Download the PHP package glueful/api-skeleton without Composer

Glueful API Skeleton

A minimal API application starter powered by the Glueful framework.

Quick Start

Default Routes

Identity, Accounts & RBAC

The skeleton enables two extensions by default — glueful/users (identity store + account lifecycle) and glueful/email-notification (the email channel). Authorization (RBAC) is opt-in.

1. Default skeleton — no RBAC required

• Login / token refresh / logout via the core auth seam (backed by glueful/users).
• GET /me — the authenticated user's account + nested profile (authentication only).
• Account lifecycle (/auth/verify-email, /auth/forgot-password, /auth/reset-password).
• Email-PIN 2FA (/2fa/*, when TWO_FACTOR_ENABLED=true).

2. Optional user lookup / list — needs RBAC

These are off by default and permission-gated (users.read):

Because they require users.read, they only work once an RBAC provider is enabled and the permission is granted — without one, the framework gate fails closed (403).

3. Enabling RBAC (glueful/aegis)

aegis:bootstrap-admin is the one-command first-admin path: it syncs the declared permission catalog, creates/reuses a role (default admin), grants it users.read, and assigns that role to your user — enough to unlock the lookup/list endpoints. Useful flags:

• --role=administrator — target a specific (e.g. seeded) role instead of admin.
• --permission=posts.read — repeatable; grant specific permissions instead of the users.read default.
• --all-catalog — grant every catalog permission (full admin).
• --dry-run — preview without writing.

Manual equivalent (if you prefer): php glueful permissions:sync, then assign a seeded role (superuser/administrator) to the user via the roles API (POST /{user_uuid}/roles).

Modern-framework norm: the user store is a sensible default; full RBAC stays opt-in so a fresh skeleton boots lean and secure (fail-closed) without imposing roles/permissions setup until you need it.

Project Structure

This skeleton uses a minimal starter structure. As your application grows, see docs/APPLICATION_ARCHITECTURE.md for guidance on scaling to standard and enterprise structures.

Architecture Guide

The skeleton follows a progressive complexity model:

Start minimal. Add complexity only when needed.

See the full guide: docs/APPLICATION_ARCHITECTURE.md

Controllers & Routing

Routes are defined explicitly in routes/api.php:

The framework also supports attribute-based routing:

Configuration

Key configuration files in config/:

Environment variables in .env override config values.

CLI Commands

Deploying To Production

Before deploying a generated app, review this checklist:

• Generate strong secrets with php glueful generate:key, then set APP_KEY and JWT_KEY in the production environment.
• Move from SQLite to your production database driver and run php glueful migrate:run during deployment.
• Move QUEUE_CONNECTION away from sync for background work, usually to database, redis, or your queue driver.
• Move CACHE_DRIVER away from local file storage when the app runs on more than one server.
• Generate the production command manifest with php glueful commands:cache.
• Check route-cache health with php glueful route:cache:status; clear stale routes with php glueful route:cache:clear.
• Clear application cache with php glueful cache:clear after config or deployment changes.
• Enable PHP opcache in production and deploy with Composer's optimized autoloader.
• Point logs at storage/logs or your platform log sink, never under public/.
• Keep /docs disabled unless API docs should be public in that environment.

Testing

Base test case at tests/TestCase.php provides framework integration.

Notes

• Database: SQLite at storage/database/glueful.sqlite (zero config)
• Queue: sync driver for immediate execution (change to redis or database in .env)
• Docs: API documentation at /docs when API_DOCS_ENABLED=true