Project Structure

app/
├── Http/
│   ├── Controllers/
│   │   ├── Auth/                        # Authentication controllers
│   │   │   ├── AuthenticatedSessionController.php
│   │   │   ├── EmailVerificationNotificationController.php
│   │   │   ├── NewPasswordController.php
│   │   │   ├── PasswordResetLinkController.php
│   │   │   ├── RegisteredUserController.php
│   │   │   └── VerifyEmailController.php
│   │   └── Controller.php               # Base controller
│   ├── Middleware/
│   │   └── EnsureEmailIsVerified.php    # Email verification middleware
│   └── Requests/
│       └── Auth/
│           └── LoginRequest.php         # Login validation request
├── Models/
│   └── User.php                         # User Eloquent model
└── Providers/
    └── AppServiceProvider.php           # Application service provider

routes/
├── api.php          # Protected API routes (requires auth:sanctum)
├── auth.php         # Authentication routes (register, login, logout)
├── console.php      # Artisan console commands
└── web.php          # Web routes (minimal for API-only)

Route::middleware(['auth:sanctum'])->get('/user', function (Request $request) {
    return $request->user();
});

Route::post('/register', [RegisteredUserController::class, 'store'])
    ->middleware('guest');

Route::post('/login', [AuthenticatedSessionController::class, 'store'])
    ->middleware('guest');

Route::post('/logout', [AuthenticatedSessionController::class, 'destroy'])
    ->middleware('auth');

config/
├── app.php           # Application settings
├── auth.php          # Authentication configuration
├── cache.php         # Cache configuration
├── cors.php          # CORS settings for API
├── database.php      # Database connections
├── filesystems.php   # File storage configuration
├── logging.php       # Logging configuration
├── mail.php          # Email configuration
├── queue.php         # Queue configuration
├── sanctum.php       # Sanctum authentication config
├── services.php      # Third-party services
└── session.php       # Session configuration

return [
    'paths' => ['*'],
    'allowed_methods' => ['*'],
    'allowed_origins' => [env('FRONTEND_URL', 'http://localhost:3000')],
    'supports_credentials' => true,
];

database/
├── factories/
│   └── UserFactory.php                              # User model factory
├── migrations/
│   ├── 0001_01_01_000000_create_users_table.php     # Users table
│   ├── 0001_01_01_000001_create_cache_table.php     # Cache table
│   ├── 0001_01_01_000002_create_jobs_table.php      # Queue jobs table
│   └── 2026_02_06_051602_create_personal_access_tokens_table.php
└── seeders/
    └── DatabaseSeeder.php                           # Main seeder

tests/
├── Feature/
│   ├── Auth/
│   │   ├── AuthenticationTest.php
│   │   ├── EmailVerificationTest.php
│   │   ├── PasswordResetTest.php
│   │   └── RegistrationTest.php
│   └── ExampleTest.php
├── Unit/
│   └── ExampleTest.php
├── Pest.php          # Pest configuration
└── TestCase.php      # Base test case

storage/
├── app/              # Application files
├── framework/        # Framework cache and sessions
│   ├── cache/
│   ├── sessions/
│   └── views/
└── logs/             # Application logs
    └── laravel.log

bootstrap/
├── app.php           # Application bootstrap
├── cache/            # Bootstrap cache
└── providers.php     # Service providers cache

src/app/
├── (authenticated)/            # Protected routes group
│   ├── dashboard/
│   │   └── page.tsx           # Dashboard page
│   └── layout.tsx             # Authenticated layout with navigation
│
├── (guest)/                   # Guest routes group
│   ├── forgot-password/
│   │   └── page.tsx           # Forgot password page
│   ├── login/
│   │   └── page.tsx           # Login page
│   ├── password-reset/
│   │   └── [token]/
│   │       └── page.tsx       # Password reset page
│   └── register/
│       └── page.tsx           # Registration page
│
├── favicon.ico                # Application favicon
├── globals.css                # Global styles
├── layout.tsx                 # Root layout
├── not-found.tsx              # 404 page
└── page.tsx                   # Home page

src/components/
└── Layouts/
    ├── Navigation.tsx         # Main navigation component
    ├── GuestLayout.tsx        # Guest layout wrapper
    └── AppLayout.tsx          # Authenticated app layout

src/hooks/
└── auth.ts                    # useAuth hook for authentication

export const useAuth = ({
  middleware,
  redirectIfAuthenticated,
}: {
  middleware?: string
  redirectIfAuthenticated?: string
}) => {
  // SWR for user data fetching
  const { data: user, error, mutate } = useSWR('/api/user', ...)
  
  return {
    user,
    register,
    login,
    forgotPassword,
    resetPassword,
    resendEmailVerification,
    logout,
  }
}

src/lib/
└── axios.ts                   # Axios instance with base configuration

const axios: AxiosInstance = Axios.create({
  baseURL: process.env.NEXT_PUBLIC_BACKEND_URL,
  headers: {
    'X-Requested-With': 'XMLHttpRequest',
  },
  withCredentials: true,
  withXSRFToken: true,
})

src/types/
└── index.ts                   # Shared type definitions

public/
├── images/
├── icons/
└── favicon.ico