Controllers

Tripfy Africa organises its controllers into two main namespaces:

App\Http\Controllers\Api — JSON endpoints consumed by the mobile app
App\Http\Controllers\User — Blade-rendered web dashboard for travellers and vendors

API controllers
Web (User) controllers

All API controllers live in app/Http/Controllers/Api/. They return JSON and use Laravel Sanctum token authentication on protected routes.

AuthController

File: app/Http/Controllers/Api/AuthController.phpHandles mobile/SPA authentication via Sanctum tokens.

Method	Route	Auth	Description
`POST`	`/api/v1/auth/register`	—	Register a new traveller account
`POST`	`/api/v1/auth/login`	—	Authenticate and receive a Sanctum token
`GET`	`/api/v1/auth/me`	Required	Return the authenticated user’s profile
`POST`	`/api/v1/auth/logout`	Required	Revoke the current device token
`POST`	`/api/v1/auth/logout-all`	Required	Revoke tokens on all devices

Register validation

public function register(Request $request): JsonResponse
{
    $validated = $request->validate([
        'firstname' => ['required', 'string', 'max:100'],
        'lastname'  => ['required', 'string', 'max:100'],
        'email'     => ['required', 'email', 'max:255', 'unique:users,email'],
        'password'  => ['required', 'confirmed', Password::min(8)->mixedCase()->numbers()],
        'phone'     => ['nullable', 'string', 'max:20'],
    ]);
    // Creates user, issues 'mobile-app' token
    $token = $user->createToken('mobile-app')->plainTextToken;
    return response()->json(['token' => $token, ...], 201);
}

Login behaviour

public function login(Request $request): JsonResponse
{
    // Revokes previous mobile tokens before issuing a new one
    $user->tokens()->where('name', 'mobile-app')->delete();
    $token = $user->createToken('mobile-app')->plainTextToken;
    // Returns 403 if user status == 0 (suspended)
}

PackageController

File: app/Http/Controllers/Api/PackageController.phpProvides read-only tour listings. Write operations remain in the web dashboard.

Method	Route	Auth	Description
`GET`	`/api/v1/packages`	—	List active packages with filtering and pagination
`GET`	`/api/v1/packages/{slug}`	—	Full detail for a single package
`GET`	`/api/v1/packages/categories`	—	List active package categories
`GET`	`/api/v1/packages/featured`	—	Featured packages for the home screen carousel

Supported query parameters for index

Parameter	Type	Description
`destination_id`	integer	Filter by destination
`category_id`	integer	Filter by category
`min_price`	float	Minimum adult price
`max_price`	float	Maximum adult price
`search`	string	Keyword match on `title` or `description`
`sort`	string	`price_asc`, `price_desc`, `rating`, or `newest` (default)
`per_page`	integer	Items per page (max 50, default 12)

Listing filter example

public function index(Request $request): JsonResponse
{
    $query = Package::with(['category:id,name', 'destination:id,title,slug', 'owner:id,firstname,lastname,image,image_driver', 'media'])
        ->where('status', 1)
        ->whereHas('owner', fn($q) => $q->whereHas('activePlan'));

    if ($request->filled('destination_id')) {
        $query->where('destination_id', (int) $request->destination_id);
    }
    // ... additional filters
    match ($request->input('sort', 'newest')) {
        'price_asc'  => $query->orderBy('adult_price', 'asc'),
        'price_desc' => $query->orderBy('adult_price', 'desc'),
        'rating'     => $query->orderByDesc('is_featured'),
        default      => $query->orderByDesc('created_at'),
    };
}

Only packages whose owner has an active plan (activePlan relationship) appear in API listings.

BookingController

File: app/Http/Controllers/Api/BookingController.phpAllows travellers to view and manage their bookings. Payment processing happens through the web checkout flow.

Method	Route	Auth	Description
`GET`	`/api/v1/bookings`	Required	Paginated list of the authenticated user’s bookings
`GET`	`/api/v1/bookings/{uid}`	Required	Single booking detail (scoped to owner)
`POST`	`/api/v1/bookings/{uid}/cancel`	Required	Cancel a pending (`0`) or confirmed (`1`) booking
`GET`	`/api/v1/bookings/availability`	—	Check remaining spaces for a package on a date

Cancel logic

public function cancel(Request $request, string $uid): JsonResponse
{
    $booking = Booking::where('uid', $uid)
        ->where('user_id', $request->user()->id)  // scoped to owner
        ->firstOrFail();

    if (!in_array($booking->status, [0, 1])) {
        return response()->json(['message' => 'This booking cannot be cancelled in its current status.'], 422);
    }

    $booking->update(['status' => 3]); // 3 = cancelled
}

Availability check query parameters

Parameter	Validation
`package_slug`	required, string
`date`	required, date, after_or_equal:today

ReviewController

File: app/Http/Controllers/Api/ReviewController.phpOnly users with a confirmed or completed booking can submit a review.

Method	Route	Auth	Description
`GET`	`/api/v1/packages/{slug}/reviews`	—	Paginated approved reviews for a package
`POST`	`/api/v1/reviews`	Required	Submit a review (requires qualifying booking)

Review submission validation

public function store(Request $request): JsonResponse
{
    $validated = $request->validate([
        'package_id' => ['required', 'integer', 'exists:packages,id'],
        'rating'     => ['required', 'integer', 'min:1', 'max:5'],
        'comment'    => ['required', 'string', 'min:10', 'max:1000'],
    ]);

    // Verify qualifying booking (status 1 or 2)
    $hasBooking = Booking::where('user_id', $user->id)
        ->where('package_id', $validated['package_id'])
        ->whereIn('status', [1, 2])
        ->exists();

    // Submitted reviews start with status=0 (pending admin approval)
    Review::create([..., 'status' => 0]);
}

UserController

File: app/Http/Controllers/Api/UserController.phpLets the mobile app read and update the authenticated user’s profile.

Method	Route	Auth	Description
`GET`	`/api/v1/user/profile`	Required	Full profile including vendor info and active plan
`PUT`	`/api/v1/user/profile`	Required	Update profile fields
`PUT`	`/api/v1/user/password`	Required	Change password and revoke all tokens
`GET`	`/api/v1/user/stats`	Required	Booking statistics for the dashboard summary

Password change — revokes all tokens

public function changePassword(Request $request): JsonResponse
{
    // Validates current password, then:
    $user->update(['password' => Hash::make($validated['password'])]);
    $user->tokens()->delete(); // force re-login on all devices
}

DestinationController

File: app/Http/Controllers/Api/DestinationController.php

Method	Route	Auth	Description
`GET`	`/api/v1/destinations`	—	All active destinations ordered by visitor count
`GET`	`/api/v1/destinations/{slug}`	—	Destination detail with up to 20 featured packages

public function index(Request $request): JsonResponse
{
    $destinations = Destination::where('status', 1)
        ->withCount('visitor')
        ->orderByDesc('visitor_count')
        ->get();
}

All web controllers live in app/Http/Controllers/User/. They serve Blade views and use the auth middleware.

HomeController

File: app/Http/Controllers/User/HomeController.phpApplies the auth middleware in its constructor. Handles the user dashboard, profile management, KYC, and transaction history.

public function __construct()
{
    $this->middleware(['auth']);
    $this->middleware(function ($request, $next) {
        $this->user = auth()->user();
        return $next($request);
    });
}

Method	Route name	Description
`index()`	`user.dashboard`	Dashboard with booking and tour stats
`profile()`	—	Edit profile form
`profileUpdate()`	—	Save profile changes
`profileUpdateImage()`	—	Upload a new profile picture
`updatePassword()`	—	Change password
`transaction()`	—	Transaction history overview
`transactionSearch()`	—	DataTables AJAX search for transactions
`paymentLog()`	—	Payment (deposit) history
`paymentLogSearch()`	—	DataTables AJAX search for deposits
`addFund()`	—	Add-fund gateway selection page
`bookings()`	—	JSON — monthly booking counts for chart
`packages()`	—	JSON — top packages by views or sells
`bookingCalender()`	—	JSON — booking counts per day for calendar
`becomeVendor()`	—	Submit KYC to request vendor role
`kycSettings()`	—	KYC submission history
`fetchState()`	—	AJAX — states for a given country
`fetchCity()`	—	AJAX — cities for a given state
`deleteAccount()`	—	Soft-delete the authenticated user’s account
`saveToken()`	—	Save FCM device token for push notifications

Dashboard chart data

public function index()
{
    $data['charts'] = [
        [
            'title'        => 'Upcoming Tour',
            'total'        => $user->booking()->where('status', 5)->whereDate('date', '>=', now())->count(),
            'from_total'   => $user->booking()->whereIn('status', [1, 2, 3, 4, 5])->count(),
            'permission'   => '0'  // travellers only
        ],
        [
            'title'        => 'Today Tour',
            'total'        => $user->vendorBooking()->whereIn('status', [1,2,3,4])->whereDate('date', now())->count(),
            'permission'   => '1'  // vendors only
        ],
        // ...
    ];
}

User\BookingController

File: app/Http/Controllers/User/BookingController.phpHandles booking lists and status changes for both travellers and vendors.

Method	Description
`bookingList()`	Traveller’s booking list with completion / refund statistics
`bookingListSearch()`	DataTables AJAX — traveller bookings with filters
`vendorBookingList()`	Vendor’s received bookings with date-range statistics
`vendorBookingListSearch()`	DataTables AJAX — vendor bookings with filters
`viewBooking($uid)`	Full booking detail (accessible by vendor or traveller)
`acceptBooking(Request, $uid)`	Accept (`confirm=1`) or reject (`confirm=0`) a pending booking
`refundBooking($uid)`	Mark a booking as refunded (vendor only)
`completeBooking(Request, $uid)`	Mark a booking as completed (vendor only)

Accept/reject booking

public function acceptBooking(Request $request, $uid)
{
    // Security: scoped to packages owned by the authenticated vendor
    $booking = Booking::with(['user', 'package'])
        ->where('uid', $uid)
        ->where('status', 5)
        ->whereHas('package', function ($query) {
            $query->where('status', 1)->where('owner_id', auth()->id());
        })
        ->firstOrFail();

    if ($request->confirm == 1) {
        $booking->status = 1; // accepted
        $this->sendBookingEmailToGuide($booking);
    } elseif ($request->confirm == 0) {
        $booking->status = 3; // rejected
    }
}

Booking status badges

Status	Badge label
`1` and date in future	Tour Pending
`2`	Completed
`3`	Rejected
`4`	Refunded
`5` and date in future	Pending
other	Expired

User\PackageController

File: app/Http/Controllers/User/PackageController.phpFull CRUD for vendor-owned tour packages, including AI-assisted content generation.

Method	Description
`list()`	Package list with weekly / monthly / active statistics
`search()`	DataTables AJAX — filterable package list
`add()`	Create package form
`store(Request)`	Save a new package (checks plan quota)
`edit($id)`	Edit package form
`update(Request, $id)`	Save package edits (sets status to `2` = resubmitted)
`delete($id)`	Delete package and its media
`deleteMultiple(Request)`	Bulk delete
`discount(Request, $id)`	Apply a percentage or fixed discount
`packageSEO($id)`	SEO settings form
`packageSeoUpdate(Request, $id)`	Save SEO metadata
`featuredRequest(Request)`	Request featured listing (requires active plan)
`generate(Request)`	AI text generation via OpenAI or Gemini
`generateImage(Request)`	AI image generation

Plan quota check on store

public function store(Request $request)
{
    $vendor = VendorInfo::where('vendor_id', auth()->id())->first();
    $freeLimit = basicControl()->free_listing ?? 1;

    if ($vendor->posted_listing >= $freeLimit) {
        // Must have an unexpired active plan with remaining listing slots
        $remainingListings = $plan->listing_allowed - $vendor->current_plan_posted_listing;
        if ($remainingListings <= 0) {
            return back()->with('error', 'You have used all your paid listings.');
        }
    }
}

AI generation

public function generate(Request $request)
{
    if (isAiAccess()) {
        if ($basicControl->open_ai_status) {
            $res = (new OpenAiService())->generateRes($request);
        } elseif ($basicControl->gemini_status) {
            $res = (new GeminiService())->generateRes($request);
        }
    }
    return response()->json($res);
}

Other User controllers

Controller	Key responsibilities
`DepositController`	Payment gateway selection and booking payment submission
`PayoutController`	Vendor payout requests and method management
`PlanController`	Vendor subscription plan purchase
`ReviewController`	Submit and manage package reviews
`KycVerificationController`	Upload KYC documents for identity verification
`GuideController`	Manage guide profiles attached to packages
`SupportTicketController`	Create and reply to support tickets
`ChattingController`	Package-level chat between travellers and vendors
`NotificationController`	In-app notification preferences and list
`VerificationController`	Email verification flow
`SocialiteController`	OAuth social login (Google, etc.)
`SubscriptionController`	Newsletter subscription management
`PaymentGatewayController`	Per-user gateway configuration for payouts

Middleware

Middleware	Applied to
`auth:sanctum`	All protected API routes
`auth`	All User controller routes
`throttle:60,1`	Public API endpoints (60 requests per minute)

Response format

API controllers return a consistent JSON envelope:

// Success
return response()->json([
    'data'    => $resource,
    'message' => 'Operation successful.',
], 200);

// Paginated
return response()->json([
    'data' => $items,
    'meta' => [
        'current_page' => $paginator->currentPage(),
        'last_page'    => $paginator->lastPage(),
        'per_page'     => $paginator->perPage(),
        'total'        => $paginator->total(),
    ],
]);

// Error
return response()->json(['message' => 'Reason for failure.'], 422);

Web controllers use Laravel’s back()->with('success', ...) and back()->with('error', ...) flash conventions for form feedback, and DataTables::of(...) for AJAX table responses.

Get Started

Requirements & Design

Backend

Frontend

Database

Deployment

Troubleshooting

AuthController

PackageController

BookingController

ReviewController

UserController

DestinationController

HomeController

User\BookingController

User\PackageController

Other User controllers

Middleware

Response format

Build docs developers (and LLMs) love

Get Started

Requirements & Design

Backend

Frontend

Database

Deployment

Troubleshooting

​AuthController

​PackageController

​BookingController

​ReviewController

​UserController

​DestinationController

​HomeController

​User\BookingController

​User\PackageController

​Other User controllers

​Middleware

​Response format

Build docs developers (and LLMs) love

AuthController

PackageController

BookingController

ReviewController

UserController

DestinationController

HomeController

User\BookingController

User\PackageController

Other User controllers

Middleware

Response format