Laravel Route Middleware Order Bug — Why Admin Routes 403

<?php

use Illuminate\Support\Facades\Route;
use App\Http\Controllers\BlogController;
use App\Http\Controllers\HomeController;

// GET /  — matches the root URL, returns the homepage view
Route::get('/', [HomeController::class, 'index'])->name('home');

// GET /blog  — lists all published blog posts
Route::get('/blog', [BlogController::class, 'index'])->name('blog.index');

// GET /blog/{slug}  — {slug} is a route parameter; Laravel captures whatever
// string sits in that position and passes it to the controller method
Route::get('/blog/{slug}', [BlogController::class, 'show'])->name('blog.show');

// POST /blog  — handles the form submission to CREATE a new post
// This is a separate route even though the URI looks similar to the GET above
Route::post('/blog', [BlogController::class, 'store'])->name('blog.store');

<?php

use Illuminate\Support\Facades\Route;
use App\Http\Controllers\Admin\DashboardController;
use App\Http\Controllers\Admin\UserController;
use App\Http\Controllers\Admin\PostController;

// Route::group() with shared attributes:
// - prefix: every URI inside gets '/admin' prepended automatically
// - middleware: 'auth' ensures only logged-in users can access these routes
// - name: 'admin.' is prepended to every named route inside the group
Route::prefix('admin')
    ->middleware(['auth', 'verified'])
    ->name('admin.')
    ->group(function () {

        // Resolves to: GET /admin/dashboard
        // Full route name:  admin.dashboard
        Route::get('/dashboard', [DashboardController::class, 'index'])
            ->name('dashboard');

        // Resolves to: GET /admin/users
        // Full route name:  admin.users.index
        Route::get('/users', [UserController::class, 'index'])
            ->name('users.index');

        // Resolves to: DELETE /admin/users/{user}
        // Full route name:  admin.users.destroy
        Route::delete('/users/{user}', [UserController::class, 'destroy'])
            ->name('users.destroy');
    });

// --- In a Blade template, use named routes like this: ---
// <a href="{{ route('admin.dashboard') }}">Dashboard</a>
// <a href="{{ route('admin.users.destroy', ['user' => $user->id]) }}">
//
// --- In a redirect, use it like this: ---
// return redirect()->route('admin.dashboard');

<?php
// ============================================================
// FILE: routes/web.php
// ============================================================

use App\Http\Controllers\BlogController;
use Illuminate\Support\Facades\Route;

// The parameter name {post} must match the variable name
// in the controller method signature for binding to work
Route::get('/blog/{post:slug}', [BlogController::class, 'show'])
    ->name('blog.show');

// {post:slug} tells Laravel: find the Post model where slug = {value}
// instead of the default: find Post where id = {value}


// ============================================================
// FILE: app/Http/Controllers/BlogController.php
// ============================================================

namespace App\Http\Controllers;

use App\Models\Post;

class BlogController extends Controller
{
    // BEFORE route model binding — what most beginners write:
    // public function show(string $slug)
    // {
    //     $post = Post::where('slug', $slug)->firstOrFail(); // manual query
    //     return view('blog.show', compact('post'));
    // }

    // AFTER route model binding — Laravel resolves $post automatically
    // from the {post:slug} route parameter. No query written. No 404 handled.
    public function show(Post $post)
    {
        // $post is already a fully hydrated Eloquent model here.
        // If the slug doesn't match any row, Laravel already threw a 404
        // before this method even executed.
        return view('blog.show', [
            'post'   => $post,
            'title'  => $post->title,
            'author' => $post->author->name,
        ]);
    }
}


// ============================================================
// FILE: app/Models/Post.php  (optional — set default binding key)
// ============================================================

namespace App\Models;

use Illuminate\Database\Eloquent\Model;

class Post extends Model
{
    // Telling Laravel: when binding this model in routes, use 'slug' by default
    // This means Route::get('/blog/{post}') also binds by slug — no need for {post:slug}
    public function getRouteKeyName(): string
    {
        return 'slug';
    }
}

<?php

use Illuminate\Support\Facades\Route;
use App\Http\Controllers\Api\V1\ArticleController;
use App\Http\Controllers\Api\V1\CommentController;
use App\Http\Controllers\Api\V1\AuthController;

// Public routes — no authentication required
Route::post('/auth/login', [AuthController::class, 'login'])
    ->name('api.auth.login');

Route::post('/auth/register', [AuthController::class, 'register'])
    ->name('api.auth.register');

// Versioned, protected API routes
// prefix('v1')         → all URIs become /api/v1/...
// middleware('auth:sanctum') → requires a valid Sanctum token on every request
// name('api.v1.')      → all route names prefixed with api.v1.
Route::prefix('v1')
    ->middleware('auth:sanctum')
    ->name('api.v1.')
    ->group(function () {

        // Route::apiResource() registers 5 routes (not 7)
        // It skips 'create' and 'edit' — those are HTML form pages, useless in an API
        //
        // Generated routes:
        //   GET    /api/v1/articles           → ArticleController@index
        //   POST   /api/v1/articles           → ArticleController@store
        //   GET    /api/v1/articles/{article} → ArticleController@show
        //   PUT    /api/v1/articles/{article} → ArticleController@update
        //   DELETE /api/v1/articles/{article} → ArticleController@destroy
        Route::apiResource('articles', ArticleController::class);

        // Nested resource: comments belong to articles
        // URI: /api/v1/articles/{article}/comments
        // only() restricts to just the routes we actually need
        Route::apiResource('articles.comments', CommentController::class)
            ->only(['index', 'store', 'destroy']);
    });


// ============================================================
// FILE: app/Http/Controllers/Api/V1/ArticleController.php
// ============================================================

namespace App\Http\Controllers\Api\V1;

use App\Http\Controllers\Controller;
use App\Models\Article;
use Illuminate\Http\JsonResponse;
use Illuminate\Http\Request;

class ArticleController extends Controller
{
    public function index(): JsonResponse
    {
        // Return paginated articles as JSON — no view, no HTML
        $articles = Article::with('author')
            ->published()
            ->latest()
            ->paginate(15);

        return response()->json([
            'data'  => $articles->items(),
            'links' => [
                'self'  => route('api.v1.articles.index'),
                'next'  => $articles->nextPageUrl(),
            ],
            'meta'  => ['total' => $articles->total()],
        ]);
    }

    public function show(Article $article): JsonResponse
    {
        // Route model binding resolves the Article by ID automatically
        return response()->json(['data' => $article->load('author', 'comments')]);
    }
}

# Cache routes for production — run after every code deployment
php artisan route:cache

# Clear the route cache — for development or troubleshooting
php artisan route:clear

# List all cached routes (only works after caching)
php artisan route:list

# Typical output of route:list after caching
# +--------+----------+------------------------+------------------+--------------------------------------------------------------+
# | Domain | Method   | URI                    | Name             | Action                                                       |
# +--------+----------+------------------------+------------------+--------------------------------------------------------------+
# |        | GET|HEAD | /                      | home             | App\Http\Controllers\HomeController@index                  |
# |        | GET|HEAD | /blog                  | blog.index       | App\Http\Controllers\BlogController@index                  |
# |        | GET|HEAD | /blog/{slug}           | blog.show        | App\Http\Controllers\BlogController@show                  |
# |        | POST     | /blog                  | blog.store       | App\Http\Controllers\BlogController@store                 |
# +--------+----------+------------------------+------------------+--------------------------------------------------------------+