Routing Architecture
App-level and package-level routes, auth guards, and key middleware
Last updated: Feb 09, 2026
Routing Architecture
Routes are loaded from two sources: app-level (routes/) and package-level (each package's ServiceProvider).
App-Level Routes
| File | Scope | Contents |
|---|---|---|
web.php | Web | Dashboard redirect (admin vs shop based on guard), requires settings.php + auth.php |
api.php | API | Single GET /user (sanctum) — bulk API routes in API package |
auth.php | Web (guest + auth) | Register, login, forgot/reset password, email verification, logout |
settings.php | Web (auth) | Profile CRUD, password, appearance, two-factor — under /settings/ |
console.php | Artisan | Default inspire command |
Package Route Files
| Package | Route File | Prefix | Middleware |
|---|---|---|---|
| Core | admin.php | /admin | web, auth, is_admin |
| Admin | admin.php | /admin | web, auth, is_admin |
| Product | admin.php | /admin/products | web, auth, is_admin |
| Product | web.php | / | web |
| Cart | web.php | /cart | web |
| Cart | api.php | /api/v1/cart | api, auth:sanctum |
| Shop | web.php | / | web |
| Shop | api.php | /api/v1 | api |
| Settings | admin.php | /admin/settings | web, auth, is_admin |
| Sales | admin.php | /admin/sales | web, auth, is_admin |
| Customer | customer.php | /admin/customers | web, auth, is_admin |
| CMS | admin.php | /admin/cms | web, auth, is_admin |
| CMS | web.php | /{slug} | web (catch-all for pages) |
| System | system.php | /admin/system | web, auth, is_admin |
| Reports | admin.php | /admin/reports | web, auth, is_admin |
| Marketing | admin.php | /admin/marketing | web, auth, is_admin |
| Marketing | shop.php | / | web (coupon application) |
| API | api.php | /api/v1 | api (some routes auth, some public) |
| Setup | setup.php | /setup | web |
| Stripe | admin.php + web.php | varies | gateway-specific |
Auth Guards
| Guard | Purpose | Session |
|---|---|---|
web (default) | Customer / user authentication | Cookie-based |
admin | Admin panel access | Cookie-based |
sanctum | API token auth | Bearer token |
Key Middleware
| Middleware | Location | Purpose |
|---|---|---|
HandleInertiaRequests | app/Http/Middleware/ | Shares auth, menu, currency, flash, theme, sidebar state to all Inertia pages |
HandleAppearance | app/Http/Middleware/ | Dark/light mode handling |
IsAdmin | Cartxis\Admin | Verifies admin guard |
PreventAdminFrontendAccess | Cartxis\Admin | Blocks admin users from customer frontend |
PreventUserAdminAccess | Cartxis\Admin | Blocks customers from admin panel |
RedirectIfAdminAuthenticated | Cartxis\Admin | Redirects authenticated admins from login |
ShareFrontendData | Cartxis\Shop | Shares storefront-specific data |
ThemeInertiaResponseFactory | Cartxis\Core | Theme-aware Inertia responses |
TrackApiSync | Cartxis\API | Auto-updates API connectivity status on auth requests |