🛠️ Weekend Project: Laravel

How to Approach a Build

The biggest mistake beginners make on a project like this is opening the editor and immediately typing php artisan make:model. Code written before you understand the problem is code you usually rewrite. Before we build anything, we'll borrow a four-step method from the mathematician George Pólya — it applies to software just as well as it applies to proofs.

Each milestone below maps onto this loop: we understand what a feature needs, plan the pieces, build them, then check the result before moving on. Treat the loop as a rhythm you return to for every feature, not a one-time ceremony at the start.

The Brief: TaskMaster

You're building TaskMaster, a task-management backend. A signed-in user can create projects, add tasks to those projects, assign each task to a team member, and move tasks through a status workflow. Everything is exposed as a clean REST API so a web or mobile frontend could sit on top later.

Core features

• Register, log in, and log out via token authentication
• Create, list, read, update, and delete projects (scoped to their owner)
• Create tasks inside a project, assign them, and change their status
• Consistent JSON output and validation errors
• Authorization so users can only touch their own projects

Milestone 0 — Understand & Plan

No code yet. Spend the first 20 minutes turning the brief into a data model and an endpoint list. This is the cheapest place to catch a design mistake.

The entities and how they relate

Read that in plain English: a user owns many projects; a project contains many tasks; a task belongs to one project and is optionally assigned to one user. Those relationships drive every migration and Eloquent method you'll write later, so it pays to get them right now.

The endpoints you're promising

💡 Why write this table first? It becomes your build checklist and your test plan at the same time. When every row returns the right thing, the milestone is done — no guesswork.

Milestone 1 — Scaffold & Auth

Goal: a fresh Laravel 11 app that can register and authenticate a user with an API token.

Create the project

Laravel 11 ships without an api.php route file by default — you opt into API routing with install:api, which also wires up the token guard scaffolding. Then add Passport for OAuth2 tokens.

composer create-project laravel/laravel taskmaster
cd taskmaster

# Opt into API routes (creates routes/api.php)
php artisan install:api

# Add Passport for token-based auth
composer require laravel/passport
php artisan migrate
php artisan passport:install

<?php
// app/Http/Controllers/Controller.php
namespace App\Http\Controllers;

use Illuminate\Foundation\Auth\Access\AuthorizesRequests;

abstract class Controller
{
    use AuthorizesRequests;
}

Wire Passport into the User model and guard

<?php
// app/Models/User.php
namespace App\Models;

use Illuminate\Foundation\Auth\User as Authenticatable;
use Illuminate\Notifications\Notifiable;
use Laravel\Passport\HasApiTokens;

class User extends Authenticatable
{
    use HasApiTokens, Notifiable;

    protected $fillable = ['name', 'email', 'password', 'role'];
    protected $hidden = ['password', 'remember_token'];

    protected function casts(): array
    {
        return [
            'email_verified_at' => 'datetime',
            'password' => 'hashed',
        ];
    }
}

<?php
// config/auth.php — point the api guard at Passport
'guards' => [
    'web' => [
        'driver' => 'session',
        'provider' => 'users',
    ],
    'api' => [
        'driver' => 'passport',
        'provider' => 'users',
    ],
],

A minimal auth controller

<?php
// app/Http/Controllers/API/AuthController.php
namespace App\Http\Controllers\API;

use App\Http\Controllers\Controller;
use App\Models\User;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Hash;
use Illuminate\Validation\ValidationException;

class AuthController extends Controller
{
    public function register(Request $request)
    {
        $data = $request->validate([
            'name' => 'required|string|max:255',
            'email' => 'required|email|unique:users,email',
            'password' => 'required|string|min:8|confirmed',
        ]);

        $user = User::create($data); // password auto-hashed by the cast
        $token = $user->createToken('api')->accessToken;

        return response()->json(['user' => $user, 'token' => $token], 201);
    }

    public function login(Request $request)
    {
        $credentials = $request->validate([
            'email' => 'required|email',
            'password' => 'required|string',
        ]);

        $user = User::where('email', $credentials['email'])->first();

        if (! $user || ! Hash::check($credentials['password'], $user->password)) {
            throw ValidationException::withMessages([
                'email' => ['The provided credentials are incorrect.'],
            ]);
        }

        return response()->json([
            'user' => $user,
            'token' => $user->createToken('api')->accessToken,
        ]);
    }

    public function logout(Request $request)
    {
        $request->user()->token()->revoke();
        return response()->json(['message' => 'Logged out']);
    }
}

Milestone 2 — Schema & Models

Goal: the database tables and Eloquent models that mirror the ER diagram from Milestone 0.

Migrations

Generate the migrations with php artisan make:migration create_projects_table and ...create_tasks_table, then fill in the schema. The users table already exists from the default install; we only add a role column to it.

<?php
// Add a role to the existing users table
Schema::table('users', function (Blueprint $table) {
    $table->enum('role', ['admin', 'user'])->default('user')->after('password');
});

// projects
Schema::create('projects', function (Blueprint $table) {
    $table->id();
    $table->string('name');
    $table->text('description')->nullable();
    $table->foreignId('user_id')->constrained()->cascadeOnDelete();
    $table->timestamps();
});

// tasks
Schema::create('tasks', function (Blueprint $table) {
    $table->id();
    $table->string('title');
    $table->text('description')->nullable();
    $table->foreignId('project_id')->constrained()->cascadeOnDelete();
    $table->foreignId('assigned_to')->nullable()
          ->constrained('users')->nullOnDelete();
    $table->enum('status', ['todo', 'in_progress', 'completed'])->default('todo');
    $table->date('due_date')->nullable();
    $table->timestamps();
});

Models with relationships

<?php
// app/Models/Project.php
namespace App\Models;

use Illuminate\Database\Eloquent\Model;
use Illuminate\Database\Eloquent\Relations\BelongsTo;
use Illuminate\Database\Eloquent\Relations\HasMany;

class Project extends Model
{
    protected $fillable = ['name', 'description', 'user_id'];

    public function user(): BelongsTo
    {
        return $this->belongsTo(User::class);
    }

    public function tasks(): HasMany
    {
        return $this->hasMany(Task::class);
    }
}

<?php
// app/Models/Task.php
namespace App\Models;

use Illuminate\Database\Eloquent\Model;
use Illuminate\Database\Eloquent\Relations\BelongsTo;

class Task extends Model
{
    protected $fillable = [
        'title', 'description', 'project_id',
        'assigned_to', 'status', 'due_date',
    ];

    protected function casts(): array
    {
        return ['due_date' => 'date'];
    }

    public function project(): BelongsTo
    {
        return $this->belongsTo(Project::class);
    }

    public function assignee(): BelongsTo
    {
        return $this->belongsTo(User::class, 'assigned_to');
    }
}

Run php artisan migrate and confirm the tables exist. To make manual testing pleasant, seed a user and a couple of projects with a factory — future-you will thank present-you.

Milestone 3 — API & Resources

Goal: controllers that return well-shaped JSON. We use API Resources so the model's database columns and the API's public shape stay decoupled — you can rename a column tomorrow without breaking clients.

Create the resources

<?php
// app/Http/Resources/ProjectResource.php
namespace App\Http\Resources;

use Illuminate\Http\Request;
use Illuminate\Http\Resources\Json\JsonResource;

class ProjectResource extends JsonResource
{
    public function toArray(Request $request): array
    {
        return [
            'id' => $this->id,
            'name' => $this->name,
            'description' => $this->description,
            'owner' => [
                'id' => $this->user->id,
                'name' => $this->user->name,
            ],
            'tasks_count' => $this->whenCounted('tasks'),
            'created_at' => $this->created_at,
        ];
    }
}

<?php
// app/Http/Resources/TaskResource.php
namespace App\Http\Resources;

use Illuminate\Http\Request;
use Illuminate\Http\Resources\Json\JsonResource;

class TaskResource extends JsonResource
{
    public function toArray(Request $request): array
    {
        return [
            'id' => $this->id,
            'title' => $this->title,
            'description' => $this->description,
            'status' => $this->status,
            'due_date' => $this->due_date?->toDateString(),
            'project_id' => $this->project_id,
            'assignee' => $this->whenLoaded('assignee', fn () => [
                'id' => $this->assignee->id,
                'name' => $this->assignee->name,
            ]),
            'created_at' => $this->created_at,
        ];
    }
}

The project controller

Generate it with php artisan make:controller API/ProjectController --api. Notice how thin each method is — validation, an Eloquent call, and a Resource. That is exactly the shape you're aiming for.

<?php
// app/Http/Controllers/API/ProjectController.php
namespace App\Http\Controllers\API;

use App\Http\Controllers\Controller;
use App\Http\Resources\ProjectResource;
use App\Models\Project;
use Illuminate\Http\Request;

class ProjectController extends Controller
{
    public function index(Request $request)
    {
        return ProjectResource::collection(
            $request->user()->projects()->withCount('tasks')->latest()->get()
        );
    }

    public function store(Request $request)
    {
        $data = $request->validate([
            'name' => 'required|string|max:255',
            'description' => 'nullable|string',
        ]);

        $project = $request->user()->projects()->create($data);

        return new ProjectResource($project);
    }

    public function show(Project $project)
    {
        $this->authorize('view', $project);
        return new ProjectResource($project->loadCount('tasks'));
    }

    public function update(Request $request, Project $project)
    {
        $this->authorize('update', $project);

        $data = $request->validate([
            'name' => 'sometimes|required|string|max:255',
            'description' => 'nullable|string',
        ]);

        $project->update($data);

        return new ProjectResource($project);
    }

    public function destroy(Project $project)
    {
        $this->authorize('delete', $project);
        $project->delete();

        return response()->json(['message' => 'Project deleted'], 200);
    }
}

The $request->user()->projects() relationship needs a projects() method on the User model — add public function projects() { return $this->hasMany(Project::class); }. Scoping queries through the authenticated user like this means a user physically cannot list someone else's projects, even before policies run.

The task controller

<?php
// app/Http/Controllers/API/TaskController.php
namespace App\Http\Controllers\API;

use App\Http\Controllers\Controller;
use App\Http\Resources\TaskResource;
use App\Models\Project;
use App\Models\Task;
use Illuminate\Http\Request;

class TaskController extends Controller
{
    public function index(Project $project)
    {
        $this->authorize('view', $project);

        return TaskResource::collection(
            $project->tasks()->with('assignee')->latest()->get()
        );
    }

    public function store(Request $request, Project $project)
    {
        $this->authorize('update', $project);

        $data = $request->validate([
            'title' => 'required|string|max:255',
            'description' => 'nullable|string',
            'assigned_to' => 'nullable|exists:users,id',
            'due_date' => 'nullable|date',
            'status' => 'nullable|in:todo,in_progress,completed',
        ]);

        $task = $project->tasks()->create($data);

        return new TaskResource($task->load('assignee'));
    }

    public function show(Task $task)
    {
        $this->authorize('view', $task->project);
        return new TaskResource($task->load('assignee'));
    }

    public function update(Request $request, Task $task)
    {
        $this->authorize('update', $task->project);

        $data = $request->validate([
            'title' => 'sometimes|required|string|max:255',
            'description' => 'nullable|string',
            'assigned_to' => 'nullable|exists:users,id',
            'due_date' => 'nullable|date',
            'status' => 'nullable|in:todo,in_progress,completed',
        ]);

        $task->update($data);

        return new TaskResource($task->load('assignee'));
    }

    public function destroy(Task $task)
    {
        $this->authorize('update', $task->project);
        $task->delete();

        return response()->json(['message' => 'Task deleted'], 200);
    }

    public function updateStatus(Request $request, Task $task)
    {
        $this->authorize('update', $task->project);

        $data = $request->validate([
            'status' => 'required|in:todo,in_progress,completed',
        ]);

        $task->update($data);

        return new TaskResource($task->load('assignee'));
    }
}

Milestone 4 — Authorization & Routes

Goal: lock the doors. Right now query-scoping hides other users' data, but the policies make the rules explicit and cover edge cases like an admin override.

The project policy

Generate it with php artisan make:policy ProjectPolicy --model=Project. Laravel 11 auto-discovers policies by naming convention, so no manual registration is needed.

<?php
// app/Policies/ProjectPolicy.php
namespace App\Policies;

use App\Models\Project;
use App\Models\User;

class ProjectPolicy
{
    public function view(User $user, Project $project): bool
    {
        return $user->id === $project->user_id || $user->role === 'admin';
    }

    public function update(User $user, Project $project): bool
    {
        return $user->id === $project->user_id || $user->role === 'admin';
    }

    public function delete(User $user, Project $project): bool
    {
        return $user->id === $project->user_id || $user->role === 'admin';
    }
}

Register the routes

<?php
// routes/api.php
use App\Http\Controllers\API\AuthController;
use App\Http\Controllers\API\ProjectController;
use App\Http\Controllers\API\TaskController;
use Illuminate\Support\Facades\Route;

// Public
Route::post('/register', [AuthController::class, 'register']);
Route::post('/login', [AuthController::class, 'login']);

// Protected by a Passport token
Route::middleware('auth:api')->group(function () {
    Route::post('/logout', [AuthController::class, 'logout']);

    Route::apiResource('projects', ProjectController::class);

    // Tasks nested under a project (list + create)
    Route::get('projects/{project}/tasks', [TaskController::class, 'index']);
    Route::post('projects/{project}/tasks', [TaskController::class, 'store']);

    // Individual tasks (everything except the nested index/store)
    Route::apiResource('tasks', TaskController::class)
        ->except(['index', 'store']);
    Route::patch('tasks/{task}/status', [TaskController::class, 'updateStatus']);
});

curl -X POST http://localhost:8000/api/projects \
  -H "Authorization: Bearer <your-token>" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"name":"Launch site","description":"Marketing push"}'

{
  "data": {
    "id": 1,
    "name": "Launch site",
    "description": "Marketing push",
    "owner": { "id": 1, "name": "Ray" },
    "created_at": "2026-08-01T14:22:10.000000Z"
  }
}

Definition of Done

Before you call TaskMaster finished, walk this checklist. If every box is honestly checked, you have a solid, secure API.

A first feature test

You don't need full coverage this weekend, but write at least one test so you learn the workflow. Laravel 11 uses Pest by default; a feature test reads almost like plain English.

<?php
// tests/Feature/ProjectTest.php
use App\Models\User;

it('lets an authenticated user create a project', function () {
    $user = User::factory()->create();

    $response = $this->actingAs($user, 'api')->postJson('/api/projects', [
        'name' => 'Weekend build',
    ]);

    $response->assertCreated()
        ->assertJsonPath('data.name', 'Weekend build');

    $this->assertDatabaseHas('projects', [
        'name' => 'Weekend build',
        'user_id' => $user->id,
    ]);
});

it('blocks a user from viewing another user\'s project', function () {
    $owner = User::factory()->create();
    $intruder = User::factory()->create();
    $project = $owner->projects()->create(['name' => 'Private']);

    $this->actingAs($intruder, 'api')
        ->getJson("/api/projects/{$project->id}")
        ->assertForbidden();
});

Run it with php artisan test. Green output on both cases proves your happy path and your authorization are working.

What Good Looks Like

Two projects can both "work" and be worlds apart in quality. Here's how to tell whether yours is genuinely good, not just green.

Your Assignment

$query = $project->tasks()->with('assignee');

if ($request->filled('status')) {
    $request->validate(['status' => 'in:todo,in_progress,completed']);
    $query->where('status', $request->string('status'));
}

return TaskResource::collection($query->latest()->get());

Submission guidelines

• Push to a public GitHub repository on a clearly named branch.
• Include the README.md with setup steps and an endpoint table.
• Ensure php artisan test passes on a clean clone.
• Be ready to walk through your Pólya notes: what you understood, planned, built, and would improve.

Summary & Quiz

📚 Further Reading

• Laravel Docs — Eloquent API Resources
• Laravel Docs — Authorization & Policies
• Laravel Docs — Passport (API tokens)
• Pest — Writing Tests

🚀 What's Next?

You've now built a complete PHP backend end-to-end. Next we step up a level to compare backend approaches across languages and cement the concepts that carry between every framework you'll meet.