = app(PaymentService::class);
                    
                    $this->expectException(PaymentException::class);
                    $service->processPayment(100.00, 'invalid_card');
                }
            }
            
            // ✅ Using HTTP Fake for external APIs
            class WeatherServiceTest extends TestCase {
                public function test_weather_api_integration() {
                    Http::fake([
                        'api.weather.com/*' => Http::response([
                            'temperature' => 25,
                            'condition' => 'sunny'
                        ], 200)
                    ]);
                    
                    $service = new WeatherService();
                    $weather = $service->getCurrentWeather('London');
                    
                    $this->assertEquals(25, $weather['temperature']);
                    $this->assertEquals('sunny', $weather['condition']);
                    
                    Http::assertSent(function ($request) {
                        return str_contains($request->url(), 'London');
                    });
                }
            }

What is Test-Driven Development (TDD) in practice?

Red → Green → Refactor cycle: Write failing test first, make it pass, then improve code

// ✅ TDD Example: Building User Registration
            // Step 1: RED - Write failing test first
            class UserRegistrationTest extends TestCase {
                /** @test */
                public function it_registers_user_with_valid_data() {
                    $userData = [
                        'name' => 'John Doe',
                        'email' => 'john@example.com',
                        'password' => 'password123'
                    ];
                    
                    $response = $this->postJson('/api/register', $userData);
                    
                    $response->assertStatus(201)
                        ->assertJsonStructure(['user' => ['id', 'name', 'email']]);
                        
                    $this->assertDatabaseHas('users', [
                        'email' => 'john@example.com'
                    ]);
                }
            }
            
            // Step 2: GREEN - Make test pass (minimal implementation)
            class AuthController extends Controller {
                public function register(Request $request) {
                    $user = User::create([
                        'name' => $request->name,
                        'email' => $request->email,
                        'password' => Hash::make($request->password)
                    ]);
                    
                    return response()->json(['user' => $user], 201);
                }
            }
            
            // Step 3: REFACTOR - Improve code quality
            class AuthController extends Controller {
                public function register(RegisterRequest $request) {
                    $user = User::create([
                        'name' => $request->validated()['name'],
                        'email' => $request->validated()['email'],
                        'password' => Hash::make($request->validated()['password'])
                    ]);
                    
                    event(new UserRegistered($user));
                    
                    return new UserResource($user);
                }
            }

How do you test background jobs and queues?

Use Queue::fake() to test job dispatching without actually running them

// ✅ Testing Queue Jobs
            class OrderProcessingTest extends TestCase {
                public function test_order_creation_dispatches_jobs() {
                    Queue::fake();
                    
                    $user = User::factory()->create();
                    $product = Product::factory()->create();
                    
                    $response = $this->actingAs($user)
                        ->postJson('/api/orders', [
                            'product_id' => $product->id,
                            'quantity' => 2
                        ]);
                        
                    $response->assertStatus(201);
                    
                    // Assert specific jobs were dispatched
                    Queue::assertPushed(ProcessPayment::class, function ($job) use ($user) {
                        return $job->order->user_id === $user->id;
                    });
                    
                    Queue::assertPushed(SendOrderConfirmation::class);
                    Queue::assertPushed(UpdateInventory::class);
                    
                    // Assert job was pushed to specific queue
                    Queue::assertPushedOn('payments', ProcessPayment::class);
                    
                    // Assert job count
                    Queue::assertPushed(ProcessPayment::class, 1);
                }
                
                public function test_job_execution_logic() {
                    // Test the actual job logic
                    $order = Order::factory()->create();
                    $job = new ProcessPayment($order);
                    
                    // Mock payment service
                    $this->mock(PaymentService::class)
                        ->shouldReceive('charge')
                        ->andReturn(['success' => true, 'id' => 'pay_123']);
                        
                    $job->handle();
                    
                    $this->assertEquals('paid', $order->fresh()->status);
                }
            }

🎯 Testing Best Practices: • Use factories for test data creation • Test both happy path and edge cases • Mock external dependencies • Use descriptive test names • Keep tests fast and independent • Aim for high coverage but focus on critical paths

💡 Pro Interview Tips:
• "I write tests first to clarify requirements" (TDD mindset) • "I mock external APIs to avoid flaky tests" • "I use feature tests for user workflows and unit tests for business logic" • "I prefer Pest for readability but PHPUnit works great too"

🔒 Security Best Practices

Senior Level: Understand OWASP Top 10, implement proper authentication/authorization, prevent XSS/CSRF/SQL injection, and secure API endpoints.

How do you prevent the most common web vulnerabilities in Laravel?

SQL Injection: Use Eloquent ORM and parameter binding
XSS: Use Blade's {{ }} escaping and validate inputs
CSRF: Use @csrf tokens in forms
Mass Assignment: Define $fillable or $guarded properties

// ❌ SQL Injection Vulnerability
            class UserController extends Controller {
                public function search(Request $request) {
                    $name = $request->input('name');
                    // DANGEROUS: Direct SQL concatenation
                    $users = DB::select("SELECT * FROM users WHERE name = '$name'");
                    return response()->json($users);
                }
            }
            
            // ✅ Safe Database Queries
            class UserController extends Controller {
                public function search(Request $request) {
                    $request->validate([
                        'name' => 'required|string|max:255|alpha_spaces'
                    ]);
                    
                    $name = $request->input('name');
                    
                    // Safe: Using Eloquent ORM
                    $users = User::where('name', 'LIKE', "%{$name}%")->get();
                    
                    // Safe: Parameter binding
                    $users = DB::select('SELECT * FROM users WHERE name LIKE ?', ["%{$name}%"]);
                    
                    return response()->json($users);
                }
                
                public function advancedSearch(Request $request) {
                    $request->validate([
                        'filters' => 'array',
                        'filters.name' => 'string|max:255',
                        'filters.email' => 'email',
                        'filters.status' => 'in:active,inactive'
                    ]);
                    
                    $query = User::query();
                    
                    if ($request->filled('filters.name')) {
                        $query->where('name', 'LIKE', '%' . $request->input('filters.name') . '%');
                    }
                    
                    if ($request->filled('filters.email')) {
                        $query->where('email', $request->input('filters.email'));
                    }
                    
                    if ($request->filled('filters.status')) {
                        $query->where('status', $request->input('filters.status'));
                    }
                    
                    return response()->json($query->paginate(20));
                }
            }

How do you implement proper CSRF protection?

Laravel includes CSRF protection by default. Use @csrf in forms and verify tokens in API requests

// ✅ CSRF Protection in Web Forms
            
            
                @csrf
                
                
                
            
            
            // ✅ CSRF Protection in AJAX
            // In your layout
            
            
            // JavaScript
            $.ajaxSetup({
                headers: {
                    'X-CSRF-TOKEN': $('meta[name="csrf-token"]').attr('content')
                }
            });
            
            // Axios default
            axios.defaults.headers.common['X-CSRF-TOKEN'] = document.querySelector('meta[name="csrf-token"]').content;
            
            // ✅ API CSRF with Sanctum
            class ApiController extends Controller {
                public function __construct() {
                    $this->middleware(['auth:sanctum', 'verified']);
                }
                
                public function store(Request $request) {
                    // Sanctum handles CSRF for same-domain requests
                    $validated = $request->validate([
                        'title' => 'required|string|max:255',
                        'content' => 'required|string'
                    ]);
                    
                    $post = auth()->user()->posts()->create($validated);
                    
                    return response()->json($post, 201);
                }
            }

How do you prevent XSS (Cross-Site Scripting) attacks?

Use Blade's automatic escaping, validate/sanitize inputs, implement CSP headers, and never output raw HTML

// ❌ XSS Vulnerability
            class PostController extends Controller {
                public function show($id) {
                    $post = Post::findOrFail($id);
                    // DANGEROUS: Raw output without escaping
                    return view('posts.show', compact('post'));
                }
            }
            
            
            
                {!! $post->content !!} 
            
            
            // ✅ XSS Prevention
            class PostController extends Controller {
                public function store(Request $request) {
                    $validated = $request->validate([
                        'title' => 'required|string|max:255',
                        'content' => 'required|string|max:10000',
                        'tags' => 'array|max:10',
                        'tags.*' => 'string|max:50'
                    ]);
                    
                    // Sanitize content
                    $validated['content'] = strip_tags($validated['content'], '
');
                    
                    $post = auth()->user()->posts()->create($validated);
                    
                    return redirect()->route('posts.show', $post);
                }
                
                public function show($id) {
                    $post = Post::with(['author', 'tags'])->findOrFail($id);
                    
                    // Safe: Blade escaping handles XSS protection
                    return view('posts.show', compact('post'));
                }
            }
            
            
            

                {{ $post->content }} 
            

            
            
                @foreach($post->tags as $tag)
                    {{ $tag->name }}
                @endforeach
            
            
            // ✅ Content Security Policy Middleware
            class ContentSecurityPolicyMiddleware {
                public function handle($request, Closure $next) {
                    $response = $next($request);
                    
                    $csp = [
                        "default-src 'self'",
                        "script-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net",
                        "style-src 'self' 'unsafe-inline' https://fonts.googleapis.com",
                        "font-src 'self' https://fonts.gstatic.com",
                        "img-src 'self' data: https:",
                        "connect-src 'self'"
                    ];
                    
                    $response->headers->set('Content-Security-Policy', implode('; ', $csp));
                    
                    return $response;
                }
            }

How do you implement secure API authentication and authorization?

Use Laravel Sanctum for SPA authentication, implement proper scopes, rate limiting, and secure headers

// ✅ Secure API Authentication with Sanctum class AuthController extends Controller { public function login(Request $request) { $request->validate([ 'email' => 'required|email', 'password' => 'required|min:8' ]); if (!Auth::attempt($request->only('email', 'password'))) { return response()->json([ 'message' => 'Invalid credentials' ], 401); } $user = Auth::user(); // Create token with specific abilities/scopes $token = $user->createToken('api-access', [ 'posts:read', 'posts:create', 'profile:update' ]); return response()->json([ 'user' => $user, 'token' => $token->plainTextToken, 'expires_at' => $token->accessToken->expires_at ]); } public function logout(Request $request) { $request->user()->currentAccessToken()->delete(); return response()->json([ 'message' => 'Successfully logged out' ]); } } // ✅ Protected API Endpoints class PostController extends Controller { public function __construct() { $this->middleware('auth:sanctum'); $this->middleware('throttle:60,1'); // Rate limiting } public function store(Request $request) { // Check specific token ability if (!$request->user()->tokenCan('posts:create')) { return response()->json(['message' => 'Insufficient permissions'], 403); } $validated = $request->validate([ 'title' => 'required|string|max:255', 'content' => 'required|string|max:10000', 'category_id' => 'required|exists:categories,id' ]); $post = $request->user()->posts()->create($validated); return response()->json($post, 201); } public function update(Request $request, Post $post) { // Authorization check $this->authorize('update', $post); $validated = $request->validate([ 'title' => 'string|max:255', 'content' => 'string|max:10000', 'category_id' => 'exists:categories,id' ]); $post->update($validated); return response()->json($post); } }

How do you handle file uploads securely?

Validate file types/sizes, use secure storage, prevent executable uploads, and scan for malware

// ✅ Secure File Upload Implementation class FileUploadController extends Controller { public function uploadAvatar(Request $request) { $request->validate([ 'avatar' => [ 'required', 'image', 'mimes:jpeg,png,jpg', 'max:2048', // 2MB max 'dimensions:min_width=100,min_height=100,max_width=1000,max_height=1000' ] ]); $user = auth()->user(); // Delete old avatar if ($user->avatar) { Storage::disk('public')->delete($user->avatar); } // Store with random name to prevent conflicts $path = $request->file('avatar')->store('avatars', 'public'); $user->update(['avatar' => $path]); return response()->json([ 'message' => 'Avatar updated successfully', 'avatar_url' => Storage::url($path) ]); } public function uploadDocument(Request $request) { $request->validate([ 'document' => [ 'required', 'file', 'mimes:pdf,doc,docx', 'max:10240', // 10MB max function ($attribute, $value, $fail) { // Custom validation: check file content $allowedMimeTypes = ['application/pdf', 'application/msword']; if (!in_array($value->getMimeType(), $allowedMimeTypes)) { $fail('Invalid file type detected.'); } } ] ]); $file = $request->file('document'); // Generate secure filename $filename = Str::uuid() . '.' . $file->getClientOriginalExtension(); // Store in private disk (not publicly accessible) $path = $file->storeAs('documents', $filename, 'private'); // Create database record $document = auth()->user()->documents()->create([ 'original_name' => $file->getClientOriginalName(), 'filename' => $filename, 'path' => $path, 'mime_type' => $file->getMimeType(), 'size' => $file->getSize() ]); return response()->json($document, 201); } public function downloadDocument(Document $document) { $this->authorize('download', $document); if (!Storage::disk('private')->exists($document->path)) { abort(404, 'File not found'); } return Storage::disk('private')->download( $document->path, $document->original_name ); } }

How do you implement rate limiting and prevent brute force attacks?

Use Laravel's built-in rate limiting, implement login throttling, and add IP-based restrictions

// ✅ Rate Limiting & Brute Force Protection // RouteServiceProvider.php class RouteServiceProvider extends ServiceProvider { protected function configureRateLimiting() { RateLimiter::for('api', function (Request $request) { return Limit::perMinute(60)->by($request->user()?->id ?: $request->ip()); }); RateLimiter::for('login', function (Request $request) { $email = (string) $request->email; return [ Limit::perMinute(5)->by($email . $request->ip()), Limit::perMinute(3)->by($email)->response(function () { return response()->json([ 'message' => 'Too many login attempts for this email.' ], 429); }) ]; }); RateLimiter::for('password-reset', function (Request $request) { return Limit::perHour(5)->by($request->ip()); }); } } // ✅ Login Controller with Throttling class LoginController extends Controller { public function login(Request $request) { // Apply rate limiting if (RateLimiter::tooManyAttempts('login:' . $request->ip(), 5)) { $seconds = RateLimiter::availableIn('login:' . $request->ip()); return response()->json([ 'message' => "Too many login attempts. Try again in {$seconds} seconds." ], 429); } $credentials = $request->validate([ 'email' => 'required|email', 'password' => 'required|min:8' ]); if (Auth::attempt($credentials)) { RateLimiter::clear('login:' . $request->ip()); $user = Auth::user(); $token = $user->createToken('auth-token'); // Log successful login activity() ->causedBy($user) ->withProperties(['ip' => $request->ip(), 'user_agent' => $request->userAgent()]) ->log('User logged in'); return response()->json([ 'user' => $user, 'token' => $token->plainTextToken ]); } RateLimiter::hit('login:' . $request->ip()); // Log failed login attempt activity() ->withProperties([ 'email' => $request->email, 'ip' => $request->ip(), 'user_agent' => $request->userAgent() ]) ->log('Failed login attempt'); return response()->json([ 'message' => 'Invalid credentials' ], 401); } }

How do you secure sensitive configuration and environment variables?

Use encrypted .env files, secret management services, and never commit secrets to version control

// ✅ Secure Configuration Management // .env.example (safe to commit) APP_NAME="Laravel App" APP_ENV=production APP_DEBUG=false APP_URL=https://yourdomain.com DB_CONNECTION=mysql DB_HOST=127.0.0.1 DB_PORT=3306 DB_DATABASE=your_database DB_USERNAME=your_username DB_PASSWORD=your_secure_password // Sensitive values - never commit actual .env STRIPE_SECRET_KEY=sk_live_xxxxx AWS_SECRET_ACCESS_KEY=xxxxx MAIL_PASSWORD=xxxxx // ✅ Configuration Service for Sensitive Data class ConfigService { public static function getSecureConfig($key, $default = null) { // In production, fetch from secure vault if (app()->environment('production')) { return self::getFromVault($key, $default); } // In development, use .env return config($key, $default); } private static function getFromVault($key, $default) { // Example: AWS Secrets Manager, HashiCorp Vault, etc. try { $client = new SecretsManagerClient([ 'region' => config('aws.region'), 'version' => 'latest' ]); $result = $client->getSecretValue([ 'SecretId' => $key ]); return json_decode($result['SecretString'], true); } catch (Exception $e) { Log::error("Failed to retrieve secret: {$key}", ['error' => $e->getMessage()]); return $default; } } } // ✅ Secure Headers Middleware class SecurityHeadersMiddleware { public function handle($request, Closure $next) { $response = $next($request); $response->headers->set('X-Content-Type-Options', 'nosniff'); $response->headers->set('X-Frame-Options', 'DENY'); $response->headers->set('X-XSS-Protection', '1; mode=block'); $response->headers->set('Strict-Transport-Security', 'max-age=31536000; includeSubDomains'); $response->headers->set('Referrer-Policy', 'strict-origin-when-cross-origin'); return $response; } }

🔒 Security Best Practices: • Never store secrets in code or version control • Use HTTPS everywhere with proper SSL certificates • Implement proper input validation and sanitization • Use parameterized queries to prevent SQL injection • Keep dependencies updated and scan for vulnerabilities • Log security events for monitoring • Implement proper session management

💡 Pro Interview Tips:
• "I follow OWASP Top 10 guidelines for web security" • "I use Laravel Sanctum for API authentication with proper scopes" • "I implement CSP headers to prevent XSS attacks" • "I never trust user input and always validate/sanitize data"

🚀 DevOps & CI/CD Pipelines

Senior Level: Understand automated deployment, testing pipelines, infrastructure as code, monitoring, and cloud deployment strategies.

What's your approach to setting up CI/CD for Laravel applications?

CI Pipeline: Automated testing, code quality checks, security scanning
CD Pipeline: Automated deployment to staging/production with rollback capabilities
Tools: GitHub Actions, GitLab CI, Jenkins, Docker, AWS/Digital Ocean

# ✅ GitHub Actions CI/CD Pipeline # .github/workflows/laravel.yml name: Laravel CI/CD on: push: branches: [ main, develop ] pull_request: branches: [ main ] jobs: test: runs-on: ubuntu-latest services: mysql: image: mysql:8.0 env: MYSQL_ROOT_PASSWORD: password MYSQL_DATABASE: laravel_test ports: - 3306:3306 options: --health-cmd="mysqladmin ping" --health-interval=10s --health-timeout=5s --health-retries=3 redis: image: redis:alpine ports: - 6379:6379 options: --health-cmd="redis-cli ping" --health-interval=10s --health-timeout=5s --health-retries=3 steps: - name: Checkout code uses: actions/checkout@v3 - name: Setup PHP uses: shivammathur/setup-php@v2 with: php-version: '8.2' extensions: mbstring, dom, fileinfo, mysql, redis coverage: xdebug - name: Copy .env run: php -r "file_exists('.env') || copy('.env.example', '.env');" - name: Install Dependencies run: composer install -q --no-ansi --no-interaction --no-scripts --no-progress --prefer-dist - name: Generate key run: php artisan key:generate - name: Directory Permissions run: chmod -R 777 storage bootstrap/cache - name: Run Migrations run: php artisan migrate --force env: DB_CONNECTION: mysql DB_HOST: 127.0.0.1 DB_PORT: 3306 DB_DATABASE: laravel_test DB_USERNAME: root DB_PASSWORD: password - name: Execute tests (Unit and Feature tests) with coverage run: php artisan test --coverage --min=80 env: DB_CONNECTION: mysql DB_HOST: 127.0.0.1 DB_PORT: 3306 DB_DATABASE: laravel_test DB_USERNAME: root DB_PASSWORD: password - name: PHP Code Sniffer run: ./vendor/bin/phpcs --standard=PSR12 app/ - name: PHPStan Static Analysis run: ./vendor/bin/phpstan analyse app/ --level=5 - name: Security Check run: php artisan security:check deploy: needs: test runs-on: ubuntu-latest if: github.ref == 'refs/heads/main' steps: - name: Deploy to production uses: appleboy/ssh-action@v0.1.4 with: host: ${{ secrets.HOST }} username: ${{ secrets.USERNAME }} key: ${{ secrets.SSH_KEY }} script: | cd /var/www/html git pull origin main composer install --no-dev --optimize-autoloader php artisan migrate --force php artisan config:cache php artisan route:cache php artisan view:cache php artisan queue:restart sudo systemctl reload nginx

How do you handle database migrations and deployments safely?

Use migration rollback strategies, backup databases, test migrations in staging, and implement zero-downtime deployments

// ✅ Safe Database Deployment Strategy # deployment-script.sh #!/bin/bash set -e # Exit on any error echo "Starting Laravel deployment..." # 1. Create database backup echo "Creating database backup..." mysqldump -u $DB_USERNAME -p$DB_PASSWORD $DB_DATABASE > backup_$(date +%Y%m%d_%H%M%S).sql # 2. Pull latest code echo "Pulling latest code..." git fetch origin git reset --hard origin/main # 3. Install dependencies echo "Installing dependencies..." composer install --no-dev --optimize-autoloader --no-interaction # 4. Run migrations (with backup strategy) echo "Running migrations..." php artisan migrate --force # 5. Clear and cache everything echo "Optimizing application..." php artisan config:cache php artisan route:cache php artisan view:cache php artisan event:cache # 6. Restart queue workers echo "Restarting queue workers..." php artisan queue:restart # 7. Reload web server echo "Reloading web server..." sudo systemctl reload php8.2-fpm sudo systemctl reload nginx echo "Deployment completed successfully!" # ✅ Laravel Migration Best Practices class CreateOrdersTable extends Migration { public function up() { Schema::create('orders', function (Blueprint $table) { $table->id(); $table->foreignId('user_id')->constrained()->onDelete('cascade'); $table->string('status')->default('pending'); $table->decimal('total', 10, 2); $table->json('metadata')->nullable(); $table->timestamps(); // Add indexes for performance $table->index(['user_id', 'status']); $table->index('created_at'); }); } public function down() { Schema::dropIfExists('orders'); } } // ✅ Data Migration Example (separate from schema) class PopulateOrderStatusesTable extends Migration { public function up() { $statuses = ['pending', 'processing', 'shipped', 'delivered', 'cancelled']; foreach ($statuses as $status) { DB::table('order_statuses')->insert([ 'name' => $status, 'label' => ucfirst($status), 'created_at' => now(), 'updated_at' => now() ]); } } public function down() { DB::table('order_statuses')->truncate(); } }

How do you monitor Laravel applications in production?

Use application monitoring (Laravel Telescope, Sentry), infrastructure monitoring (New Relic, DataDog), and logging strategies

// ✅ Application Monitoring Setup // config/logging.php 'channels' => [ 'stack' => [ 'driver' => 'stack', 'channels' => ['single', 'sentry'], ], 'sentry' => [ 'driver' => 'sentry', 'level' => env('LOG_LEVEL', 'debug'), 'bubble' => true, ], 'performance' => [ 'driver' => 'daily', 'path' => storage_path('logs/performance.log'), 'level' => 'info', 'days' => 14, ], ]; // ✅ Custom Monitoring Middleware class MonitoringMiddleware { public function handle($request, Closure $next) { $start = microtime(true); $response = $next($request); $duration = (microtime(true) - $start) * 1000; // Convert to milliseconds $memoryUsage = memory_get_peak_usage(true) / 1024 / 1024; // Convert to MB // Log slow requests if ($duration > 1000) { // Slower than 1 second Log::channel('performance')->warning('Slow request detected', [ 'url' => $request->fullUrl(), 'method' => $request->method(), 'duration_ms' => round($duration, 2), 'memory_mb' => round($memoryUsage, 2), 'user_id' => auth()->id(), 'ip' => $request->ip() ]); } // Add performance headers $response->headers->set('X-Response-Time', round($duration, 2) . 'ms'); $response->headers->set('X-Memory-Usage', round($memoryUsage, 2) . 'MB'); return $response; } } // ✅ Health Check Endpoint class HealthController extends Controller { public function check() { $health = [ 'status' => 'healthy', 'timestamp' => now()->toISOString(), 'services' => [] ]; // Check database connection try { DB::connection()->getPdo(); $health['services']['database'] = 'healthy'; } catch (Exception $e) { $health['services']['database'] = 'unhealthy'; $health['status'] = 'unhealthy'; } // Check Redis connection try { Redis::ping(); $health['services']['redis'] = 'healthy'; } catch (Exception $e) { $health['services']['redis'] = 'unhealthy'; $health['status'] = 'unhealthy'; } // Check queue status try { $queueSize = Queue::size(); $health['services']['queue'] = $queueSize < 1000 ? 'healthy' : 'warning'; $health['queue_size'] = $queueSize; } catch (Exception $e) { $health['services']['queue'] = 'unhealthy'; $health['status'] = 'unhealthy'; } $statusCode = $health['status'] === 'healthy' ? 200 : 503; return response()->json($health, $statusCode); } }

How do you implement blue-green or zero-downtime deployments?

Use load balancers, multiple server instances, gradual rollouts, and proper health checks

# ✅ Zero-Downtime Deployment Script #!/bin/bash # Blue-Green Deployment Strategy TIMESTAMP=$(date +%Y%m%d_%H%M%S) RELEASE_DIR="/var/www/releases/$TIMESTAMP" CURRENT_DIR="/var/www/current" SHARED_DIR="/var/www/shared" echo "Starting zero-downtime deployment..." # 1. Create new release directory mkdir -p $RELEASE_DIR cd $RELEASE_DIR # 2. Clone repository git clone --branch main --single-branch https://github.com/your-repo/app.git . # 3. Create symbolic links to shared resources ln -s $SHARED_DIR/.env .env ln -s $SHARED_DIR/storage/app/public storage/app/public ln -s $SHARED_DIR/storage/logs storage/logs # 4. Install dependencies composer install --no-dev --optimize-autoloader --no-interaction # 5. Run optimizations php artisan config:cache php artisan route:cache php artisan view:cache php artisan event:cache # 6. Run database migrations (if any) php artisan migrate --force # 7. Warm up application php artisan tinker --execute="app('cache')->flush();" # 8. Run health checks php artisan health:check if [ $? -eq 0 ]; then echo "Health checks passed. Switching to new release..." # 9. Atomic switch - update symlink ln -sfn $RELEASE_DIR $CURRENT_DIR # 10. Reload PHP-FPM and web server sudo systemctl reload php8.2-fpm sudo systemctl reload nginx # 11. Restart queue workers php artisan queue:restart echo "Deployment successful!" # 12. Clean up old releases (keep last 3) cd /var/www/releases ls -t | tail -n +4 | xargs -r rm -rf else echo "Health checks failed. Aborting deployment." rm -rf $RELEASE_DIR exit 1 fi # ✅ Docker-based Deployment # docker-compose.production.yml version: '3.8' services: app: build: context: . dockerfile: Dockerfile.production image: your-app:latest environment: - APP_ENV=production - APP_DEBUG=false volumes: - ./storage:/var/www/html/storage deploy: replicas: 3 update_config: parallelism: 1 delay: 10s order: start-first restart_policy: condition: on-failure delay: 5s max_attempts: 3 healthcheck: test: ["CMD", "php", "artisan", "health:check"] interval: 30s timeout: 10s retries: 3 start_period: 40s nginx: image: nginx:alpine ports: - "80:80" - "443:443" volumes: - ./nginx.conf:/etc/nginx/nginx.conf - ./ssl:/etc/ssl/certs depends_on: - app deploy: replicas: 2

How do you manage environment configuration and secrets?

Use secret management services, encrypted environment variables, and proper CI/CD secret handling

# ✅ Environment Configuration Management # .env.production (encrypted or in secrets manager) APP_NAME="Production App" APP_ENV=production APP_DEBUG=false APP_URL=https://yourapp.com # Database DB_CONNECTION=mysql DB_HOST=${DATABASE_HOST} DB_DATABASE=${DATABASE_NAME} DB_USERNAME=${DATABASE_USERNAME} DB_PASSWORD=${DATABASE_PASSWORD} # Redis REDIS_HOST=${REDIS_HOST} REDIS_PASSWORD=${REDIS_PASSWORD} # External Services STRIPE_SECRET=${STRIPE_SECRET_KEY} AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY} AWS_SECRET_ACCESS_KEY=${AWS_SECRET_KEY} MAIL_PASSWORD=${MAIL_PASSWORD} # ✅ Secrets Management with Laravel class SecretsManager { public static function get($key, $default = null) { // Try environment first $value = env($key); if ($value !== null) { return $value; } // Fallback to secrets manager if (app()->environment('production')) { return self::getFromSecretsManager($key, $default); } return $default; } private static function getFromSecretsManager($key, $default) { try { // AWS Secrets Manager example $client = new SecretsManagerClient([ 'region' => config('aws.region'), 'version' => 'latest' ]); $result = $client->getSecretValue([ 'SecretId' => "production/laravel-app/{$key}" ]); return $result['SecretString']; } catch (Exception $e) { Log::error("Failed to fetch secret: {$key}", [ 'error' => $e->getMessage() ]); return $default; } } } # ✅ GitHub Actions Secrets Management # In your workflow file env: DB_PASSWORD: ${{ secrets.DB_PASSWORD }} STRIPE_SECRET_KEY: ${{ secrets.STRIPE_SECRET_KEY }} AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }} steps: - name: Deploy to production env: SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }} HOST: ${{ secrets.PRODUCTION_HOST }} run: | echo "$SSH_PRIVATE_KEY" > ssh_key chmod 600 ssh_key ssh -i ssh_key -o StrictHostKeyChecking=no user@$HOST 'cd /var/www && ./deploy.sh'

🚀 DevOps Best Practices: • Use Infrastructure as Code (Terraform, CloudFormation) • Implement proper monitoring and alerting • Automate testing at every stage • Use feature flags for safe deployments • Implement proper backup and disaster recovery • Monitor application performance and errors • Use container orchestration for scalability

💡 Pro Interview Tips:
• "I implement CI/CD pipelines with automated testing and deployment" • "I use blue-green deployments for zero downtime" • "I monitor applications with health checks and performance metrics" • "I manage secrets securely with dedicated secret management services"

🐳 Docker & Containerization

Senior Level: Understand containerization benefits, Docker multi-stage builds, orchestration with Docker Compose, and production deployment strategies.

How do you containerize a Laravel application with Docker?

Multi-stage builds: Separate build and runtime environments
Optimization: Layer caching, minimal base images, .dockerignore
Services: App, database, Redis, queue workers in separate containers
Orchestration: Docker Compose for development, Kubernetes for production

# ✅ Production-Ready Dockerfile # Dockerfile FROM php:8.2-fpm-alpine as base # Install system dependencies RUN apk add --no-cache \ curl \ libpng-dev \ libxml2-dev \ zip \ unzip \ git \ oniguruma-dev \ libzip-dev \ freetype-dev \ libjpeg-turbo-dev \ && docker-php-ext-configure gd --with-freetype --with-jpeg \ && docker-php-ext-install pdo_mysql mbstring exif pcntl bcmath gd zip opcache # Install Composer COPY --from=composer:latest /usr/bin/composer /usr/bin/composer # Set working directory WORKDIR /var/www # Create system user RUN addgroup -g 1000 -S www && adduser -u 1000 -S www -G www # Copy composer files first for better layer caching COPY composer.json composer.lock ./ RUN composer install --no-dev --no-scripts --no-autoloader --prefer-dist # Copy application code COPY . . RUN composer dump-autoload --optimize --classmap-authoritative --no-dev # Set permissions RUN chown -R www:www /var/www \ && chmod -R 755 /var/www/storage \ && chmod -R 755 /var/www/bootstrap/cache # PHP Configuration for production RUN echo "opcache.enable=1" >> /usr/local/etc/php/php.ini \ && echo "opcache.memory_consumption=128" >> /usr/local/etc/php/php.ini \ && echo "opcache.max_accelerated_files=4000" >> /usr/local/etc/php/php.ini \ && echo "opcache.revalidate_freq=2" >> /usr/local/etc/php/php.ini \ && echo "upload_max_filesize=20M" >> /usr/local/etc/php/php.ini \ && echo "post_max_size=20M" >> /usr/local/etc/php/php.ini USER www EXPOSE 9000 CMD ["php-fpm"] # ✅ Multi-stage build for different environments FROM base as development USER root RUN apk add --no-cache nodejs npm RUN docker-php-ext-install xdebug USER www FROM base as production # Production-specific optimizations RUN php artisan config:cache \ && php artisan route:cache \ && php artisan view:cache

How do you set up a complete Laravel development environment with Docker Compose?

Separate containers for app, database, Redis, queue workers, and web server with proper networking and volumes

# ✅ Complete Docker Compose Setup # docker-compose.yml version: '3.8' services: app: build: context: . dockerfile: Dockerfile target: development image: laravel-app:dev container_name: laravel-app restart: unless-stopped working_dir: /var/www volumes: - ./:/var/www - ./docker/php/local.ini:/usr/local/etc/php/conf.d/local.ini networks: - laravel-network depends_on: - mysql - redis nginx: image: nginx:alpine container_name: laravel-nginx restart: unless-stopped ports: - "8000:80" - "8443:443" volumes: - ./:/var/www - ./docker/nginx/nginx.conf:/etc/nginx/nginx.conf - ./docker/nginx/sites/:/etc/nginx/sites-available - ./docker/nginx/ssl/:/etc/ssl/certs depends_on: - app networks: - laravel-network mysql: image: mysql:8.0 container_name: laravel-mysql restart: unless-stopped environment: MYSQL_DATABASE: ${DB_DATABASE} MYSQL_ROOT_PASSWORD: ${DB_PASSWORD} MYSQL_PASSWORD: ${DB_PASSWORD} MYSQL_USER: ${DB_USERNAME} volumes: - mysql-data:/var/lib/mysql - ./docker/mysql/my.cnf:/etc/mysql/my.cnf - ./docker/mysql/init:/docker-entrypoint-initdb.d ports: - "3306:3306" networks: - laravel-network redis: image: redis:alpine container_name: laravel-redis restart: unless-stopped ports: - "6379:6379" volumes: - redis-data:/data networks: - laravel-network queue: build: context: . dockerfile: Dockerfile target: development image: laravel-app:dev container_name: laravel-queue restart: unless-stopped command: php artisan queue:work --verbose --tries=3 --timeout=90 volumes: - ./:/var/www depends_on: - mysql - redis networks: - laravel-network scheduler: build: context: . dockerfile: Dockerfile target: development image: laravel-app:dev container_name: laravel-scheduler restart: unless-stopped command: /bin/sh -c "while true; do php artisan schedule:run; sleep 60; done" volumes: - ./:/var/www depends_on: - mysql - redis networks: - laravel-network mailhog: image: mailhog/mailhog container_name: laravel-mailhog restart: unless-stopped ports: - "1025:1025" - "8025:8025" networks: - laravel-network networks: laravel-network: driver: bridge volumes: mysql-data: driver: local redis-data: driver: local

How do you optimize Docker images for Laravel production?

Use multi-stage builds, minimize layers, leverage build cache, use Alpine images, and exclude unnecessary files

# ✅ .dockerignore for smaller images .git .gitignore README.md .env .env.example docker-compose*.yml Dockerfile* .dockerignore .nyc_output .sass-cache .vscode node_modules npm-debug.log tests/ storage/logs/* !storage/logs/.gitkeep storage/framework/cache/* !storage/framework/cache/.gitkeep storage/framework/sessions/* !storage/framework/sessions/.gitkeep storage/framework/testing/* !storage/framework/testing/.gitkeep storage/framework/views/* !storage/framework/views/.gitkeep # ✅ Optimized Production Dockerfile FROM php:8.2-fpm-alpine as builder # Install build dependencies RUN apk add --no-cache --virtual .build-deps \ $PHPIZE_DEPS \ libpng-dev \ libxml2-dev \ oniguruma-dev \ libzip-dev \ freetype-dev \ libjpeg-turbo-dev # Install PHP extensions RUN docker-php-ext-configure gd --with-freetype --with-jpeg \ && docker-php-ext-install -j$(nproc) \ pdo_mysql \ mbstring \ exif \ pcntl \ bcmath \ gd \ zip \ opcache \ && apk del .build-deps # Install Composer COPY --from=composer:2 /usr/bin/composer /usr/bin/composer WORKDIR /var/www # Copy composer files and install dependencies COPY composer.json composer.lock ./ RUN composer install \ --no-dev \ --no-interaction \ --no-plugins \ --no-scripts \ --prefer-dist \ --optimize-autoloader # Production stage FROM php:8.2-fpm-alpine as production # Install runtime dependencies only RUN apk add --no-cache \ libpng \ libxml2 \ oniguruma \ libzip \ freetype \ libjpeg-turbo \ && docker-php-ext-install opcache # Copy PHP extensions from builder COPY --from=builder /usr/local/lib/php/extensions/ /usr/local/lib/php/extensions/ COPY --from=builder /usr/local/etc/php/conf.d/ /usr/local/etc/php/conf.d/ # Production PHP configuration RUN echo "opcache.enable=1" > /usr/local/etc/php/conf.d/opcache.ini \ && echo "opcache.memory_consumption=256" >> /usr/local/etc/php/conf.d/opcache.ini \ && echo "opcache.max_accelerated_files=20000" >> /usr/local/etc/php/conf.d/opcache.ini \ && echo "opcache.revalidate_freq=0" >> /usr/local/etc/php/conf.d/opcache.ini \ && echo "opcache.validate_timestamps=0" >> /usr/local/etc/php/conf.d/opcache.ini # Create app user RUN addgroup -g 1000 -S www \ && adduser -u 1000 -S www -G www WORKDIR /var/www # Copy vendor from builder COPY --from=builder --chown=www:www /var/www/vendor vendor # Copy application code COPY --chown=www:www . . # Set permissions and cache configuration RUN chmod -R 755 storage bootstrap/cache \ && php artisan config:cache \ && php artisan route:cache \ && php artisan view:cache USER www EXPOSE 9000 CMD ["php-fpm"]

How do you handle Laravel queues and scheduled tasks in containers?

Run separate containers for queue workers and scheduler, with proper restart policies and monitoring

# ✅ Queue Worker Container Configuration # docker-compose.production.yml version: '3.8' services: app: image: your-registry/laravel-app:latest deploy: replicas: 2 restart_policy: condition: on-failure delay: 5s max_attempts: 3 resources: limits: memory: 512M reservations: memory: 256M queue-default: image: your-registry/laravel-app:latest command: php artisan queue:work --queue=default --verbose --tries=3 --timeout=300 --memory=256 deploy: replicas: 2 restart_policy: condition: any delay: 5s max_attempts: 5 healthcheck: test: ["CMD", "php", "artisan", "queue:monitor", "default", "--max-jobs=100"] interval: 30s timeout: 10s retries: 3 queue-high-priority: image: your-registry/laravel-app:latest command: php artisan queue:work --queue=high,default --verbose --tries=3 --timeout=60 --memory=128 deploy: replicas: 1 restart_policy: condition: any delay: 5s queue-emails: image: your-registry/laravel-app:latest command: php artisan queue:work --queue=emails --verbose --tries=5 --timeout=120 --memory=256 deploy: replicas: 1 scheduler: image: your-registry/laravel-app:latest command: > sh -c "while true; do php artisan schedule:run --verbose --no-interaction sleep 60 done" deploy: replicas: 1 restart_policy: condition: any # ✅ Health Check for Queue Workers class HealthCheckCommand extends Command { protected $signature = 'queue:monitor {queue} {--max-jobs=50}'; protected $description = 'Monitor queue health for container orchestration'; public function handle() { $queue = $this->argument('queue'); $maxJobs = $this->option('max-jobs'); $size = Queue::size($queue); if ($size > $maxJobs) { $this->error("Queue {$queue} has {$size} jobs (max: {$maxJobs})"); return 1; } // Check if queue workers are processing $workersActive = $this->checkActiveWorkers($queue); if (!$workersActive) { $this->error("No active workers found for queue {$queue}"); return 1; } $this->info("Queue {$queue} is healthy ({$size} jobs pending)"); return 0; } private function checkActiveWorkers($queue) { // Check if workers have processed jobs recently $recentJobs = DB::table('jobs') ->where('queue', $queue) ->where('created_at', '>', now()->subMinutes(5)) ->count(); $failedJobs = DB::table('failed_jobs') ->where('queue', $queue) ->where('failed_at', '>', now()->subMinutes(5)) ->count(); return $recentJobs > 0 || $failedJobs == 0; } }

How do you manage database migrations and seeding in containerized environments?

Use init containers, migration jobs, or startup scripts with proper dependency management and rollback strategies

# ✅ Database Migration Strategies # kubernetes-migration-job.yml apiVersion: batch/v1 kind: Job metadata: name: laravel-migrate labels: app: laravel component: migration spec: template: metadata: labels: app: laravel component: migration spec: restartPolicy: OnFailure containers: - name: migrate image: your-registry/laravel-app:latest command: ["php", "artisan", "migrate", "--force"] env: - name: DB_HOST value: "mysql-service" - name: DB_DATABASE value: "laravel" - name: DB_USERNAME valueFrom: secretKeyRef: name: mysql-secret key: username - name: DB_PASSWORD valueFrom: secretKeyRef: name: mysql-secret key: password initContainers: - name: wait-for-db image: busybox:1.28 command: ['sh', '-c', 'until nc -z mysql-service 3306; do echo waiting for mysql; sleep 2; done;'] # ✅ Docker Compose with Migration # docker-compose.yml (updated) services: migrate: build: context: . dockerfile: Dockerfile command: php artisan migrate --force volumes: - ./:/var/www depends_on: mysql: condition: service_healthy networks: - laravel-network seed: build: context: . dockerfile: Dockerfile command: php artisan db:seed --force volumes: - ./:/var/www depends_on: - migrate networks: - laravel-network mysql: image: mysql:8.0 healthcheck: test: ["CMD", "mysqladmin", "ping", "-h", "localhost"] timeout: 10s retries: 10 start_period: 30s # ✅ Startup Script for Application Container #!/bin/bash # docker/startup.sh set -e # Wait for database echo "Waiting for database connection..." until php artisan tinker --execute="DB::connection()->getPdo(); echo 'Database connected!'"; do echo "Database is unavailable - sleeping" sleep 2 done # Run migrations if needed if [ "$RUN_MIGRATIONS" = "true" ]; then echo "Running database migrations..." php artisan migrate --force fi # Cache configuration for production if [ "$APP_ENV" = "production" ]; then echo "Caching configuration for production..." php artisan config:cache php artisan route:cache php artisan view:cache fi # Start PHP-FPM exec "$@"

How do you handle file storage and volumes in containerized Laravel apps?

Use persistent volumes for uploads, shared storage for multi-instance deployments, and cloud storage for scalability

# ✅ Volume Management Strategy # docker-compose.yml services: app: image: laravel-app:latest volumes: # Persistent storage for uploads - uploads:/var/www/storage/app/public # Shared logs volume - logs:/var/www/storage/logs # Cache and sessions - use Redis instead of files # - cache:/var/www/storage/framework/cache # - sessions:/var/www/storage/framework/sessions nginx: image: nginx:alpine volumes: # Share uploads volume with nginx for direct serving - uploads:/var/www/storage/app/public:ro volumes: uploads: driver: local driver_opts: type: none o: bind device: /mnt/shared/uploads logs: driver: local # ✅ Cloud Storage Configuration // config/filesystems.php 'disks' => [ 'public' => [ 'driver' => 'local', 'root' => storage_path('app/public'), 'url' => env('APP_URL').'/storage', 'visibility' => 'public', ], 's3' => [ 'driver' => 's3', 'key' => env('AWS_ACCESS_KEY_ID'), 'secret' => env('AWS_SECRET_ACCESS_KEY'), 'region' => env('AWS_DEFAULT_REGION'), 'bucket' => env('AWS_BUCKET'), 'url' => env('AWS_URL'), 'endpoint' => env('AWS_ENDPOINT'), ], ], 'default' => env('FILESYSTEM_DISK', 's3'), // Use S3 in production # ✅ File Upload Service for Containers class FileUploadService { public function store($file, $path = 'uploads') { // In production containers, always use cloud storage $disk = app()->environment('production') ? 's3' : 'public'; $filename = Str::uuid() . '.' . $file->getClientOriginalExtension(); $storedPath = Storage::disk($disk)->putFileAs( $path, $file, $filename, ['visibility' => 'public'] ); return [ 'path' => $storedPath, 'url' => Storage::disk($disk)->url($storedPath), 'disk' => $disk ]; } public function delete($path, $disk = null) { $disk = $disk ?: (app()->environment('production') ? 's3' : 'public'); return Storage::disk($disk)->delete($path); } }

🐳 Docker Best Practices: • Use multi-stage builds to reduce image size • Leverage build cache with proper layer ordering • Use Alpine images for smaller footprint • Implement proper health checks • Use init containers for dependencies • Separate concerns with dedicated containers • Use secrets management for sensitive data

💡 Pro Interview Tips:
• "I use multi-stage builds to optimize Docker images for production" • "I separate queue workers and schedulers into dedicated containers" • "I use persistent volumes for stateful data and cloud storage for uploads" • "I implement health checks and proper restart policies for reliability"

📡 Broadcasting & WebSockets

Real-Time Level: Master Laravel's real-time communication using broadcasting, WebSockets, and event-driven architecture for live updates.

What is Laravel Broadcasting and how does it work?

Broadcasting: Server-to-client real-time communication using WebSockets
Drivers: Pusher, Ably, Redis, Socket.IO, or custom implementations
Use cases: Live chat, notifications, real-time dashboards, collaboration tools
Components: Events, Channels, Broadcasting drivers, JavaScript integration

// ✅ Broadcasting Configuration // config/broadcasting.php return [ 'default' => env('BROADCAST_DRIVER', 'null'), 'connections' => [ 'pusher' => [ 'driver' => 'pusher', 'key' => env('PUSHER_APP_KEY'), 'secret' => env('PUSHER_APP_SECRET'), 'app_id' => env('PUSHER_APP_ID'), 'options' => [ 'cluster' => env('PUSHER_APP_CLUSTER'), 'host' => env('PUSHER_HOST') ?: 'api-'.env('PUSHER_APP_CLUSTER', 'mt1').'.pusherapp.com', 'port' => env('PUSHER_PORT', 443), 'scheme' => env('PUSHER_SCHEME', 'https'), 'encrypted' => true, 'useTLS' => env('PUSHER_SCHEME', 'https') === 'https', ], 'client_options' => [ 'verify_peer' => false, ], ], 'ably' => [ 'driver' => 'ably', 'key' => env('ABLY_KEY'), ], 'redis' => [ 'driver' => 'redis', 'connection' => 'default', ], 'log' => [ 'driver' => 'log', ], ], ]; // ✅ .env Configuration BROADCAST_DRIVER=pusher PUSHER_APP_ID=your-app-id PUSHER_APP_KEY=your-app-key PUSHER_APP_SECRET=your-app-secret PUSHER_APP_CLUSTER=us2

How do you create and broadcast events in Laravel?

Create broadcastable events that implement ShouldBroadcast interface and define channels

// ✅ Create Broadcastable Event // php artisan make:event MessageSent // app/Events/MessageSent.php class MessageSent implements ShouldBroadcast { use Dispatchable, InteractsWithSockets, SerializesModels; public $message; public $user; public function __construct(Message $message) { $this->message = $message; $this->user = $message->user; } // Define which channels to broadcast on public function broadcastOn() { return [ new PrivateChannel('chat.' . $this->message->room_id), new PresenceChannel('chat-room.' . $this->message->room_id) ]; } // Customize event name (optional) public function broadcastAs() { return 'message.sent'; } // Customize broadcast data public function broadcastWith() { return [ 'id' => $this->message->id, 'content' => $this->message->content, 'user' => [ 'id' => $this->user->id, 'name' => $this->user->name, 'avatar' => $this->user->avatar_url ], 'created_at' => $this->message->created_at->toISOString(), 'room_id' => $this->message->room_id ]; } // Conditionally broadcast public function broadcastWhen() { return $this->message->is_approved && !$this->message->is_deleted; } } // ✅ Broadcasting the Event class MessageController extends Controller { public function store(Request $request) { $request->validate([ 'content' => 'required|string|max:1000', 'room_id' => 'required|exists:chat_rooms,id' ]); // Check if user can send messages to this room $room = ChatRoom::findOrFail($request->room_id); $this->authorize('sendMessage', $room); $message = Message::create([ 'user_id' => auth()->id(), 'room_id' => $request->room_id, 'content' => $request->content, 'type' => 'text' ]); // Broadcast the event broadcast(new MessageSent($message)); return response()->json([ 'message' => $message->load('user'), 'status' => 'sent' ]); } }

What are the different types of channels and when do you use each?

Public: Anyone can listen, no authentication
Private: Requires authentication, user-specific content
Presence: Private + shows who's online, great for collaboration

// ✅ Channel Types and Authorization // routes/channels.php // Public Channel - No authorization needed Broadcast::channel('public-announcements', function () { return true; // Anyone can listen }); // Private Channel - Requires authentication Broadcast::channel('user-notifications.{userId}', function (User $user, $userId) { return $user->id === (int) $userId; }); // Private Channel with complex authorization Broadcast::channel('project.{projectId}', function (User $user, $projectId) { $project = Project::find($projectId); return $project && ( $project->owner_id === $user->id || $project->team->members->contains($user) || $user->hasRole('admin') ); }); // Presence Channel - Shows who's online Broadcast::channel('chat-room.{roomId}', function (User $user, $roomId) { $room = ChatRoom::find($roomId); if ($room && $room->members->contains($user)) { return [ 'id' => $user->id, 'name' => $user->name, 'avatar' => $user->avatar_url, 'status' => $user->status, 'joined_at' => now()->toISOString() ]; } return false; }); // Dynamic channel with parameters Broadcast::channel('order-updates.{userId}.{orderId}', function (User $user, $userId, $orderId) { $order = Order::find($orderId); return $user->id === (int) $userId && $order && $order->user_id === $user->id; }); // ✅ Different Broadcasting Events for Each Channel Type class AnnouncementBroadcast implements ShouldBroadcast { public $announcement; public function __construct($announcement) { $this->announcement = $announcement; } public function broadcastOn() { return new Channel('public-announcements'); // Public } } class NotificationSent implements ShouldBroadcast { public $notification; public function __construct(UserNotification $notification) { $this->notification = $notification; } public function broadcastOn() { return new PrivateChannel('user-notifications.' . $this->notification->user_id); } } class UserJoinedRoom implements ShouldBroadcast { public $user; public $room; public function __construct(User $user, ChatRoom $room) { $this->user = $user; $this->room = $room; } public function broadcastOn() { return new PresenceChannel('chat-room.' . $this->room->id); } public function broadcastWith() { return [ 'user' => [ 'id' => $this->user->id, 'name' => $this->user->name, 'avatar' => $this->user->avatar_url ], 'message' => $this->user->name . ' joined the room' ]; } }

How do you integrate Laravel Broadcasting with JavaScript frontend?

Use Laravel Echo with Pusher, Socket.IO, or other drivers to listen for real-time events

// ✅ Frontend Integration with Laravel Echo // Install Laravel Echo and Pusher // npm install --save laravel-echo pusher-js // resources/js/bootstrap.js import Echo from 'laravel-echo'; import Pusher from 'pusher-js'; window.Pusher = Pusher; window.Echo = new Echo({ broadcaster: 'pusher', key: import.meta.env.VITE_PUSHER_APP_KEY, cluster: import.meta.env.VITE_PUSHER_APP_CLUSTER, wsHost: import.meta.env.VITE_PUSHER_HOST || `ws-${import.meta.env.VITE_PUSHER_APP_CLUSTER}.pusherapp.com`, wsPort: import.meta.env.VITE_PUSHER_PORT || 80, wssPort: import.meta.env.VITE_PUSHER_PORT || 443, forceTLS: (import.meta.env.VITE_PUSHER_SCHEME || 'https') === 'https', enabledTransports: ['ws', 'wss'], authorizer: (channel, options) => { return { authorize: (socketId, callback) => { axios.post('/api/broadcasting/auth', { socket_id: socketId, channel_name: channel.name }) .then(response => { callback(false, response.data); }) .catch(error => { callback(true, error); }); } }; }, }); // ✅ Listening to Events in JavaScript // Chat Application Example class ChatApp { constructor(roomId, userId) { this.roomId = roomId; this.userId = userId; this.setupEcho(); this.bindEvents(); } setupEcho() { // Listen to private channel for messages Echo.private(`chat.${this.roomId}`) .listen('.message.sent', (event) => { this.handleNewMessage(event); }) .listen('MessageDeleted', (event) => { this.handleMessageDeleted(event); }) .listen('TypingStarted', (event) => { this.handleTypingStarted(event); }) .listen('TypingStopped', (event) => { this.handleTypingStopped(event); }); // Listen to presence channel for user status Echo.join(`chat-room.${this.roomId}`) .here((users) => { this.handleUsersOnline(users); }) .joining((user) => { this.handleUserJoined(user); }) .leaving((user) => { this.handleUserLeft(user); }) .listenForWhisper('typing', (event) => { this.handleWhisperTyping(event); }); // Listen to personal notifications Echo.private(`user-notifications.${this.userId}`) .listen('NotificationSent', (event) => { this.showNotification(event.notification); }); } handleNewMessage(event) { const messageHtml = `

${event.user.name} ${this.formatTime(event.created_at)}

${this.escapeHtml(event.content)}

`; document.querySelector('#messages').insertAdjacentHTML('beforeend', messageHtml); this.scrollToBottom(); this.playNotificationSound(); } handleUsersOnline(users) { const usersList = document.querySelector('#online-users'); usersList.innerHTML = ''; users.forEach(user => { usersList.insertAdjacentHTML('beforeend', `
${user.name} ${user.status}
`); }); document.querySelector('#online-count').textContent = users.length; } handleUserJoined(user) { this.showSystemMessage(`${user.name} joined the chat`); // Add user to online list document.querySelector('#online-users').insertAdjacentHTML('beforeend', `
${user.name} ${user.status}
`); this.updateOnlineCount(); } handleUserLeft(user) { this.showSystemMessage(`${user.name} left the chat`); // Remove user from online list const userElement = document.querySelector(`[data-id="${user.id}"]`); if (userElement) { userElement.remove(); } this.updateOnlineCount(); } sendMessage() { const input = document.querySelector('#message-input'); const content = input.value.trim(); if (!content) return; axios.post('/api/messages', { room_id: this.roomId, content: content }) .then(response => { input.value = ''; this.stopTyping(); }) .catch(error => { this.showError('Failed to send message'); }); } // Typing indicators using whisper events startTyping() { if (!this.isTyping) { this.isTyping = true; Echo.join(`chat-room.${this.roomId}`) .whisper('typing', { user: this.getCurrentUser(), typing: true }); } clearTimeout(this.typingTimeout); this.typingTimeout = setTimeout(() => { this.stopTyping(); }, 3000); } stopTyping() { if (this.isTyping) { this.isTyping = false; Echo.join(`chat-room.${this.roomId}`) .whisper('typing', { user: this.getCurrentUser(), typing: false }); } } bindEvents() { const messageInput = document.querySelector('#message-input'); const sendButton = document.querySelector('#send-button'); messageInput.addEventListener('keypress', (e) => { if (e.key === 'Enter' && !e.shiftKey) { e.preventDefault(); this.sendMessage(); } else { this.startTyping(); } }); sendButton.addEventListener('click', () => { this.sendMessage(); }); } } // Initialize chat when page loads document.addEventListener('DOMContentLoaded', () => { const roomId = document.querySelector('#chat-container').dataset.roomId; const userId = document.querySelector('#chat-container').dataset.userId; new ChatApp(roomId, userId); });

How do you handle real-time notifications and live dashboards?

Create dedicated notification channels and dashboard update events with proper user targeting

// ✅ Real-time Notification System class NotificationSent implements ShouldBroadcast { public $notification; public $user; public function __construct(UserNotification $notification) { $this->notification = $notification; $this->user = $notification->user; } public function broadcastOn() { return new PrivateChannel('user-notifications.' . $this->user->id); } public function broadcastWith() { return [ 'id' => $this->notification->id, 'type' => $this->notification->type, 'title' => $this->notification->title, 'message' => $this->notification->message, 'data' => $this->notification->data, 'created_at' => $this->notification->created_at->toISOString(), 'read_at' => $this->notification->read_at, 'action_url' => $this->notification->action_url ]; } } // ✅ Live Dashboard Updates class DashboardStatsUpdated implements ShouldBroadcast { public $stats; public $organizationId; public function __construct($stats, $organizationId) { $this->stats = $stats; $this->organizationId = $organizationId; } public function broadcastOn() { return new PrivateChannel('dashboard.' . $this->organizationId); } public function broadcastWith() { return [ 'total_users' => $this->stats['total_users'], 'active_users' => $this->stats['active_users'], 'revenue' => $this->stats['revenue'], 'orders' => $this->stats['orders'], 'updated_at' => now()->toISOString() ]; } } // ✅ Service to Handle Notifications class NotificationService { public function sendNotification(User $user, $type, $title, $message, $data = []) { $notification = UserNotification::create([ 'user_id' => $user->id, 'type' => $type, 'title' => $title, 'message' => $message, 'data' => $data, 'action_url' => $data['url'] ?? null ]); // Broadcast to user's private channel broadcast(new NotificationSent($notification)); // Also send push notification if user has enabled it if ($user->push_notifications_enabled) { $this->sendPushNotification($user, $notification); } // Send email if critical if ($type === 'critical') { $user->notify(new CriticalNotificationMail($notification)); } return $notification; } public function markAsRead(UserNotification $notification) { $notification->update(['read_at' => now()]); // Broadcast update to user broadcast(new NotificationRead($notification)); } } // ✅ Frontend Notification Handler class NotificationManager { constructor(userId) { this.userId = userId; this.notifications = []; this.unreadCount = 0; this.setupEcho(); this.loadExistingNotifications(); } setupEcho() { Echo.private(`user-notifications.${this.userId}`) .listen('NotificationSent', (event) => { this.handleNewNotification(event); }) .listen('NotificationRead', (event) => { this.handleNotificationRead(event); }); } handleNewNotification(event) { // Add to notifications array this.notifications.unshift(event); this.unreadCount++; // Show toast notification this.showToast(event); // Update UI this.updateNotificationBadge(); this.updateNotificationsList(); // Play sound this.playNotificationSound(); // Show browser notification if permission granted if ('Notification' in window && Notification.permission === 'granted') { new Notification(event.title, { body: event.message, icon: '/favicon.ico' }); } } showToast(notification) { const toast = document.createElement('div'); toast.className = 'notification-toast'; toast.innerHTML = `
${notification.title}

${notification.message}
`; document.querySelector('#toast-container').appendChild(toast); // Auto remove after 5 seconds setTimeout(() => { if (toast.parentElement) { toast.remove(); } }, 5000); } markAsRead(notificationId) { axios.post(`/api/notifications/${notificationId}/read`) .then(() => { // Update local state const notification = this.notifications.find(n => n.id === notificationId); if (notification && !notification.read_at) { notification.read_at = new Date().toISOString(); this.unreadCount--; this.updateNotificationBadge(); } }); } updateNotificationBadge() { const badge = document.querySelector('#notification-badge'); if (badge) { badge.textContent = this.unreadCount; badge.style.display = this.unreadCount > 0 ? 'block' : 'none'; } } } // ✅ Dashboard Updates class DashboardManager { constructor(organizationId) { this.organizationId = organizationId; this.setupEcho(); } setupEcho() { Echo.private(`dashboard.${this.organizationId}`) .listen('DashboardStatsUpdated', (event) => { this.updateStats(event); }) .listen('OrderCreated', (event) => { this.handleNewOrder(event); }) .listen('UserRegistered', (event) => { this.handleNewUser(event); }); } updateStats(event) { // Update counter animations this.animateCounter('#total-users', event.total_users); this.animateCounter('#active-users', event.active_users); this.animateCounter('#revenue', '$' + event.revenue.toLocaleString()); this.animateCounter('#orders', event.orders); // Update charts if needed if (window.salesChart) { this.updateChart(event); } // Update last updated timestamp document.querySelector('#last-updated').textContent = 'Last updated: ' + new Date(event.updated_at).toLocaleTimeString(); } animateCounter(selector, newValue) { const element = document.querySelector(selector); const currentValue = parseInt(element.textContent.replace(/[^0-9]/g, '')); if (currentValue !== newValue) { // Simple counter animation const increment = (newValue - currentValue) / 20; let current = currentValue; const timer = setInterval(() => { current += increment; if ((increment > 0 && current >= newValue) || (increment < 0 && current <= newValue)) { current = newValue; clearInterval(timer); } element.textContent = Math.floor(current).toLocaleString(); }, 50); } } }

How do you handle WebSocket authentication and security?

Implement proper channel authorization, validate tokens, and secure sensitive data transmission

// ✅ WebSocket Authentication & Security // routes/channels.php - Secure Channel Authorization Broadcast::channel('admin-dashboard.{organizationId}', function (User $user, $organizationId) { // Multiple security checks return $user->hasRole('admin') && $user->organizations->contains($organizationId) && $user->hasPermission('view-admin-dashboard') && $user->is_active && !$user->is_suspended; }); // Time-sensitive channels Broadcast::channel('live-session.{sessionId}', function (User $user, $sessionId) { $session = LiveSession::find($sessionId); // Check if session is active and user has access return $session && $session->isActive() && $session->participants->contains($user) && $session->expires_at->isFuture(); }); // IP-restricted channels for sensitive operations Broadcast::channel('secure-operations.{userId}', function (User $user, $userId) { if ($user->id !== (int) $userId) { return false; } // Check IP whitelist for sensitive operations $allowedIps = $user->allowed_ips ?? []; $currentIp = request()->ip(); return in_array($currentIp, $allowedIps) || $user->hasRole('admin'); }); // ✅ Custom Broadcasting Authorization class BroadcastAuthController extends Controller { public function authenticate(Request $request) { // Validate the socket connection $channelName = $request->input('channel_name'); $socketId = $request->input('socket_id'); // Additional security checks if ($this->isRateLimited($request)) { abort(429, 'Too many authorization attempts'); } // Validate token if (!$this->validateAuthToken($request)) { abort(401, 'Invalid authentication token'); } // Log authorization attempts for security monitoring Log::info('WebSocket authorization attempt', [ 'user_id' => auth()->id(), 'channel' => $channelName, 'ip' => $request->ip(), 'user_agent' => $request->userAgent() ]); return Broadcast::auth($request); } private function validateAuthToken(Request $request) { $token = $request->bearerToken(); if (!$token) { return false; } // Validate JWT token or session return auth()->check() && auth()->user()->tokens()->where('token', hash('sha256', $token))->exists(); } private function isRateLimited(Request $request) { $key = 'websocket_auth:' . $request->ip(); return RateLimiter::tooManyAttempts($key, 10); // 10 attempts per minute } } // ✅ Secure Event Broadcasting class SensitiveDataUpdated implements ShouldBroadcast { public $data; public $userId; public function __construct($data, $userId) { $this->data = $data; $this->userId = $userId; } public function broadcastOn() { return new PrivateChannel('secure-data.' . $this->userId); } public function broadcastWith() { // Encrypt sensitive data before broadcasting return [ 'data' => encrypt($this->data), 'timestamp' => now()->toISOString(), 'checksum' => hash('sha256', json_encode($this->data)) ]; } // Only broadcast during business hours for sensitive data public function broadcastWhen() { $now = now(); return $now->hour >= 9 && $now->hour <= 17 && !$now->isWeekend(); } } // ✅ Frontend Security Implementation class SecureEcho { constructor() { this.token = this.getAuthToken(); this.setupSecureConnection(); this.setupHeartbeat(); } setupSecureConnection() { this.echo = new Echo({ broadcaster: 'pusher', key: import.meta.env.VITE_PUSHER_APP_KEY, cluster: import.meta.env.VITE_PUSHER_APP_CLUSTER, encrypted: true, forceTLS: true, auth: { headers: { 'Authorization': `Bearer ${this.token}`, 'X-CSRF-TOKEN': document.querySelector('meta[name="csrf-token"]').content } }, authorizer: (channel, options) => { return { authorize: (socketId, callback) => { // Custom authorization with additional security axios.post('/api/broadcasting/auth', { socket_id: socketId, channel_name: channel.name, timestamp: Date.now(), signature: this.generateSignature(socketId, channel.name) }, { headers: { 'Authorization': `Bearer ${this.token}`, 'X-Requested-With': 'XMLHttpRequest' } }) .then(response => { callback(false, response.data); }) .catch(error => { console.error('WebSocket authorization failed:', error); callback(true, error); // Handle authorization failures if (error.response?.status === 401) { this.handleAuthFailure(); } }); } }; } }); // Handle connection errors this.echo.connector.pusher.connection.bind('error', (error) => { console.error('WebSocket connection error:', error); this.handleConnectionError(error); }); // Handle disconnections this.echo.connector.pusher.connection.bind('disconnected', () => { console.warn('WebSocket disconnected'); this.scheduleReconnection(); }); } generateSignature(socketId, channelName) { const data = `${socketId}:${channelName}:${Date.now()}`; return btoa(data); // Simple signature - use proper HMAC in production } setupHeartbeat() { // Send heartbeat every 30 seconds to maintain connection setInterval(() => { if (this.echo.connector.pusher.connection.state === 'connected') { this.echo.connector.pusher.send_event('client-heartbeat', { timestamp: Date.now() }); } }, 30000); } handleAuthFailure() { // Refresh token and reconnect this.refreshAuthToken() .then((newToken) => { this.token = newToken; this.reconnect(); }) .catch(() => { // Redirect to login if token refresh fails window.location.href = '/login'; }); } async refreshAuthToken() { const response = await axios.post('/api/auth/refresh'); return response.data.token; } }

📡 Broadcasting Best Practices: • Use presence channels for collaborative features • Implement proper channel authorization • Handle connection failures gracefully • Use whisper events for lightweight interactions • Encrypt sensitive data before broadcasting • Implement rate limiting for security • Monitor WebSocket connections and performance

💡 Pro Interview Tips:
• "I use private channels for user-specific data and presence channels for collaboration" • "I implement proper authorization to secure WebSocket connections" • "I handle connection failures with automatic reconnection logic" • "I use broadcasting for real-time features like chat, notifications, and live dashboards"

🔍 Advanced Eloquent & Database

Advanced Level: Master complex queries, custom relationships, database design patterns, and performance optimization techniques.

How do you handle complex database relationships and queries?

Advanced Relationships: Polymorphic, many-to-many with pivot data, nested relationships
Complex Queries: Subqueries, joins, window functions, conditional aggregates
Performance: Eager loading, lazy loading, query optimization, indexing strategies

// ✅ Advanced Polymorphic Relationships class Comment extends Model { // Polymorphic relationship - comments can belong to posts, videos, etc. public function commentable() { return $this->morphTo(); } // User who made the comment public function user() { return $this->belongsTo(User::class); } // Nested comments (replies) public function replies() { return $this->hasMany(Comment::class, 'parent_id'); } public function parent() { return $this->belongsTo(Comment::class, 'parent_id'); } // Get all nested replies recursively public function allReplies() { return $this->replies()->with('allReplies'); } } class Post extends Model { // Polymorphic relationship public function comments() { return $this->morphMany(Comment::class, 'commentable'); } // Get only top-level comments (no replies) public function topLevelComments() { return $this->comments()->whereNull('parent_id'); } // Get comments with their nested replies public function commentsWithReplies() { return $this->topLevelComments()->with('allReplies.user'); } } // ✅ Many-to-Many with Complex Pivot Data class User extends Model { public function projects() { return $this->belongsToMany(Project::class, 'project_members') ->withPivot([ 'role', 'permissions', 'joined_at', 'invited_by', 'is_active', 'hourly_rate' ]) ->withTimestamps() ->using(ProjectMember::class); // Custom pivot model } // Filtered relationships public function activeProjects() { return $this->projects()->wherePivot('is_active', true); } public function adminProjects() { return $this->projects()->wherePivot('role', 'admin'); } } // ✅ Custom Pivot Model with Additional Logic class ProjectMember extends Pivot { protected $table = 'project_members'; protected $casts = [ 'permissions' => 'array', 'joined_at' => 'datetime', 'hourly_rate' => 'decimal:2' ]; // Access the related user public function user() { return $this->belongsTo(User::class); } // Access the related project public function project() { return $this->belongsTo(Project::class); } // Check if member has specific permission public function hasPermission($permission) { return in_array($permission, $this->permissions ?? []); } // Calculate total hours worked public function totalHoursWorked() { return TimeEntry::where('user_id', $this->user_id) ->where('project_id', $this->project_id) ->sum('hours'); } }

How do you write complex database queries with Eloquent?

Use subqueries, joins, raw expressions, and query builder methods for complex data retrieval

// ✅ Complex Queries with Subqueries class OrderRepository { public function getTopCustomersByRevenue($limit = 10) { return User::select([ 'users.id', 'users.name', 'users.email', DB::raw('SUM(orders.total) as total_revenue'), DB::raw('COUNT(orders.id) as total_orders'), DB::raw('AVG(orders.total) as average_order_value'), DB::raw('MAX(orders.created_at) as last_order_date') ]) ->join('orders', 'users.id', '=', 'orders.user_id') ->where('orders.status', 'completed') ->where('orders.created_at', '>=', now()->subYear()) ->groupBy('users.id', 'users.name', 'users.email') ->orderByDesc('total_revenue') ->limit($limit) ->get(); } public function getOrdersWithProductCount() { return Order::select([ 'orders.*', DB::raw('(SELECT COUNT(*) FROM order_items WHERE order_items.order_id = orders.id) as items_count'), DB::raw('(SELECT SUM(quantity) FROM order_items WHERE order_items.order_id = orders.id) as total_quantity') ]) ->with(['user:id,name,email', 'items.product:id,name,price']) ->get(); } public function getProductsWithSalesData() { return Product::select([ 'products.*', DB::raw('COALESCE(sales_data.total_sold, 0) as total_sold'), DB::raw('COALESCE(sales_data.revenue, 0) as revenue'), DB::raw('COALESCE(sales_data.avg_rating, 0) as avg_rating') ]) ->leftJoinSub( OrderItem::select([ 'product_id', DB::raw('SUM(quantity) as total_sold'), DB::raw('SUM(quantity * price) as revenue') ]) ->groupBy('product_id'), 'sales_data', 'products.id', '=', 'sales_data.product_id' ) ->leftJoinSub( Review::select([ 'product_id', DB::raw('AVG(rating) as avg_rating') ]) ->groupBy('product_id'), 'review_data', 'products.id', '=', 'review_data.product_id' ) ->orderByDesc('revenue') ->get(); } } // ✅ Advanced Query Scopes class Product extends Model { // Complex scope with multiple conditions public function scopeTopSelling($query, $period = 30) { return $query->select([ 'products.*', DB::raw('SUM(order_items.quantity) as total_sold') ]) ->join('order_items', 'products.id', '=', 'order_items.product_id') ->join('orders', 'order_items.order_id', '=', 'orders.id') ->where('orders.status', 'completed') ->where('orders.created_at', '>=', now()->subDays($period)) ->groupBy('products.id') ->having('total_sold', '>', 0) ->orderByDesc('total_sold'); } // Scope with conditional logic public function scopeWithInventoryStatus($query) { return $query->addSelect([ '*', DB::raw('CASE WHEN stock_quantity = 0 THEN "out_of_stock" WHEN stock_quantity <= reorder_level THEN "low_stock" WHEN stock_quantity > reorder_level * 2 THEN "overstocked" ELSE "in_stock" END as inventory_status') ]); } // Scope with window functions (MySQL 8.0+) public function scopeWithSalesRank($query) { return $query->addSelect([ '*', DB::raw('ROW_NUMBER() OVER (PARTITION BY category_id ORDER BY total_sold DESC) as category_rank'), DB::raw('DENSE_RANK() OVER (ORDER BY total_sold DESC) as overall_rank') ]); } }

How do you handle database transactions and maintain data consistency?

Use database transactions, implement proper locking strategies, and handle concurrent access scenarios

// ✅ Complex Transaction Management class OrderService { public function processOrder(array $orderData) { return DB::transaction(function () use ($orderData) { // Lock user for reading to prevent race conditions $user = User::where('id', $orderData['user_id']) ->lockForUpdate() ->first(); if (!$user) { throw new \Exception('User not found'); } // Check user's credit limit if ($user->hasCredit() && $orderData['total'] > $user->available_credit) { throw new \Exception('Insufficient credit limit'); } // Create order $order = Order::create([ 'user_id' => $user->id, 'status' => 'pending', 'total' => 0 // Will calculate below ]); $totalAmount = 0; foreach ($orderData['items'] as $item) { // Lock product for update to prevent overselling $product = Product::where('id', $item['product_id']) ->lockForUpdate() ->first(); if (!$product) { throw new \Exception("Product {$item['product_id']} not found"); } if ($product->stock_quantity < $item['quantity']) { throw new \Exception("Insufficient stock for {$product->name}"); } // Calculate item total $itemTotal = $product->price * $item['quantity']; $totalAmount += $itemTotal; // Create order item $order->items()->create([ 'product_id' => $product->id, 'quantity' => $item['quantity'], 'price' => $product->price, 'total' => $itemTotal ]); // Update product stock $product->decrement('stock_quantity', $item['quantity']); // Log inventory change InventoryLog::create([ 'product_id' => $product->id, 'type' => 'sale', 'quantity' => -$item['quantity'], 'reference_type' => 'order', 'reference_id' => $order->id, 'previous_stock' => $product->stock_quantity + $item['quantity'], 'new_stock' => $product->stock_quantity ]); } // Update order total $order->update(['total' => $totalAmount]); // Update user's credit if applicable if ($user->hasCredit()) { $user->decrement('available_credit', $totalAmount); } // Create payment record $payment = Payment::create([ 'order_id' => $order->id, 'amount' => $totalAmount, 'status' => 'pending', 'payment_method' => $orderData['payment_method'] ]); // Dispatch jobs for post-processing ProcessPayment::dispatch($payment); SendOrderConfirmation::dispatch($order); UpdateRecommendations::dispatch($user); return $order->load(['items.product', 'user', 'payment']); }, 3); // 3 attempts on deadlock } public function cancelOrder(Order $order) { return DB::transaction(function () use ($order) { if ($order->status !== 'pending') { throw new \Exception('Only pending orders can be cancelled'); } // Restore product stock foreach ($order->items as $item) { $product = Product::lockForUpdate()->find($item->product_id); $product->increment('stock_quantity', $item->quantity); // Log inventory restoration InventoryLog::create([ 'product_id' => $product->id, 'type' => 'cancellation', 'quantity' => $item->quantity, 'reference_type' => 'order', 'reference_id' => $order->id, 'previous_stock' => $product->stock_quantity - $item->quantity, 'new_stock' => $product->stock_quantity ]); } // Restore user credit if ($order->user->hasCredit()) { $order->user->increment('available_credit', $order->total); } // Update order status $order->update([ 'status' => 'cancelled', 'cancelled_at' => now(), 'cancellation_reason' => 'User requested' ]); // Cancel payment if ($order->payment) { $order->payment->update(['status' => 'cancelled']); } return $order; }); } }

How do you implement custom Eloquent collections and query builders?

Create custom collection classes and query builder methods for domain-specific operations

// ✅ Custom Eloquent Collection class ProductCollection extends Collection { public function averagePrice() { return $this->avg('price'); } public function totalValue() { return $this->sum(function ($product) { return $product->price * $product->stock_quantity; }); } public function groupByCategory() { return $this->groupBy('category.name'); } public function filterByPriceRange($min, $max) { return $this->filter(function ($product) use ($min, $max) { return $product->price >= $min && $product->price <= $max; }); } public function getOutOfStock() { return $this->filter(function ($product) { return $product->stock_quantity === 0; }); } public function getLowStock($threshold = null) { return $this->filter(function ($product) use ($threshold) { $limit = $threshold ?? $product->reorder_level ?? 10; return $product->stock_quantity <= $limit && $product->stock_quantity > 0; }); } public function calculateReorderCost() { return $this->getLowStock()->sum(function ($product) { $quantityNeeded = max($product->max_stock_level - $product->stock_quantity, 0); return $quantityNeeded * $product->cost_price; }); } } // ✅ Custom Query Builder class ProductQueryBuilder extends Builder { public function whereInStock() { return $this->where('stock_quantity', '>', 0); } public function whereOutOfStock() { return $this->where('stock_quantity', '=', 0); } public function whereLowStock() { return $this->whereRaw('stock_quantity <= reorder_level'); } public function whereCategory($category) { if (is_string($category)) { return $this->whereHas('category', function ($query) use ($category) { $query->where('name', $category); }); } return $this->where('category_id', $category); } public function wherePriceRange($min, $max) { return $this->whereBetween('price', [$min, $max]); } public function withSalesData($period = 30) { return $this->addSelect([ 'products.*', 'sales_summary.total_sold', 'sales_summary.revenue' ])->leftJoinSub( OrderItem::select([ 'product_id', DB::raw('SUM(quantity) as total_sold'), DB::raw('SUM(quantity * price) as revenue') ]) ->whereHas('order', function ($query) use ($period) { $query->where('status', 'completed') ->where('created_at', '>=', now()->subDays($period)); }) ->groupBy('product_id'), 'sales_summary', 'products.id', '=', 'sales_summary.product_id' ); } public function popularFirst($period = 30) { return $this->withSalesData($period) ->orderByDesc('sales_summary.total_sold'); } } // ✅ Product Model with Custom Collection and Builder class Product extends Model { // Use custom collection public function newCollection(array $models = []) { return new ProductCollection($models); } // Use custom query builder public function newEloquentBuilder($query) { return new ProductQueryBuilder($query); } // Custom accessor with caching public function getTotalSoldAttribute() { return Cache::remember( "product_{$this->id}_total_sold", 3600, function () { return $this->orderItems() ->whereHas('order', function ($query) { $query->where('status', 'completed'); }) ->sum('quantity'); } ); } // Custom mutator public function setPriceAttribute($value) { // Log price changes if ($this->exists && $this->price != $value) { PriceHistory::create([ 'product_id' => $this->id, 'old_price' => $this->price, 'new_price' => $value, 'changed_by' => auth()->id(), 'reason' => 'Manual update' ]); } $this->attributes['price'] = $value; } } // ✅ Usage Examples class ProductService { public function getInventoryReport() { $products = Product::with('category') ->withSalesData(30) ->get(); return [ 'total_products' => $products->count(), 'total_value' => $products->totalValue(), 'average_price' => $products->averagePrice(), 'out_of_stock' => $products->getOutOfStock()->count(), 'low_stock' => $products->getLowStock()->count(), 'reorder_cost' => $products->calculateReorderCost(), 'by_category' => $products->groupByCategory()->map(function ($categoryProducts) { return [ 'count' => $categoryProducts->count(), 'total_value' => $categoryProducts->totalValue(), 'average_price' => $categoryProducts->averagePrice() ]; }) ]; } public function getPopularProducts($category = null, $limit = 10) { $query = Product::popularFirst(30); if ($category) { $query->whereCategory($category); } return $query->limit($limit)->get(); } }

How do you implement database-level constraints and triggers?

Use migrations to create constraints, indexes, and triggers for data integrity and business rules

// ✅ Advanced Migration with Constraints and Triggers class CreateAdvancedOrdersTable extends Migration { public function up() { Schema::create('orders', function (Blueprint $table) { $table->id(); $table->foreignId('user_id')->constrained()->onDelete('cascade'); $table->string('order_number')->unique(); $table->enum('status', ['pending', 'processing', 'shipped', 'delivered', 'cancelled']) ->default('pending'); $table->decimal('subtotal', 10, 2); $table->decimal('tax_amount', 10, 2); $table->decimal('shipping_cost', 10, 2)->default(0); $table->decimal('discount_amount', 10, 2)->default(0); $table->decimal('total', 10, 2); $table->json('metadata')->nullable(); $table->timestamp('shipped_at')->nullable(); $table->timestamp('delivered_at')->nullable(); $table->timestamps(); // Indexes for performance $table->index(['user_id', 'status']); $table->index(['status', 'created_at']); $table->index('order_number'); // Check constraints for business rules $table->check('subtotal >= 0', 'positive_subtotal'); $table->check('tax_amount >= 0', 'positive_tax'); $table->check('shipping_cost >= 0', 'positive_shipping'); $table->check('total >= 0', 'positive_total'); $table->check('total = subtotal + tax_amount + shipping_cost - discount_amount', 'correct_total'); }); // Add database triggers for business logic DB::unprepared(' CREATE TRIGGER update_order_total BEFORE UPDATE ON orders FOR EACH ROW BEGIN IF NEW.subtotal IS NOT NULL AND NEW.tax_amount IS NOT NULL AND NEW.shipping_cost IS NOT NULL AND NEW.discount_amount IS NOT NULL THEN SET NEW.total = NEW.subtotal + NEW.tax_amount + NEW.shipping_cost - NEW.discount_amount; END IF; END '); // Trigger to update timestamps DB::unprepared(' CREATE TRIGGER update_order_status_timestamps BEFORE UPDATE ON orders FOR EACH ROW BEGIN IF OLD.status != NEW.status THEN IF NEW.status = "shipped" AND OLD.status != "shipped" THEN SET NEW.shipped_at = NOW(); END IF; IF NEW.status = "delivered" AND OLD.status != "delivered" THEN SET NEW.delivered_at = NOW(); END IF; END IF; END '); } public function down() { DB::unprepared('DROP TRIGGER IF EXISTS update_order_total'); DB::unprepared('DROP TRIGGER IF EXISTS update_order_status_timestamps'); Schema::dropIfExists('orders'); } } // ✅ Advanced Indexes Migration class AddAdvancedIndexesToProductsTable extends Migration { public function up() { Schema::table('products', function (Blueprint $table) { // Composite index for common query patterns $table->index(['category_id', 'is_active', 'price'], 'idx_category_active_price'); // Partial index (MySQL 8.0+) - only index active products DB::statement('CREATE INDEX idx_active_products_name ON products (name) WHERE is_active = 1'); // Full-text index for search DB::statement('CREATE FULLTEXT INDEX idx_product_search ON products (name, description)'); // Index for JSON column (MySQL 5.7+) DB::statement('CREATE INDEX idx_product_attributes ON products ((CAST(attributes->"$.color" AS CHAR(50))))'); }); // Create materialized view for reporting (PostgreSQL style) DB::statement(' CREATE VIEW product_sales_summary AS SELECT p.id, p.name, p.category_id, COALESCE(SUM(oi.quantity), 0) as total_sold, COALESCE(SUM(oi.quantity * oi.price), 0) as total_revenue, COUNT(DISTINCT o.id) as order_count, AVG(r.rating) as avg_rating FROM products p LEFT JOIN order_items oi ON p.id = oi.product_id LEFT JOIN orders o ON oi.order_id = o.id AND o.status = "completed" LEFT JOIN reviews r ON p.id = r.product_id GROUP BY p.id, p.name, p.category_id '); } public function down() { DB::statement('DROP VIEW IF EXISTS product_sales_summary'); DB::statement('DROP INDEX IF EXISTS idx_product_attributes ON products'); DB::statement('DROP INDEX IF EXISTS idx_product_search ON products'); DB::statement('DROP INDEX IF EXISTS idx_active_products_name ON products'); Schema::table('products', function (Blueprint $table) { $table->dropIndex('idx_category_active_price'); }); } } // ✅ Using Database Functions and Procedures class DatabaseFunctionsHelper { public static function createStoredProcedures() { // Stored procedure for complex business logic DB::unprepared(' CREATE PROCEDURE UpdateProductStock( IN product_id INT, IN quantity_change INT, IN operation_type VARCHAR(50), IN reference_id INT ) BEGIN DECLARE current_stock INT; DECLARE new_stock INT; START TRANSACTION; SELECT stock_quantity INTO current_stock FROM products WHERE id = product_id FOR UPDATE; SET new_stock = current_stock + quantity_change; IF new_stock < 0 THEN SIGNAL SQLSTATE "45000" SET MESSAGE_TEXT = "Insufficient stock"; END IF; UPDATE products SET stock_quantity = new_stock, updated_at = NOW() WHERE id = product_id; INSERT INTO inventory_logs ( product_id, operation_type, quantity_change, previous_stock, new_stock, reference_id, created_at ) VALUES ( product_id, operation_type, quantity_change, current_stock, new_stock, reference_id, NOW() ); COMMIT; END '); // Function for calculating distance (useful for shipping) DB::unprepared(' CREATE FUNCTION CalculateDistance( lat1 DECIMAL(10,8), lng1 DECIMAL(11,8), lat2 DECIMAL(10,8), lng2 DECIMAL(11,8) ) RETURNS DECIMAL(10,2) READS SQL DATA DETERMINISTIC BEGIN DECLARE distance DECIMAL(10,2); SET distance = ( 6371 * ACOS( COS(RADIANS(lat1)) * COS(RADIANS(lat2)) * COS(RADIANS(lng2) - RADIANS(lng1)) + SIN(RADIANS(lat1)) * SIN(RADIANS(lat2)) ) ); RETURN distance; END '); } public static function useStoredProcedure($productId, $quantityChange, $operationType, $referenceId) { try { DB::statement('CALL UpdateProductStock(?, ?, ?, ?)', [ $productId, $quantityChange, $operationType, $referenceId ]); return true; } catch (\Exception $e) { Log::error('Stock update failed: ' . $e->getMessage()); return false; } } }

🔍 Advanced Eloquent Best Practices: • Use custom collections for domain-specific operations • Implement proper database constraints and triggers • Use transactions for complex operations • Optimize queries with proper indexing • Cache expensive calculations and queries • Use database functions for complex calculations • Implement proper locking for concurrent operations

💡 Pro Interview Tips:
• "I use database transactions with proper locking to prevent race conditions" • "I implement custom Eloquent collections for domain-specific operations" • "I optimize complex queries with strategic indexing and subqueries" • "I use database constraints and triggers for data integrity"

🏗️ Domain-Driven Design (DDD)

Think of DDD as: Designing software the same way architects design buildings - start with understanding the business domain, then create a model that reflects real-world business concepts and rules.

Q: What is Domain-Driven Design and why use it in Laravel?

Definition: An approach to software development that focuses on modeling the business domain
Core Idea: Your code structure should mirror your business domain, not your database schema
Benefits: Better communication with business stakeholders, cleaner code organization, reduced complexity
Laravel Context: Structure your app around business concepts, not just MVC patterns

Q: What are the key DDD building blocks in Laravel?

Entities: Business objects with identity (User, Order, Product)
Value Objects: Immutable objects that describe things (Money, Email, Address)
Aggregates: Cluster of related entities with consistency boundaries
Services: Business logic that doesn't belong to entities
Repositories: Abstract data access layer
Domain Events: Something significant that happened in the business

Q: How do you structure a Laravel app using DDD principles?

Folder Structure: Organize by domain, not by technical layers
Example: app/Domain/User, app/Domain/Billing, app/Domain/Inventory
Separate Concerns: Domain logic separate from infrastructure (databases, APIs)
Use Cases: Application services that orchestrate domain operations

// ❌ Traditional Laravel Structure (Technical Focus) app/ ├── Http/Controllers/ ├── Models/ ├── Services/ └── Repositories/ // ✅ DDD Laravel Structure (Domain Focus) app/ ├── Domain/ │ ├── User/ │ │ ├── Entities/User.php │ │ ├── ValueObjects/Email.php │ │ ├── Services/UserRegistrationService.php │ │ ├── Events/UserRegistered.php │ │ └── Repositories/UserRepositoryInterface.php │ ├── Billing/ │ │ ├── Entities/Invoice.php │ │ ├── ValueObjects/Money.php │ │ └── Services/PaymentService.php │ └── Inventory/ │ ├── Entities/Product.php │ └── Services/StockService.php ├── Infrastructure/ │ ├── Repositories/EloquentUserRepository.php │ └── External/StripePaymentGateway.php └── Application/ ├── UseCases/RegisterUserUseCase.php └── Http/Controllers/

Q: How do you implement Value Objects in Laravel?

Purpose: Encapsulate and validate business concepts
Characteristics: Immutable, no identity, compared by value
Examples: Money, Email, PhoneNumber, Address
Laravel Implementation: Use PHP 8 readonly classes or custom validation

// ✅ Value Object Example - Money class Money { public function __construct( public readonly int $amount, // Store in cents public readonly string $currency ) { if ($amount < 0) { throw new InvalidArgumentException('Amount cannot be negative'); } if (!in_array($currency, ['USD', 'EUR', 'GBP'])) { throw new InvalidArgumentException('Invalid currency'); } } public function add(Money $other): Money { if ($this->currency !== $other->currency) { throw new InvalidArgumentException('Currency mismatch'); } return new Money($this->amount + $other->amount, $this->currency); } public function toDecimal(): float { return $this->amount / 100; } public function equals(Money $other): bool { return $this->amount === $other->amount && $this->currency === $other->currency; } } // ✅ Usage in Domain Entity class Product { public function __construct( public ProductId $id, public string $name, public Money $price ) {} public function applyDiscount(float $percentage): void { $discountAmount = (int) ($this->price->amount * $percentage / 100); $this->price = new Money( $this->price->amount - $discountAmount, $this->price->currency ); } }

Q: How do you implement Domain Events in Laravel?

Purpose: Decouple domain logic from side effects
Pattern: Domain entities raise events, listeners handle consequences
Laravel Integration: Use Laravel's event system with domain-focused events
Benefits: Clean separation, easier testing, flexible workflows

// ✅ Domain Event class UserRegistered { public function __construct( public readonly UserId $userId, public readonly Email $email, public readonly DateTime $occurredAt ) {} } // ✅ Domain Entity with Events class User { private array $domainEvents = []; public function __construct( public UserId $id, public Email $email, public HashedPassword $password ) {} public static function register(Email $email, string $plainPassword): self { $user = new self( UserId::generate(), $email, HashedPassword::fromPlain($plainPassword) ); // Raise domain event $user->raise(new UserRegistered($user->id, $user->email, new DateTime())); return $user; } private function raise(object $event): void { $this->domainEvents[] = $event; } public function releaseEvents(): array { $events = $this->domainEvents; $this->domainEvents = []; return $events; } } // ✅ Use Case (Application Layer) class RegisterUserUseCase { public function __construct( private UserRepositoryInterface $userRepository, private EventDispatcher $eventDispatcher ) {} public function execute(string $email, string $password): void { $user = User::register(new Email($email), $password); $this->userRepository->save($user); // Dispatch domain events foreach ($user->releaseEvents() as $event) { $this->eventDispatcher->dispatch($event); } } }

Q: How do you implement Repositories with DDD in Laravel?

Purpose: Abstract data access from domain logic
Pattern: Domain defines interface, infrastructure provides implementation
Benefit: Testable domain logic, swappable data sources
Laravel Implementation: Interface in domain, Eloquent implementation in infrastructure

// ✅ Domain Repository Interface interface UserRepositoryInterface { public function findById(UserId $id): ?User; public function findByEmail(Email $email): ?User; public function save(User $user): void; public function delete(User $user): void; public function existsByEmail(Email $email): bool; } // ✅ Infrastructure Implementation class EloquentUserRepository implements UserRepositoryInterface { public function findById(UserId $id): ?User { $userData = EloquentUser::find($id->value()); return $userData ? $this->toDomainEntity($userData) : null; } public function save(User $user): void { EloquentUser::updateOrCreate( ['id' => $user->id->value()], [ 'email' => $user->email->value(), 'password' => $user->password->value(), 'created_at' => $user->createdAt, ] ); } private function toDomainEntity(EloquentUser $eloquentUser): User { return new User( new UserId($eloquentUser->id), new Email($eloquentUser->email), new HashedPassword($eloquentUser->password) ); } }

Q: What are Aggregates and how do you use them in Laravel?

Definition: A cluster of related entities treated as a single unit
Rules: Only access aggregate internals through the root entity
Consistency: Maintain business rules within aggregate boundaries
Example: Order (root) contains OrderItems, manages total calculation and validation

// ✅ Order Aggregate Root class Order { private array $items = []; public function __construct( public OrderId $id, public CustomerId $customerId, public OrderStatus $status ) {} public function addItem(ProductId $productId, Money $price, int $quantity): void { // Business rule: can't modify confirmed orders if ($this->status->isConfirmed()) { throw new OrderAlreadyConfirmedException(); } // Business rule: maximum 10 items per order if (count($this->items) >= 10) { throw new TooManyItemsException(); } $this->items[] = new OrderItem($productId, $price, $quantity); } public function calculateTotal(): Money { $total = new Money(0, 'USD'); foreach ($this->items as $item) { $total = $total->add($item->getSubtotal()); } return $total; } public function confirm(): void { // Business rule: need at least one item if (empty($this->items)) { throw new EmptyOrderException(); } $this->status = OrderStatus::confirmed(); // Raise domain event $this->raise(new OrderConfirmed($this->id, $this->calculateTotal())); } }

🏗️ DDD Best Practices in Laravel:
• Keep domain logic pure - no Laravel dependencies in domain layer
• Use value objects for business concepts (Money, Email, etc.)
• Implement aggregates to maintain business invariants
• Use domain events for decoupling and side effects
• Repository pattern for data access abstraction
• Separate application services from domain services
• Use ubiquitous language - same terms in code and business

💡 Pro Interview Tips:
• "I use DDD to align code structure with business domain"
• "I implement value objects to encapsulate business rules and validation"
• "I use aggregates to maintain consistency boundaries and business invariants"
• "I separate domain logic from infrastructure concerns for better testability"

🔗 Microservices Architecture

Think of Microservices as: Breaking a large monolithic application into smaller, independent services that can be developed, deployed, and scaled separately - like having specialized teams for different parts of a business.

Q: What are Microservices and when should you use them in Laravel?

Definition: Architectural pattern where applications are built as loosely coupled, independently deployable services
Laravel Context: Split monolithic Laravel apps into smaller Laravel apps or services
When to Use: Large teams, complex domains, different scaling requirements, independent deployment needs
Trade-offs: Increased complexity vs. improved scalability and team autonomy

Q: How do you decompose a Laravel monolith into microservices?

Domain Boundaries: Split by business capabilities (User Service, Order Service, Payment Service)
Data Separation: Each service owns its database schema
API Communication: RESTful APIs or event-driven messaging between services
Gradual Migration: Strangler Fig pattern - gradually extract services from monolith

Q: How do microservices communicate in a Laravel ecosystem?

Synchronous: HTTP APIs using Guzzle HTTP client
Asynchronous: Message queues (Redis, RabbitMQ, SQS) with Laravel Queues
Event Streaming: Apache Kafka or Laravel Events for real-time communication
Service Discovery: Consul, Eureka, or load balancer configuration

// ✅ Laravel Service Communication Example // User Service API Client class UserServiceClient { public function __construct(private Client $httpClient) {} public function getUserById(int $userId): ?array { try { $response = $this->httpClient->get("/api/users/{$userId}", [ 'timeout' => 5, 'headers' => [ 'Authorization' => 'Bearer ' . config('services.user_service.token'), 'Accept' => 'application/json', ] ]); return json_decode($response->getBody(), true); } catch (RequestException $e) { // Implement circuit breaker pattern Log::error('User service unavailable', ['error' => $e->getMessage()]); return null; // Graceful degradation } } } // ✅ Event-Driven Communication class OrderCreated implements ShouldQueue { public function __construct( public int $orderId, public int $userId, public float $total, public array $items ) {} } // Order Service publishes event class OrderService { public function createOrder(array $orderData): Order { $order = Order::create($orderData); // Publish event for other services event(new OrderCreated( $order->id, $order->user_id, $order->total, $order->items->toArray() )); return $order; } }

Q: How do you handle data consistency across microservices?

Eventual Consistency: Accept that data will be consistent "eventually" rather than immediately
Saga Pattern: Coordinate transactions across services using compensating actions
Event Sourcing: Store events instead of current state, replay events for consistency
CQRS: Separate read and write models for better performance and consistency

// ✅ Saga Pattern Implementation class OrderSaga { public function handle(OrderCreated $event): void { DB::beginTransaction(); try { // Step 1: Reserve inventory $reservationId = $this->inventoryService->reserveItems($event->items); // Step 2: Process payment $paymentId = $this->paymentService->processPayment( $event->userId, $event->total ); // Step 3: Confirm order $this->orderService->confirmOrder($event->orderId); DB::commit(); } catch (Exception $e) { DB::rollBack(); // Compensating actions if (isset($reservationId)) { $this->inventoryService->releaseReservation($reservationId); } if (isset($paymentId)) { $this->paymentService->refundPayment($paymentId); } $this->orderService->cancelOrder($event->orderId); throw $e; } } } // ✅ Event Sourcing Example class EventStore { public function store(DomainEvent $event): void { Event::create([ 'aggregate_id' => $event->aggregateId, 'event_type' => get_class($event), 'event_data' => json_encode($event->toArray()), 'version' => $this->getNextVersion($event->aggregateId), 'occurred_at' => now() ]); } public function getEventsForAggregate(string $aggregateId): Collection { return Event::where('aggregate_id', $aggregateId) ->orderBy('version') ->get() ->map(fn($event) => $this->deserializeEvent($event)); } }

Q: How do you implement API Gateway pattern with Laravel?

Purpose: Single entry point for client requests, routes to appropriate microservices
Responsibilities: Authentication, rate limiting, request routing, response aggregation
Laravel Implementation: Dedicated Laravel app as gateway or use tools like Kong, Zuul
Benefits: Simplified client communication, centralized cross-cutting concerns

// ✅ Laravel API Gateway Implementation class ApiGatewayController extends Controller { public function __construct( private UserServiceClient $userService, private OrderServiceClient $orderService, private InventoryServiceClient $inventoryService ) {} public function getUserDashboard(int $userId): JsonResponse { // Aggregate data from multiple services $user = $this->userService->getUserById($userId); $orders = $this->orderService->getUserOrders($userId); $recommendations = $this->inventoryService->getRecommendations($userId); return response()->json([ 'user' => $user, 'recent_orders' => $orders, 'recommendations' => $recommendations ]); } public function createOrder(CreateOrderRequest $request): JsonResponse { // Coordinate multiple services $validation = $this->inventoryService->validateItems($request->items); if (!$validation['valid']) { return response()->json(['error' => 'Invalid items'], 400); } $order = $this->orderService->createOrder([ 'user_id' => $request->user_id, 'items' => $request->items, 'total' => $validation['total'] ]); return response()->json($order, 201); } } // ✅ Circuit Breaker Pattern class CircuitBreaker { private int $failureCount = 0; private int $threshold = 5; private int $timeout = 60; // seconds public function call(callable $service) { if ($this->isOpen()) { throw new ServiceUnavailableException(); } try { $result = $service(); $this->reset(); return $result; } catch (Exception $e) { $this->recordFailure(); throw $e; } } private function isOpen(): bool { return $this->failureCount >= $this->threshold; } }

Q: How do you handle authentication and authorization in microservices?

JWT Tokens: Stateless authentication tokens passed between services
OAuth 2.0: Centralized authorization server (Laravel Passport)
Service Mesh: Istio or Linkerd for service-to-service authentication
API Keys: Service-to-service communication with rotating keys

// ✅ JWT Authentication Middleware class JwtAuthenticationMiddleware { public function handle(Request $request, Closure $next) { $token = $request->bearerToken(); if (!$token) { return response()->json(['error' => 'Token required'], 401); } try { $payload = JWT::decode($token, config('jwt.secret'), ['HS256']); // Add user context to request $request->merge(['user_id' => $payload->sub]); return $next($request); } catch (Exception $e) { return response()->json(['error' => 'Invalid token'], 401); } } } // ✅ Service-to-Service Authentication class ServiceAuthMiddleware { public function handle(Request $request, Closure $next) { $serviceToken = $request->header('X-Service-Token'); $serviceName = $request->header('X-Service-Name'); if (!$this->validateServiceToken($serviceName, $serviceToken)) { return response()->json(['error' => 'Unauthorized service'], 403); } return $next($request); } private function validateServiceToken(string $service, string $token): bool { $validToken = config("services.{$service}.token"); return hash_equals($validToken, $token); } }

Q: How do you monitor and debug microservices in Laravel?

Distributed Tracing: Jaeger or Zipkin to trace requests across services
Centralized Logging: ELK Stack (Elasticsearch, Logstash, Kibana) or Fluentd
Metrics: Prometheus + Grafana for service metrics and health checks
Laravel Tools: Telescope for development, Horizon for queue monitoring

// ✅ Distributed Tracing Implementation class DistributedTracingMiddleware { public function handle(Request $request, Closure $next) { $traceId = $request->header('X-Trace-ID') ?? Str::uuid(); $spanId = Str::uuid(); // Add trace context to logs Log::withContext([ 'trace_id' => $traceId, 'span_id' => $spanId, 'service' => config('app.name') ]); // Add headers for downstream services $request->headers->set('X-Trace-ID', $traceId); $request->headers->set('X-Parent-Span-ID', $spanId); return $next($request); } } // ✅ Health Check Endpoint class HealthController extends Controller { public function check(): JsonResponse { $checks = [ 'database' => $this->checkDatabase(), 'redis' => $this->checkRedis(), 'external_services' => $this->checkExternalServices() ]; $healthy = collect($checks)->every(fn($check) => $check['status'] === 'ok'); return response()->json([ 'status' => $healthy ? 'healthy' : 'unhealthy', 'checks' => $checks, 'timestamp' => now()->toISOString() ], $healthy ? 200 : 503); } private function checkDatabase(): array { try { DB::select('SELECT 1'); return ['status' => 'ok']; } catch (Exception $e) { return ['status' => 'error', 'message' => $e->getMessage()]; } } }

🔗 Microservices Best Practices:
• Design services around business capabilities, not technical layers
• Implement proper service contracts and API versioning
• Use asynchronous communication for non-critical operations
• Implement circuit breaker pattern for resilience
• Maintain service independence - avoid shared databases
• Use distributed tracing for debugging across services
• Implement proper monitoring and health checks
• Consider eventual consistency over strict consistency

💡 Pro Interview Tips:
• "I use microservices for complex domains where team autonomy and independent scaling are important"
• "I implement saga patterns for distributed transactions and eventual consistency"
• "I use API gateways for client simplification and cross-cutting concerns"
• "I implement proper monitoring with distributed tracing and centralized logging"

🌟 Laravel Ecosystem (Nova, Horizon, Telescope)

Think of Laravel Ecosystem as: A collection of powerful tools that extend Laravel's capabilities - like having specialized instruments in a toolbox that make complex tasks easier and provide better insights into your application.

Q: What is Laravel Nova and when should you use it?

Definition: A beautifully-designed administration panel for Laravel applications
Purpose: Rapid development of admin interfaces with minimal code
Use Cases: Content management, user administration, business analytics, data visualization
Benefits: Built-in CRUD operations, filters, metrics, custom actions, and authorization

Q: How do you create and customize Nova resources?

Resource Creation: Maps Eloquent models to Nova dashboard interfaces
Field Types: Text, BelongsTo, HasMany, Image, Boolean, Select, etc.
Customization: Custom fields, computed fields, resource policies
Advanced Features: Lenses, metrics, actions, and filters

// ✅ Nova Resource Example class User extends Resource { public static $model = \App\Models\User::class; public static $title = 'name'; public static $search = ['id', 'name', 'email']; public function fields(Request $request) { return [ ID::make()->sortable(), Text::make('Name') ->sortable() ->rules('required', 'max:255'), Text::make('Email') ->sortable() ->rules('required', 'email', 'max:254') ->creationRules('unique:users,email') ->updateRules('unique:users,email,{{resourceId}}'), Password::make('Password') ->onlyOnForms() ->creationRules('required', 'string', 'min:8') ->updateRules('nullable', 'string', 'min:8'), DateTime::make('Email Verified At')->exceptOnForms(), BelongsToMany::make('Roles'), HasMany::make('Posts'), // Custom computed field Text::make('Posts Count', function () { return $this->posts()->count(); })->onlyOnIndex(), // Custom field with complex logic Boolean::make('Is Premium', function () { return $this->subscription && $this->subscription->active(); })->onlyOnIndex(), ]; } public function actions(Request $request) { return [ new Actions\SendWelcomeEmail, new Actions\ResetPassword, ]; } public function filters(Request $request) { return [ new Filters\UserRole, new Filters\AccountType, ]; } } // ✅ Custom Nova Action class SendWelcomeEmail extends Action { public function handle(ActionFields $fields, Collection $models) { foreach ($models as $user) { Mail::to($user)->queue(new WelcomeEmail($user)); } return Action::message('Welcome emails queued successfully!'); } }

Q: What is Laravel Horizon and how does it work?

Definition: Beautiful dashboard and configuration system for Laravel Redis queues
Features: Real-time monitoring, job metrics, failed job management, auto-scaling
Benefits: Visual queue monitoring, performance insights, queue balancing
Production Use: Essential for applications with heavy background job processing

// ✅ Horizon Configuration // config/horizon.php return [ 'environments' => [ 'production' => [ 'supervisor-1' => [ 'connection' => 'redis', 'queue' => ['high', 'default', 'low'], 'balance' => 'auto', 'processes' => 10, 'tries' => 3, 'timeout' => 300, ], ], 'local' => [ 'supervisor-1' => [ 'connection' => 'redis', 'queue' => ['default'], 'balance' => 'simple', 'processes' => 3, 'tries' => 3, 'timeout' => 60, ], ], ], 'waits' => [ 'redis:default' => 60, 'redis:high' => 15, 'redis:low' => 300, ], 'trim' => [ 'recent' => 60, // Keep recent jobs for 1 hour 'pending' => 60, // Keep pending jobs for 1 hour 'completed' => 60, // Keep completed jobs for 1 hour 'failed' => 10080, // Keep failed jobs for 1 week ], ]; // ✅ Queue Job with Horizon Tags class ProcessPayment implements ShouldQueue { use Dispatchable, InteractsWithQueue, Queueable, SerializesModels; public function __construct( private Order $order, private PaymentMethod $paymentMethod ) {} public function handle(PaymentService $paymentService): void { $paymentService->processPayment($this->order, $this->paymentMethod); } // Add tags for Horizon monitoring public function tags(): array { return [ 'order:' . $this->order->id, 'user:' . $this->order->user_id, 'payment:' . $this->paymentMethod->type, ]; } // Handle job failure public function failed(Exception $exception): void { Log::error('Payment processing failed', [ 'order_id' => $this->order->id, 'error' => $exception->getMessage(), ]); // Notify customer of payment failure $this->order->user->notify(new PaymentFailedNotification($this->order)); } }

Q: What is Laravel Telescope and how does it help with debugging?

Definition: Elegant debug assistant that provides insight into requests, exceptions, logs, and more
Features: Request monitoring, query logging, exception tracking, performance profiling
Watchers: Track requests, queries, jobs, mail, cache, events, and custom activities
Benefits: Real-time application debugging and performance analysis

// ✅ Telescope Configuration // config/telescope.php return [ 'enabled' => env('TELESCOPE_ENABLED', true), 'driver' => env('TELESCOPE_DRIVER', 'database'), 'storage' => [ 'database' => [ 'connection' => env('DB_CONNECTION', 'mysql'), 'chunk' => 1000, ], ], 'watchers' => [ Watchers\CacheWatcher::class => [ 'enabled' => env('TELESCOPE_CACHE_WATCHER', true), ], Watchers\CommandWatcher::class => [ 'enabled' => env('TELESCOPE_COMMAND_WATCHER', true), 'ignore' => ['schedule:run'], ], Watchers\DumpWatcher::class => [ 'enabled' => env('TELESCOPE_DUMP_WATCHER', true), 'always' => env('TELESCOPE_DUMP_WATCHER_ALWAYS', false), ], Watchers\EventWatcher::class => [ 'enabled' => env('TELESCOPE_EVENT_WATCHER', true), 'ignore' => [], ], Watchers\ExceptionWatcher::class => [ 'enabled' => env('TELESCOPE_EXCEPTION_WATCHER', true), ], Watchers\JobWatcher::class => [ 'enabled' => env('TELESCOPE_JOB_WATCHER', true), ], Watchers\LogWatcher::class => [ 'enabled' => env('TELESCOPE_LOG_WATCHER', true), 'level' => 'error', ], Watchers\MailWatcher::class => [ 'enabled' => env('TELESCOPE_MAIL_WATCHER', true), ], Watchers\ModelWatcher::class => [ 'enabled' => env('TELESCOPE_MODEL_WATCHER', true), 'hydrations' => true, ], Watchers\NotificationWatcher::class => [ 'enabled' => env('TELESCOPE_NOTIFICATION_WATCHER', true), ], Watchers\QueryWatcher::class => [ 'enabled' => env('TELESCOPE_QUERY_WATCHER', true), 'slow' => 100, // Log queries slower than 100ms 'location' => true, 'ignore_packages' => true, ], Watchers\RedisWatcher::class => [ 'enabled' => env('TELESCOPE_REDIS_WATCHER', true), ], Watchers\RequestWatcher::class => [ 'enabled' => env('TELESCOPE_REQUEST_WATCHER', true), 'size_limit' => 64, ], Watchers\GateWatcher::class => [ 'enabled' => env('TELESCOPE_GATE_WATCHER', true), ], Watchers\ScheduleWatcher::class => [ 'enabled' => env('TELESCOPE_SCHEDULE_WATCHER', true), ], Watchers\ViewWatcher::class => [ 'enabled' => env('TELESCOPE_VIEW_WATCHER', true), ], ], ]; // ✅ Custom Telescope Watcher class CustomBusinessLogicWatcher extends Watcher { public function register($app) { $app['events']->listen( OrderProcessed::class, [$this, 'recordOrderProcessed'] ); } public function recordOrderProcessed(OrderProcessed $event) { if (!$this->shouldRecord($event)) { return; } IncomingEntry::make([ 'type' => 'order', 'family_hash' => $event->order->id, 'content' => [ 'order_id' => $event->order->id, 'user_id' => $event->order->user_id, 'total' => $event->order->total, 'processing_time' => $event->processingTime, 'status' => $event->order->status, ], ])->tags([ 'order:' . $event->order->id, 'user:' . $event->order->user_id, ]); } }

Q: How do you optimize and secure these Laravel tools for production?

Nova Security: Restrict access with authorization policies and custom guards
Horizon Monitoring: Set up proper Redis monitoring and alerting for queue failures
Telescope Production: Disable in production or use sampling and authentication
Performance: Configure proper caching, database connections, and resource limits

// ✅ Production Security Configuration // NovaServiceProvider authorization class NovaServiceProvider extends NovaApplicationServiceProvider { protected function gate() { Gate::define('viewNova', function ($user) { return in_array($user->email, [ 'admin@example.com', ]) || $user->hasRole('admin'); }); } protected function routes() { Nova::routes() ->withAuthenticationRoutes() ->withPasswordResetRoutes() ->register(); } } // ✅ Horizon Production Configuration // config/horizon.php - Production environment 'environments' => [ 'production' => [ 'supervisor-1' => [ 'connection' => 'redis', 'queue' => ['high', 'default', 'low'], 'balance' => 'auto', 'processes' => 20, 'tries' => 3, 'timeout' => 300, 'memory' => 512, 'nice' => 10, ], ], ], // ✅ Telescope Production Safety // config/telescope.php 'enabled' => env('TELESCOPE_ENABLED', false), // Disabled by default // Only enable for specific environments 'enabled' => env('APP_ENV') === 'local' || auth()->user()?->isAdmin(), // Use sampling in production 'sampling' => [ 'requests' => env('TELESCOPE_SAMPLING_REQUESTS', 100), // 1% sampling ], // Telescope authorization class TelescopeServiceProvider extends TelescopeApplicationServiceProvider { protected function gate() { Gate::define('viewTelescope', function ($user) { return $user->hasRole('developer') || $user->hasRole('admin'); }); } } // ✅ Queue Monitoring and Alerting class QueueHealthCommand extends Command { protected $signature = 'queue:health'; public function handle() { $failedJobs = DB::table('failed_jobs') ->where('failed_at', '>', now()->subHour()) ->count(); $queueSize = Redis::llen('queues:default'); if ($failedJobs > 10 || $queueSize > 1000) { // Send alert to monitoring system $this->sendAlert([ 'failed_jobs' => $failedJobs, 'queue_size' => $queueSize, 'timestamp' => now()->toISOString() ]); } } }

🌟 Laravel Ecosystem Best Practices:
• Use Nova for rapid admin panel development with proper authorization
• Monitor queues with Horizon and set up alerts for failures
• Use Telescope for development debugging, disable or sample in production
• Implement proper authentication and authorization for all tools
• Configure appropriate resource limits and monitoring
• Use tags and metadata for better job tracking and debugging
• Set up proper backup and recovery procedures for queue data

💡 Pro Interview Tips:
• "I use Nova for rapid admin development with custom authorization policies"
• "I monitor queue performance with Horizon and implement proper failure handling"
• "I use Telescope for debugging in development but disable it in production for security"
• "I implement proper queue scaling and monitoring with Redis and supervisord"

⚡ Frontend Integration (Inertia.js, Livewire)

Think of Frontend Integration as: Building bridges between your Laravel backend and modern frontend experiences - like having interpreters that help different languages communicate seamlessly.

Q: What is Inertia.js and how does it work with Laravel?

Definition: A modern approach to building single-page apps using classic server-side routing
Concept: No API needed - render pages server-side but navigate client-side
Benefits: SEO-friendly, faster development, leverages existing Laravel skills
Supported Frontends: Vue.js, React, Svelte

Q: How do you set up and use Inertia.js in Laravel?

Setup: Install Inertia server-side and client-side adapters
Controllers: Return Inertia responses instead of views
Pages: Frontend components receive data as props
Navigation: Client-side routing with server-side rendering fallback

// ✅ Inertia Controller Setup class UserController extends Controller { public function index(Request $request) { return Inertia::render('Users/Index', [ 'users' => User::query() ->when($request->search, fn($query, $search) => $query->where('name', 'like', "%{$search}%")) ->paginate(10) ->withQueryString() ->through(fn($user) => [ 'id' => $user->id, 'name' => $user->name, 'email' => $user->email, 'role' => $user->role, 'created_at' => $user->created_at->format('M d, Y'), ]), 'filters' => $request->only(['search']), ]); } public function create() { return Inertia::render('Users/Create', [ 'roles' => Role::all()->map(fn($role) => [ 'value' => $role->id, 'label' => $role->name, ]), ]); } public function store(StoreUserRequest $request) { $user = User::create($request->validated()); return redirect()->route('users.index') ->with('success', 'User created successfully.'); } public function edit(User $user) { return Inertia::render('Users/Edit', [ 'user' => [ 'id' => $user->id, 'name' => $user->name, 'email' => $user->email, 'role_id' => $user->role_id, ], 'roles' => Role::all()->map(fn($role) => [ 'value' => $role->id, 'label' => $role->name, ]), ]); } } // ✅ Inertia Middleware for Flash Messages class HandleInertiaRequests extends Middleware { public function share(Request $request): array { return array_merge(parent::share($request), [ 'auth' => [ 'user' => $request->user() ? [ 'id' => $request->user()->id, 'name' => $request->user()->name, 'email' => $request->user()->email, 'role' => $request->user()->role, ] : null, ], 'flash' => [ 'success' => $request->session()->get('success'), 'error' => $request->session()->get('error'), ], 'errors' => fn() => $request->session()->get('errors') ? $request->session()->get('errors')->getBag('default')->getMessages() : (object) [], ]); } }

Q: What is Laravel Livewire and when should you use it?

Definition: Full-stack framework for building dynamic interfaces without leaving PHP
Concept: Write reactive components using PHP instead of JavaScript
Benefits: No API endpoints needed, real-time updates, stays in PHP ecosystem
Best For: CRUD interfaces, forms with validation, real-time features, dashboards

// ✅ Livewire Component Example class UserManager extends Component { public $users; public $search = ''; public $selectedUser = null; public $showModal = false; // Form fields public $name = ''; public $email = ''; public $role_id = ''; protected $rules = [ 'name' => 'required|min:3', 'email' => 'required|email|unique:users', 'role_id' => 'required|exists:roles,id', ]; public function mount() { $this->loadUsers(); } public function updatedSearch() { $this->loadUsers(); } public function loadUsers() { $this->users = User::query() ->when($this->search, fn($query, $search) => $query->where('name', 'like', "%{$search}%") ->orWhere('email', 'like', "%{$search}%")) ->with('role') ->latest() ->get(); } public function createUser() { $this->resetForm(); $this->showModal = true; } public function editUser($userId) { $user = User::findOrFail($userId); $this->selectedUser = $user; $this->name = $user->name; $this->email = $user->email; $this->role_id = $user->role_id; $this->showModal = true; } public function saveUser() { $this->validate(); if ($this->selectedUser) { // Update existing user $this->selectedUser->update([ 'name' => $this->name, 'email' => $this->email, 'role_id' => $this->role_id, ]); session()->flash('success', 'User updated successfully.'); } else { // Create new user User::create([ 'name' => $this->name, 'email' => $this->email, 'role_id' => $this->role_id, 'password' => Hash::make('password'), ]); session()->flash('success', 'User created successfully.'); } $this->resetForm(); $this->showModal = false; $this->loadUsers(); } public function deleteUser($userId) { User::findOrFail($userId)->delete(); $this->loadUsers(); session()->flash('success', 'User deleted successfully.'); } private function resetForm() { $this->selectedUser = null; $this->name = ''; $this->email = ''; $this->role_id = ''; $this->resetErrorBag(); } public function render() { return view('livewire.user-manager', [ 'roles' => Role::all(), ]); } }

Q: How do you handle real-time updates and advanced interactions in Livewire?

Real-time Updates: Use polling, events, or WebSockets for live data
File Uploads: Built-in file upload handling with validation and progress
JavaScript Integration: Alpine.js for client-side interactions
Performance: Lazy loading, defer updates, optimize queries

// ✅ Advanced Livewire Features class OrderDashboard extends Component { public $orders; public $stats; public $chartData; // Real-time polling every 5 seconds protected $queryString = ['status', 'dateRange']; public $status = 'all'; public $dateRange = 'today'; public function mount() { $this->loadDashboardData(); } // Listen for broadcasted events protected $listeners = [ 'orderUpdated' => 'handleOrderUpdate', 'newOrderReceived' => 'loadDashboardData', ]; public function handleOrderUpdate($orderId) { // Update specific order in real-time $order = Order::find($orderId); if ($order) { $this->orders = $this->orders->map(function ($item) use ($order) { return $item->id === $order->id ? $order : $item; }); $this->emit('orderStatusChanged', $order->id, $order->status); } } // Polling for real-time updates public function poll() { $this->loadDashboardData(); } public function updatedStatus() { $this->loadDashboardData(); } public function updatedDateRange() { $this->loadDashboardData(); } public function loadDashboardData() { $query = Order::query()->with(['user', 'items']); // Apply filters if ($this->status !== 'all') { $query->where('status', $this->status); } if ($this->dateRange === 'today') { $query->whereDate('created_at', today()); } elseif ($this->dateRange === 'week') { $query->whereBetween('created_at', [now()->startOfWeek(), now()->endOfWeek()]); } $this->orders = $query->latest()->take(50)->get(); // Calculate stats $this->stats = [ 'total_orders' => $this->orders->count(), 'total_revenue' => $this->orders->sum('total'), 'pending_orders' => $this->orders->where('status', 'pending')->count(), 'completed_orders' => $this->orders->where('status', 'completed')->count(), ]; // Prepare chart data $this->chartData = $this->orders ->groupBy(fn($order) => $order->created_at->format('H:00')) ->map(fn($group) => $group->sum('total')) ->toArray(); } // Bulk actions public function bulkUpdateStatus($orderIds, $newStatus) { Order::whereIn('id', $orderIds)->update(['status' => $newStatus]); $this->loadDashboardData(); session()->flash('success', count($orderIds) . ' orders updated successfully.'); } public function render() { return view('livewire.order-dashboard') ->extends('layouts.app') ->section('content'); } } // ✅ File Upload Component class ImageUploader extends Component { public $images = []; public $uploadedImages = []; protected $rules = [ 'images.*' => 'image|max:2048', // 2MB max ]; public function updatedImages() { $this->validate(); foreach ($this->images as $image) { // Store image and create thumbnail $path = $image->store('uploads', 'public'); $thumbnailPath = $this->createThumbnail($image, $path); $this->uploadedImages[] = [ 'original' => Storage::url($path), 'thumbnail' => Storage::url($thumbnailPath), 'name' => $image->getClientOriginalName(), 'size' => $image->getSize(), ]; } $this->images = []; // Clear for next upload session()->flash('success', 'Images uploaded successfully.'); } public function removeImage($index) { // Remove from storage $image = $this->uploadedImages[$index]; Storage::disk('public')->delete([ str_replace('/storage/', '', $image['original']), str_replace('/storage/', '', $image['thumbnail']), ]); // Remove from array unset($this->uploadedImages[$index]); $this->uploadedImages = array_values($this->uploadedImages); } private function createThumbnail($image, $originalPath) { // Implementation for thumbnail generation // Using Intervention Image or similar package return 'thumbnails/' . basename($originalPath); } public function render() { return view('livewire.image-uploader'); } }

Q: How do you compare Inertia.js vs Livewire for different use cases?

Inertia.js: Best for SPA-like experiences with modern JS frameworks
Livewire: Best for PHP developers who want reactive UIs without JavaScript
Performance: Inertia for heavy client interactions, Livewire for form-heavy apps
Team Skills: Choose based on team's frontend framework expertise

// ✅ Comparison Example - User CRUD // Inertia.js Approach class UserController extends Controller { public function index() { return Inertia::render('Users/Index', [ 'users' => UserResource::collection( User::paginate(15) ), ]); } public function store(Request $request) { $user = User::create($request->validated()); return redirect() ->route('users.index') ->with('success', 'User created.'); } } // Vue.js component (resources/js/Pages/Users/Index.vue) /* */ // Livewire Approach - Single Component class UserCrud extends Component { public $users; public $search = ''; public $editingUser = null; public $name = ''; public $email = ''; public function mount() { $this->loadUsers(); } public function loadUsers() { $this->users = User::when($this->search, function ($query) { return $query->where('name', 'like', '%' . $this->search . '%'); })->get(); } public function editUser($userId) { $user = User::find($userId); $this->editingUser = $user; $this->name = $user->name; $this->email = $user->email; } public function saveUser() { $this->validate([ 'name' => 'required', 'email' => 'required|email', ]); if ($this->editingUser) { $this->editingUser->update([ 'name' => $this->name, 'email' => $this->email, ]); } else { User::create([ 'name' => $this->name, 'email' => $this->email, ]); } $this->resetForm(); $this->loadUsers(); } public function deleteUser($userId) { User::find($userId)->delete(); $this->loadUsers(); } private function resetForm() { $this->editingUser = null; $this->name = ''; $this->email = ''; } public function render() { return view('livewire.user-crud'); } }

⚡ Frontend Integration Best Practices:
• Choose Inertia.js for SPA experiences with existing JS framework skills
• Choose Livewire for PHP-centric teams wanting reactive UIs
• Implement proper error handling and validation in both approaches
• Use caching and optimization techniques for better performance
• Handle real-time updates appropriately (polling vs WebSockets)
• Implement proper security measures and CSRF protection
• Test both server-side logic and frontend interactions

💡 Pro Interview Tips:
• "I choose Inertia.js for modern SPA experiences while keeping server-side routing"
• "I use Livewire for rapid development when the team prefers staying in PHP"
• "I implement proper real-time features using Laravel broadcasting with both tools"
• "I optimize performance by choosing the right tool based on interaction complexity"

📖 Laravel Topics

🚀 Laravel Backend Interview Preparation

🏗️ 26. Namespaces

💉 1. Dependency Injection (DI)

2. ORM vs Raw SQL

3. Redis Caching

4. JWT vs Passport vs OAuth

🔍 5. EXPLAIN Command

🔥 6. N+1 Problem

🎨 8. Design Patterns in Laravel

9. Traits vs Facades

⏳ 10. Queuing System

11. Middleware

🔄 12. Request Lifecycle

13. Sanctum vs Passport

🎯 15. Events & Listeners

17. Mass Assignment Protection

18. Policies and Gates

19. Performance Optimization

20. Migrations

21. Jobs vs Queues

22. Bind vs Singleton

23. CSRF Protection

25. Eloquent Relationships

🏗️ 26. SOLID Principles

🎭 27. OOP Concepts

🚀 28. PHP 8+ Features

🎓 MASTER SOLID & DESIGN PATTERNS

🎨 DESIGN PATTERNS MASTERY

📊 Database Indexing

🌐 SOAP vs REST

📦 Laravel Service Container

🗄️ Eloquent vs Query Builder vs Raw SQL

💡 Give Examples

⚡ Performance Matters

🔒 Security First

🏗️ Architecture Thinking

🧪 Testing Mindset

🎯 Common Interview Questions to Prepare:

🧪 Testing & Quality Assurance

🔒 Security Best Practices

🚀 DevOps & CI/CD Pipelines

🐳 Docker & Containerization

📡 Broadcasting & WebSockets

🔍 Advanced Eloquent & Database

🏗️ Domain-Driven Design (DDD)

🔗 Microservices Architecture

🌟 Laravel Ecosystem (Nova, Horizon, Telescope)

⚡ Frontend Integration (Inertia.js, Livewire)

Users

{{ user.name }}