Skip to main content

Introduction

The Restaurant Management System is built on Laravel 11 and provides a comprehensive web application with role-based access control. The system manages restaurant operations including menu management, table reservations, orders, and staff coordination.
This application uses Laravel Sanctum for authentication with Jetstream integration. While primarily a web application, it follows RESTful conventions and can be extended for API usage.

Architecture

The application follows Laravel’s MVC architecture with the following key components:
  • Authentication: Laravel Sanctum + Jetstream (Livewire stack)
  • Authorization: Role-based access control using Spatie Laravel Permission + custom middleware
  • Database: Eloquent ORM with migrations
  • Frontend: Blade templates with Livewire components

Supported User Roles

The system supports four distinct user roles:
  1. Guest - Public access to menu browsing
  2. Customer (authenticated) - Can place orders, manage cart, make reservations
  3. Chef - Manages food menu items and their profile
  4. Mesero (Waiter) - Manages tables and reservations
  5. Admin - Full system access including user management, orders, and reports

Response Formats

All responses follow standard Laravel conventions:

Successful Responses

Web Routes: Returns rendered HTML views or redirects with session flash messages:
// Success redirect
return redirect()->route('home')->with('success', 'Order created successfully. ID: 123');

// View response
return view('comidaview', compact('foods', 'count'));
JSON Responses (for API-compatible endpoints):
{
  "success": true,
  "message": "Operation completed successfully",
  "data": {
    "id": 1,
    "name": "Example"
  }
}

Error Responses

Validation Errors (HTTP 422):
{
  "message": "The given data was invalid.",
  "errors": {
    "email": [
      "The email field is required."
    ],
    "password": [
      "The password must be at least 8 characters."
    ]
  }
}
Authorization Errors (HTTP 403):
{
  "message": "No tienes permiso para acceder a esta página. (sin-rol)"
}
Authentication Errors (HTTP 401):
  • Redirects to /login route for web requests
  • Returns null for JSON requests (expectsJson)

Endpoint Structure by Role

Public Endpoints

No authentication required:
MethodEndpointControllerDescription
GET/HomeController@indexHome page with food listings
GET/menuHomeController@comidaviewFull menu view (paginated)
GET/comidaviewHomeController@comidaviewAlternative menu route
GET/infocomida/{food}HomeController@infocomidaFood item details

Authenticated Customer Endpoints

Requires auth middleware:
MethodEndpointControllerDescription
GET/redirectsHomeController@redirectsPost-login role-based redirect
GET/cartCartController@indexView shopping cart
POST/cart/{food}CartController@storeAdd item to cart
DELETE/cart/{cart}CartController@destroyRemove cart item
POST/orderconfirmHomeController@orderConfirmConfirm and create order
Cart operations are only available to authenticated users. The cart is user-specific and persists in the database.

Admin Endpoints

Prefix: /admin | Middleware: auth, role:admin

User Management

MethodEndpointControllerDescription
GET/admin/usersAdminController@userList all users
POST/admin/usersAdminController@createUserCreate new user
POST/admin/users/{id}AdminController@updateUserUpdate user
DELETE/admin/users/{id}AdminController@deleteuserDelete user

Food Menu Management

MethodEndpointControllerDescription
GET/admin/foodmenuAdminController@foodmenuList all menu items
POST/admin/foodmenuAdminController@uploadfoodCreate menu item
GET/admin/foodmenu/{id}/editAdminController@updateviewEdit form
POST/admin/foodmenu/{id}AdminController@updateUpdate menu item
DELETE/admin/foodmenu/{id}AdminController@deletemenuDelete menu item

Chef Management

MethodEndpointControllerDescription
GET/admin/chefsAdminController@viewchefList all chefs
POST/admin/chefsAdminController@uploadchefCreate chef
PUT/admin/chefs/{id}AdminController@updatechefUpdate chef
DELETE/admin/chefs/{id}AdminController@deletechefDelete chef

Table Management

MethodEndpointControllerDescription
GET/admin/tablesTableController@indexList all tables
POST/admin/tablesTableController@storeCreate table
PUT/admin/tables/{id}TableController@updateUpdate table
DELETE/admin/tables/{id}TableController@destroyDelete table
POST/admin/tables/{id}/mark-as-usedTableController@markAsUsedMark table as occupied

Reservations

MethodEndpointControllerDescription
GET/admin/reservationsAdminController@viewreservationList reservations
POST/admin/reservations/{reservationId}/assign-tableAdminController@assignTableAssign table to reservation

Orders

MethodEndpointControllerDescription
GET/admin/ordersAdminController@ordersList all orders
GET/admin/orders/searchAdminController@searchSearch orders

Chef Endpoints

Prefix: /chef | Middleware: auth, role:chef
MethodEndpointControllerDescription
GET/chef/profileChefController@showProfileView profile
POST/chef/profileChefController@storeProfileCreate profile
POST/chef/profile/updateChefController@updateProfileUpdate profile
GET/chef/menuChefController@cheffoodmenuList menu items
POST/chef/menuChefController@uploadfoodchefCreate menu item
GET/chef/menu/{id}/editChefController@chefupdateviewEdit form
POST/chef/menu/{id}ChefController@updatechefUpdate menu item
DELETE/chef/menu/{id}ChefController@chefdeletemenuDelete menu item

Mesero (Waiter) Endpoints

Prefix: /mesero | Middleware: auth, role:mesero
MethodEndpointControllerDescription
GET/mesero/homeViewDashboard home
GET/mesero/tablesMeseroController@viewTablesList tables
POST/mesero/tablesMeseroController@storeTableCreate table
PUT/mesero/tables/{id}MeseroController@updateTableUpdate table
DELETE/mesero/tables/{id}MeseroController@deleteTableDelete table
POST/mesero/tables/{id}/mark-as-usedTableController@markAsUsedMark table as used
GET/mesero/reservationsMeseroController@meseroviewreservationView reservations
POST/mesero/reservations/{reservationId}/assign-tableMeseroController@assignTableAssign table

Unified Admin Panel Endpoints

Prefix: /admin | Middleware: auth, role:admin,chef,mesero
The unified admin panel provides a single dashboard accessible to admin, chef, and mesero roles with role-specific permissions enforced at the route level.
MethodEndpointRolesControllerDescription
GET/admin/dashboardadmin, chef, meseroAdmin\DashboardController@indexMain dashboard
Resource/admin/usersadminAdmin\UserControllerUser CRUD
Resource/admin/chefsadminAdmin\ChefControllerChef CRUD
Resource/admin/foodsadmin, chefAdmin\FoodControllerFood menu CRUD
Resource/admin/tablesadmin, meseroAdmin\TableControllerTable CRUD
POST/admin/tables/{table}/mark-as-usedadmin, meseroAdmin\TableController@markAsUsedMark table used
GET/admin/reservationsadmin, meseroAdmin\ReservationController@indexList reservations
POST/admin/reservations/{reservation}/assign-tableadmin, meseroAdmin\ReservationController@assignTableAssign table
DELETE/admin/reservations/{reservation}admin, meseroAdmin\ReservationController@destroyDelete reservation
GET/admin/ordersadminAdmin\OrderController@indexList orders
GET/admin/orders/{order}adminAdmin\OrderController@showView order
GET/POST/etc/admin/profileadmin, chefAdmin\ProfileControllerProfile management

Order Confirmation Format

The /orderconfirm endpoint (routes/web.php:44) accepts two payload formats:
{
  "name": "John Doe",
  "phone": "+1234567890",
  "address": "123 Main St",
  "items": [
    {
      "food_id": 1,
      "quantity": 2
    },
    {
      "food_id": 3,
      "quantity": 1
    }
  ]
}

Legacy Format

POST /orderconfirm

name=John Doe
phone=+1234567890
address=123 Main St
foodname[]=Pizza
foodname[]=Burger
price[]=15.99
price[]=12.99
quantity[]=2
quantity[]=1
The legacy format is maintained for backward compatibility but the structured JSON format is recommended for all new integrations.

Route Model Binding

The application uses Laravel’s route model binding extensively:
// Automatic model resolution
Route::get('/infocomida/{food}', [HomeController::class, 'infocomida']);

// Controller receives Food model instance
public function infocomida(Food $food)
{
    return view('infocomida', compact('food'));
}

Pagination

List endpoints return paginated results:
  • Home page: 12 items per page (routes/web.php:25)
  • Menu view: 24 items per page (routes/web.php:69)
  • Standard Laravel pagination links included in views

CSRF Protection

All POST, PUT, PATCH, and DELETE requests require CSRF token validation:
<form method="POST" action="/cart/1">
    @csrf
    <!-- form fields -->
</form>
CSRF protection is enforced by App\Http\Middleware\VerifyCsrfToken (config/sanctum.php:80)

Next Steps

Authentication

Learn about Laravel Sanctum authentication, role-based access, and middleware

Admin Controller

Detailed documentation for administrator endpoints

Chef Controller

Chef-specific menu management operations

Waiter Controller

Waiter endpoints for tables and reservations

Build docs developers (and LLMs) love