Architecture

Architecture

Thin controllers; business logic in app/Actions and app/Services; validation in app/Http/Requests; one Inertia page per file on the frontend.

app/
├─ Actions/              PlaceOrder (locks, offers, interaction check), StorePrescription, ReviewPrescription
├─ Console/Commands/     catalog:*, prescriptions:auto-approve, payments:expire, refills:remind, user:admin
├─ Enums/                OrderStatus, PrescriptionStatus, StaffRole (permissions per role)
├─ Http/
│  ├─ Controllers/       Storefront/ · Pages/ · Auth/ · Account/ · Admin/
│  ├─ Middleware/        RequestGuard, SecurityHeaders (nonce CSP), EnsureAdmin, EnsureStaffCan,
│  │                     EnsureNotBanned, SetLocale, HandleInertiaRequests
│  └─ Requests/          validation, reCAPTCHA and ban checks
├─ Listeners/            sign-in activity, guest → account merge
├─ Models/               Product, Order, Prescription, Offer, Ban, UserActivity, …
├─ Services/
│  ├─ Payments/          PaymentService, StripeGateway, SandboxGateway
│  ├─ Personalization/   Visitor, Interactions, OfferEngine, Pricing, Recommender, Refills
│  ├─ Assistant/         preset intents → personal answers
│  ├─ Experiments/       A/B bucketing + events
│  ├─ Security/          BanGuard, ActivityLog, TwoFactor, LoginCodes, PendingLogin, MalwareScanner
│  └─ Cart · Catalog (InteractionChecker) · Mail (AccountNotices) · Wishlist
└─ Support/              Seo, CatalogCache, Username, UserAgent, Content
resources/
├─ content/              FAQ + policies, interactions.json (drug rules)
├─ js/
│  ├─ ssr.jsx            SSR entry (body only; Blade owns the head)
│  ├─ Pages/             one Inertia page per file (Admin/ included)
│  ├─ Components/        layout/ · ui/ · product/ · motion/ · three/ · forms/ · admin/
│  ├─ Layouts/           StoreLayout (persistent), AdminLayout
│  └─ hooks/ · lib/      useT (i18n), fly, prefetch, signals, fingerprint
└─ views/                app.blade.php, branded error pages, e-mails
lang/ur.json             Urdu dictionary
tests/                   Feature/ (PHPUnit) · e2e/ (Playwright) · load/ (autocannon)
deploy/                  nginx, supervisor, production env template

Request path

1. RequestGuard drops malformed or abusive requests before any session or database work.
2. SecurityHeaders adds a per-request CSP nonce; SetLocale picks English or Urdu; EnsureNotBanned checks the shared ban cache.
3. A thin controller calls an Action or Service and returns an Inertia response.
4. With SSR on, the Node SSR server renders the page body; Blade renders the head (title, meta, JSON-LD).

Scheduled jobs

Command	Schedule
prescriptions:auto-approve	every 10 minutes
payments:expire	every 5 minutes
refills:remind	daily at 09:00 PKT

The app is stateless (sessions, cache and queue in the database or Redis), so it runs behind any load balancer. See Deployment and Data Model.