AP Malls

Server Components load public catalog content close to the API, while focused Client Components handle cart updates, forms, dialogs, delivery actions, and POS interactions.

URL-backed search, category, sorting, filters, tabs, and pagination keep important views shareable and browser-navigation friendly.

Next Route Handlers act as a backend-for-frontend layer, forwarding authenticated requests without exposing the Laravel bearer token to browser JavaScript.

Reusable providers coordinate authentication, cart, and wishlist state; optimistic cart updates are reconciled against authoritative backend totals.

Versioned `/api/v1` controllers keep transport concerns separate from services that implement catalog, checkout, stock, POS, payment, delivery, and access-control behavior.

Service contracts and dependency injection keep domain operations replaceable and testable, while API Resources normalize response shapes for frontend consumers.

Eloquent models, migrations, factories, and seeders define the database lifecycle and provide repeatable local or disposable environments.

Critical writes use database transactions, row locking, status guards, and idempotency keys to avoid duplicated stock or payment effects.

Laravel Sanctum issues API tokens that the Next.js layer stores in an httpOnly, same-site cookie and forwards only from server-side route handlers.

Spatie Permission models capabilities with `module.action` names; Laravel middleware remains authoritative even when the frontend hides an action.

Super Admin and self-protection rules prevent accidental demotion, deletion, deactivation, or destructive edits to access-critical records.

Customer shopping actions, staff workspaces, Cashier POS isolation, and Delivery Boy ownership checks are all role-aware.

Categories are limited to parent and subcategory levels. Products belong to an active leaf category, while selecting a parent returns products from all active descendants.

Search, category, pricing, brand, feature flags, sorting, and pagination are composed by the backend so totals stay accurate.

The stocks table is authoritative; product quantity is maintained only as a compatibility mirror.

Product creation, checkout, POS sales, cancellations, received purchases, returns, and manual adjustments all pass through transactional stock services.

Customers maintain server-backed carts and wishlists, save addresses, place orders, and track fulfillment from their account.

Cashiers work only inside POS, open their assigned register session, search or scan products, hold and recall bills, collect payment, and print receipts.

Prices, product discounts, taxes, and totals are derived by backend services rather than trusted from browser payloads.

Completed POS orders can be adjusted through controlled order-edit flows that preserve prior payments and collect only any additional balance.

Delivery Boys accept, reject, pick up, and move assignments out for delivery through ordered state transitions and ownership checks.

Reporting a handover does not complete the order. The Customer confirms receipt in My Orders or provides a five-minute, hashed one-time code to the courier.

Customer disputes lock reassignment until an authorized manager either confirms the handoff with remarks or reopens the order for delivery.

Finalization is row-locked and idempotent so a COD confirmation creates exactly one completed Cash payment.

Products can receive settings-backed generated barcodes or manually entered values, with the generation source and barcode type preserved.

Active label templates control dimensions and content for bulk printable barcode pages, including QR-capable layouts.

POS receipts use a compact 80mm print layout; staff order details render a separate A4 invoice instead of printing the responsive management screen.

Image processing, PDF tooling, and spreadsheet export packages are available for media normalization and operational outputs.