Download the PHP package caminodeldev/laravel-api-scaffold without Composer

Laravel API Scaffold

Generate clean, secure and configurable Laravel API scaffolding from existing database tables.

Languages: Español

This package generates reviewable Laravel code. It does not replace authorization design, business rules, human review, tests, or production readiness checks.

What this package does

caminodeldev/laravel-api-scaffold inspects an existing database table and generates Laravel files that follow a layered API structure:

• Eloquent model.
• API controller.
• FormRequest classes.
• API Resource.
• Service class.
• Dedicated generated route file.
• Basic Feature test scaffold.

The generated code is intentionally simple and explicit. It is meant to be reviewed, customized and committed like normal application code.

What this package does not do

This package does not:

• Act as a runtime CRUD engine.
• Infer business authorization rules.
• Create database migrations.
• Replace policies, gates, middleware or domain validation.
• Guarantee that generated code is production-ready without review.
• Support every database engine. v0.4.0 supports MySQL/MariaDB and PostgreSQL for common Laravel API tables.

Release status

Current prepared release:

This release focuses on richer generated Eloquent models for MySQL/MariaDB and PostgreSQL, adding foreign-key relationship generation and PHPDoc metadata while keeping explicit, reviewable code.

See CHANGELOG.md for release notes.

Requirements

• PHP 8.2 or higher.
• Laravel 10, 11, 12 or 13.
• A configured database connection.
• MySQL/MariaDB or PostgreSQL connection support.

Laravel 13 compatibility is declared in Composer constraints and CI includes PHP 8.4. Always run the package test suite and validate generated code inside your target Laravel application before using it in production.

Installation

Install the package with Composer:

Laravel package discovery registers the service provider automatically.

Publish the configuration file:

This creates:

Local development installation

When testing the package before publishing it to Packagist, add a local path repository in the Laravel application that will consume it.

Example:

Then require it locally:

Refresh autoload files:

Recommended first flow

Start by inspecting the table:

Preview the generated API before writing files:

Generate a safe read-only API:

--read-only is explicit for readability. Read-only is also the default behavior when --crud is not used.

The read-only scaffold generates routes for listing and showing records only:

The /api prefix assumes the generated route file is imported from Laravel's routes/api.php. If you load the generated route file somewhere else, adjust routes.prefix in config/api-scaffold.php.

Laravel Octane / Swoole

When using Laravel Octane or Swoole, reload workers after generating routes or code. The CLI may show new routes immediately while the HTTP worker still serves the old in-memory application.

The package prints a reminder when Octane is detected. It does not reload workers automatically.

Generated files

For a users table, the default read-only scaffold creates:

When --crud is used, the package also generates write FormRequests:

The generated controller delegates query logic to a service, validates input with FormRequest classes, returns data through a Resource and uses controlled try/catch blocks.

Available Artisan commands

The package currently registers these commands:

scaffold:inspect

Signature:

Use this before generating files to confirm that the package reads the expected table metadata.

scaffold:model

Signature:

Examples:

Generated model relationships and PHPDoc

Starting in v0.4.0, generated models can include Eloquent relationships discovered from database foreign keys.

For a child table with a foreign key such as scaffold_transacciones.scaffold_cliente_id -> scaffold_clientes.id, the generated model includes:

When the current table is referenced by another table, the generated model can include inverse hasMany relationships:

Generated models also include PHPDoc for columns and relationships when enabled:

Configuration:

Only single-column foreign keys are used for relationship generation. Composite keys, many-to-many and polymorphic relationships are intentionally out of scope.

scaffold:api

Signature:

Preview without writing files:

Generate explicit write operations:

Generate delete support explicitly:

--with-delete requires --crud.

Use a custom route resource URI when the table name should not be exposed directly:

By default, the route resource URI is derived from the table name, not from English pluralization of the model name. For example, solicitudes with --model=Solicitud generates solicitudes, not solicituds.

Overwrite existing generated files explicitly:

Route strategy

Generated routes are written to:

The package can optionally add an import block to routes/api.php:

This import is idempotent and configurable in config/api-scaffold.php.

Generated route blocks inside routes/scaffolded-api.php are managed per resource. Regenerating the same resource replaces the existing managed block instead of appending a duplicate block. Manual routes outside generated markers are preserved.

By default, the package uses v1 as route prefix because routes/api.php is usually already mounted under /api by Laravel. If your project loads the generated route file elsewhere, change routes.prefix to api/v1 or any prefix you need.

Generated Feature tests use Laravel named routes, such as route('users.index'), instead of hardcoded /v1/... paths. This keeps tests aligned with the actual Laravel route prefix, commonly /api/v1/... when loaded from routes/api.php.

Generated index smoke tests also mock the generated Service pagination method. This keeps the test focused on route/controller wiring and avoids failures when the consumer application's testing database has not been migrated yet.

Generated query behavior

Starting with v0.2.0, generated index endpoints support safe query behavior through generated allow-lists in the Service layer.

Supported query parameters:

The generated Service contains explicit allow-lists:

Invalid filter or sort columns are ignored by the generated Service instead of being passed blindly to the query builder.

Starting with v0.3.2, generated index FormRequests can also reject invalid filters and sorts with HTTP 422. This is opt-in and disabled by default to preserve compatibility:

When enabled:

will fail validation instead of being ignored.

You may also exclude additional business columns from generated query allow-lists without removing them from generated fillable arrays or API resources:

These query-only exclusions are evaluated in addition to the security.* exclusions.

Pagination is configurable:

The generated request accepts both per_page and perPage for compatibility.

Generated write FormRequests now use richer column metadata when available, including string length, enum values, boolean-like tinyint(1) columns and unique rules for store requests.

Configuration overview

Default controller namespace:

Default request namespace:

Default output paths and namespaces are configurable in:

Generated controllers use the package response envelope helper:

The helper centralizes response key resolution through config/api-scaffold.php:

You can customize these keys for your organization:

By default, the package helper is used. If your Laravel application already has a compatible helper, configure it explicitly:

The configured helper must expose a public static method compatible with:

If response.helper is null or the configured class/method is unavailable, the package falls back to its internal ResponseEnvelope implementation.

To include a timestamp in the default package envelope, enable:

Generated controllers now depend on the package at runtime through ResponseEnvelope. Keep caminodeldev/laravel-api-scaffold installed while using generated controllers, or replace the generated response calls with your application helper before removing the package.

Security defaults and production readiness

Security is the main design constraint of this package. The scaffold is intentionally conservative and is meant to generate reviewable code, not production-ready authorization decisions.

Read the full security notes in SECURITY.md.

Safe defaults included in the MVP:

• Read-only APIs are the recommended default.
• Write operations require --crud.
• Delete generation requires both --crud and --with-delete.
• Generated resources exclude common secret-like columns.
• Generated models exclude common secret-like columns from $fillable.
• Generated models hide common secret-like columns.
• Generated controllers return controlled error messages.
• Generated routes use configurable middleware.
• --dry-run lets you inspect planned files before writing.
• Existing files are not overwritten unless --force is used.

Before using generated code in production, review at least:

• Authentication middleware.
• Authorization rules, policies or gates.
• Generated FormRequest rules.
• Generated Resource fields.
• Search, filter, sorting and pagination behavior.
• Write operations and mass-assignment rules.
• Logs and exception handling.
• Database indexes and pagination limits.

MVP status

Current MVP scope:

• MySQL/MariaDB table inspection.
• PostgreSQL table inspection for common Laravel API tables.
• Safe Eloquent model generation.
• Read-only API generation.
• Optional CRUD generation via explicit flags.
• FormRequest generation.
• Resource generation excluding sensitive fields.
• Service layer generation.
• Thin controller generation with try/catch.
• Dedicated route file generation.
• Idempotent import into routes/api.php.
• Per-resource replacement of managed route blocks in routes/scaffolded-api.php.
• Dry-run mode.
• Force overwrite mode.
• Basic generated Feature test scaffold using named routes and a mocked index Service call.
• Safe generated filters, search, sorting and paginated index services.
• Smarter generated FormRequest rules based on MySQL and PostgreSQL metadata.

Planned next steps after v0.3.0:

• Optional policy generation.
• Real diff mode.
• Optional extraction of the response envelope into a dedicated package.
• Expanded CI matrix for framework-version-specific validation.

Development

Install dependencies:

Validate Composer metadata:

Refresh autoload files:

Run tests:

Current package test coverage validates:

• Sensitive column detection.
• File writing and dry-run behavior.
• MySQL table inspection with fixtures.
• PostgreSQL table inspection and schema-qualified table names.
• Name resolution.
• Generated route URI, route parameter and Feature test behavior.
• Controller response envelope consistency.
• ResponseEnvelope helper behavior.
• Generated query allow-lists, pagination, search and sorting.
• Generated FormRequest validation rules.

Versioning

Releases are created with Git tags. The package does not define a hardcoded version field in composer.json; Packagist and Composer resolve versions from repository tags.

Recommended release tag example:

Distribution archive

The package includes a .gitattributes file to keep development-only files out of Composer distribution archives.

License

MIT