CMS Framework - v2.2.2

This document provides a comprehensive overview of all registered routes in the CMS Framework.

Route Organization

All API routes are organized by module and follow RESTful conventions where applicable.

Base Prefix

All routes are prefixed with /api/cms (configured in the consuming application).

Middleware

• Authentication: Most routes require auth:sanctum middleware
• Authorization: Enforced through Laravel policies in controllers

Users Module

Base Path: /api/cms

User Management

Standard RESTful resource routes:

Role Management

Standard RESTful resource routes:

Permission Management

Standard RESTful resource routes:

Middleware: auth

Blog Module

Base Path: /api/cms Middleware: auth

Posts

Post Archives

Special archive routes for filtering posts:

Post Categories

Post Tags

Pages Module

Base Path: /api/cms Middleware: auth

Structure identical to Blog module with pages instead of posts:

• /pages - Standard CRUD operations
• /pages/bulk - Bulk page actions (delete, publish, draft)
• /page-categories - Category management
• /page-tags - Tag management

Content Types Module

Base Path: /api/cms Middleware: auth

Content Types

Standard RESTful resource routes for managing custom content types.

Custom Fields

Standard RESTful resource routes for managing custom fields attached to content types.

Taxonomies

Standard RESTful resource routes for managing taxonomies (categories, tags, etc.).

Notifications Module

Base Path: /api/cms/notifications Middleware: auth:sanctum

Plugins Module (Experimental)

Base Path: /api/v1/plugins Middleware: auth

Themes Module (Experimental)

Base Path: /api/cms/themes Middleware: auth

Standard RESTful resource routes for theme management.

Settings Module

Base Path: /api/cms/settings Middleware: auth

Standard RESTful resource routes for application settings management.

Site Settings (2.0.0)

Base Path: /api/v1/settings/site Middleware: auth:sanctum

WP-shape envelope over the built-in site.* settings (title, tagline, URL, logo, icon).

See settings/Site Settings for the envelope shape.

Site Editor Module (2.0.0)

Base Path: /api/v1/ Middleware: auth:sanctum

The Site Editor module exposes WP-shape endpoints for templates, parts, patterns, global styles, and menus. See site-editor/API Reference for the full listing and response shapes.

Templates and Template Parts

Patterns

Global Styles

Menus

Themes Upload (2.0.0)

Base Path: /api/v1/themes Middleware: auth:sanctum

See themes/Installing From Zip for usage and validation behavior.

Route Registration

Routes are registered in each module's routes/api.php file and loaded by the module's service provider.

Example Service Provider Route Registration

public function boot(): void
{
    $this->loadRoutesFrom(__DIR__.'/../routes/api.php');
}

Route Naming Convention

Routes follow Laravel's standard naming convention:

• API Resources: users, roles, posts, etc.
• Named Routes: api.{resource}.{action}
• Example: api.notifications.markAsRead

Route Prefixing

Application-level route prefixing is configured in the consuming application's RouteServiceProvider:

Route::prefix('api/cms')
    ->middleware('api')
    ->group(base_path('routes/api.php'));

Authorization

All routes enforce authorization through Laravel policies:

// In controller
$this->authorize('update', $user);

Policies are registered in each module's service provider:

protected $policies = [
    User::class => UserPolicy::class,
    Role::class => RolePolicy::class,
];

Middleware Groups

API Middleware

Standard Laravel API middleware:

• throttle:api - Rate limiting (60 requests/minute)
• auth:sanctum - Sanctum token authentication

Custom Middleware

Modules can register custom middleware in their service providers.

Route Caching

For production environments, routes can be cached:

php artisan route:cache

To clear the cache:

php artisan route:clear

Testing Routes

Using Pest/PHPUnit

test('can list users', function() {
    $user = User::factory()->create();

    $response = $this->actingAs($user)
        ->getJson('/api/cms/users');

    $response->assertStatus(200);
});

Using cURL

curl -H "Authorization: Bearer YOUR_TOKEN" \
     https://example.com/api/cms/users

Future Considerations

Versioning

Future API versions will use versioned prefixes:

• /api/v1/cms/... (current default)
• /api/v2/cms/... (future)

Custom Routes

Applications can register additional routes by publishing and modifying route files.

See Also

• API Documentation
• Controller Documentation
• Authorization Policies
• Testing Guide