# Laravel 12 Local Upgrade Analysis ## Scope And Rule This analysis is local-only for `c:\Users\Fatih\Desktop\new\markest-local\propturk`. No live server work is allowed. No application code, dependency, environment, database, or asset change should be made without explicit user approval. The local skill for this work is: - `docs/skills/laravel-12-local-upgrade/SKILL.md` ## Current Baseline - Laravel: `8.83.29` - PHP CLI: `8.2.29` - Composer: `2.9.5` - Node: `20.20.2` - npm: `10.8.2` - `composer validate --no-check-publish`: passes - `php artisan route:list`: passes - `php artisan view:cache`: passes - `php artisan test`: passes, but only 2 default example tests exist - Route count observed by agent analysis: 94 total - Files under `app`, `routes`, `resources`, `config`, `database`, `tests`: 230 - Blade views under `resources/views`: 91 The worktree is already heavily dirty. Preserve all existing changes before any upgrade implementation. ## Project Purpose The project is a Laravel-based real estate tender/listing platform. Core business behavior: - Public visitors browse real estate tenders/listings. - Users register, log in, activate accounts by SMS, request tender permission, favorite listings, bid on tenders, and use fast buy. - Admin users manage banks, documents/contracts, users, listings/properties, listing images, archive files, logs, and tender PDF reports. - The system sends mail and SMS notifications for tender permissions, bid changes, winners, losers, reminders, and activation. - Realtime bid updates use Laravel broadcasting with Echo/Pusher-compatible WebSocket behavior. - External/API consumers authenticate with JWT and fetch realty data. ## Core Data Map - `users`: registered users, admins, activation/SMS state, slugs, company data. - `banks`: bank accounts, bank codes/subdomains, deposit settings, active/completed tender visibility. - `properties`: real estate details, address fields, property type fields, slugs. - `posts`: tender/listing wrapper for properties, prices, duration, status, bank relation, image folder, contracts, archive folder. - `offers`: bids by user and post. - `post_user`: users permitted for posts/tenders. - `documents`: bank/propturk contracts used for permission/custom mail and PDF attachments. - `notification_logs`: mail/SMS log records. - `archive_files`: files stored under post archive folders and optionally tied to notification logs. - `post_views`: listing view tracking. - `cities`, `districts`, `neighborhoods`: address filters and AJAX address dropdowns. - `jobs`, `failed_jobs`: queue processing. - `personal_access_tokens`: Sanctum table, although active API auth uses JWT. Important current DB risk: - `2022_12_21_183247_add_archive_folder_to_posts_table` is pending locally. - Code uses `posts.archive_folder` in archive upload/download/delete flows. - This must be resolved or intentionally documented before upgrade verification. ## Page And Workflow Coverage ### Public - `/` -> `HomeController@index` -> `resources/views/home/index.blade.php` - `/search` -> `HomeController@searchFilter` -> `home.index` or `search.search-result` - `/ihaleler/{slug}` -> `HomeController@show` -> `resources/views/property/index.blade.php` - `/v/{slug}` -> `HomeController@shortURLtoURL` - `/getDistrictshome/{id}` -> `HomeController@getDistrictsHome` - `/iletisim`, `/hakkimizda`, `/isimiz`, `/nasil-edinirim`, `/cerez-politikasi`, `/gizlilik-politikasi`, `/kvkk` Must preserve: - Bank/subdomain filtering from `DetectSubDomain` and `CheckPostBank` - Listing image access through `Storage::allFiles` / `Storage::url` - Favorite button AJAX - Search filters and address dropdowns - Completed/offered/non-offered listing sections ### Auth - `Auth::routes()` - Login, logout, register, password reset, password confirm - Views under `resources/views/auth` - Redirect behavior via `RouteServiceProvider::HOME` and `RedirectIfAuthenticated` Must preserve current Blade/bootstrap UI and existing custom fields in registration. ### User - `/kullanici/{slug}` -> profile - `/kullanici/{slug}/guncelle` -> edit profile - `/kullanici/ihaleler/{slug}` -> user tenders - `/kullanici/ihaleler/favoricrud/{slug}` and `/updateFavoritePosts/{slug}` -> favorites - `/kullanici/sms-aktivasyon/{slug}` -> SMS activation - `/ihaleler/{slug}` PUT -> bid - `/fastbuy/{slug}` -> fast buy - `/tenderUserPermissionMail/{slug}` -> tender permission mail/SMS/PDF flow Must preserve: - Active/inactive user gates - Tender authorization through `post_user` - Winner/loser/current bidder status display - Offer price validation and first-bid behavior - Notification logs and queued mail/SMS ### Admin - `/admin/home` dashboard - `/admin/banks` CRUD - `/admin/documents` CRUD - `/admin/properties` CRUD - `/admin/properties/image/{slug}` image upload/delete - `/admin/properties/clone/count/{id}` clone listing - `/admin/archive-files/{slug}` archive file upload/download/delete - `/admin/users` CRUD - `/admin/users/sendCustomMail/{user}` and custom mail send - `/admin/logs`, `/admin/logs/mailSms`, `/admin/logs/mailView/{log}`, mail PDF download - `/admin/tenderReportDownload/{id}` tender report PDF - `/admin/getbankId/{id}`, `/getDistricts/{id}`, `/getNeighborhoods/{id}` AJAX helpers Must preserve: - Admin role behavior: `is_admin` values 1 and 2 - Policies for property permissions - DataTables/summernote/dropzone/lightbox/date/mask plugins - Property create/edit partials for property types 1, 2, 3 - Image compression through Intervention Image `Image::make` - Contract selection by bank and propturk documents - Archive files tied to `posts.archive_folder` ### API - `POST /api/rest/user/authenticate` - `GET /api/rest/realty/all` behind `jwt.verify` Must preserve: - JWT response format - Protected endpoint behavior - Realty payload shape expected by consumers - Image URL generation Current code risk: - `routes/api.php` imports `ApiController` but references `APIController::class`. Windows allows this; it should be normalized during an approved compatibility pass. ### Realtime - `routes/channels.php` authorizes `posts.{postId}` by checking `Post::users` - `TenderOfferValueUpdateEvent` broadcasts bid changes - `resources/js/bootstrap.js` configures Echo/Pusher - `resources/views/property/index.blade.php` listens to private bid update events - `beyondcode/laravel-websockets` registers dashboard/statistics routes Must preserve: - Private channel authorization - Live bid price/winner/loser UI updates - Current Pusher-compatible client behavior - Local WebSocket replacement must be tested before Laravel 12 can be called safe ### Background Work - `tender:everyminute` checks active tenders, closes expired tenders, sends winner/loser notifications. - `tender:offerrequest` reminds permitted users who did not bid. - Scheduler runs both commands and runs `queue:work --once` every minute. - Mail classes under `app/Mail` - SMS helper under `app/Helpers/SmsSend.php` Must preserve: - Queue behavior - Mail templates - SMS text generation - Notification log creation - Tender status transitions ## Laravel 12 Package Blockers Direct blockers from `composer why-not laravel/framework ^12.0`: - `laravel/framework` currently pinned to `^8.83.27` - `barryvdh/laravel-dompdf` current version supports through Laravel 11 - `beyondcode/laravel-websockets` supports through Laravel 10 and is abandoned - `cviebrock/eloquent-sluggable` current version is Laravel 8-only - `fruitcake/laravel-cors` supports through Laravel 9 and is abandoned - `laravel/sanctum` current version supports through Laravel 9 - `laravel/ui` current version supports Laravel 8/9 - `spatie/laravel-sitemap` current version supports through Laravel 10 - `tymon/jwt-auth` current installed line supports through Laravel 9 - `facade/ignition`, old `collision`, old `sail`, Symfony 5, Flysystem 1, Monolog 2, Carbon 2, SwiftMailer-era mail stack Behavior-preserving package decisions needed before code changes: - WebSockets: choose Laravel Reverb or another Pusher-compatible replacement. - JWT: prove a Laravel 12-compatible `tymon/jwt-auth` path or replace with behavior-compatible JWT auth. - CORS: remove Fruitcake and use framework CORS while preserving config behavior. - Sluggable: upgrade/replace while preserving existing slug source behavior. - DOMPDF: choose a Laravel 12-compatible version/replacement and verify PDFs. - Laravel UI: keep generated Blade auth behavior; package may be removed after routes/views are preserved. - Intervention Image: avoid major API change unless image upload code is adapted and verified. ## Safe Upgrade Strategy Do not jump directly from Laravel 8 to 12. Use staged local branches or checkpoints: 1. Laravel 8 to 9. 2. Laravel 9 to 10. 3. Laravel 10 to 11. 4. Laravel 11 to 12. At every stage: - Run `composer validate`. - Run `composer why-not laravel/framework ^next`. - Run `php artisan --version`. - Run `php artisan route:list`. - Run `php artisan view:cache`. - Run tests. - Compare route names/URIs/middleware to baseline. - Check the critical page/workflow list below. Prefer preserving the legacy Laravel app skeleton first. Do not combine framework upgrade with Laravel 12 skeleton modernization unless separately approved. ## Required Local Verification Matrix Minimum local checks before any Laravel 12-ready claim: - Home page renders. - Search filters render and submit. - Listing detail renders for at least one active listing. - Login works. - Register works. - User profile opens. - SMS activation page opens and validation behavior is checked. - Favorite add/remove works. - Tender permission mail flow works. - Bid flow works. - Fast buy works. - Admin dashboard opens. - Banks CRUD works. - Documents CRUD works. - Properties index/create/edit/show/delete works. - Property image upload/delete works. - Property clone works. - Tender status active/passive works. - Archive upload/download/delete works. - Users CRUD works. - Custom mail with contract PDFs works. - Logs and log detail pages work. - Tender report PDF downloads and opens. - JWT authenticate works. - Protected realty API works. - Broadcast auth works. - Live bid event updates UI. - Scheduler commands run locally. - Queue worker processes one queued mail. - Sitemap/static assets/storage links remain valid. ## No-Approval Boundary Allowed before approval: - Read files. - Run local read-only diagnostics. - Run safe local verification commands. - Create or update documentation under `docs/`. Not allowed before approval: - Modify application code. - Modify Composer dependencies. - Run migrations that change the local DB. - Change `.env`. - Replace WebSocket/JWT/PDF packages. - Delete or revert existing user changes. ## Current Verdict Laravel 12 upgrade is possible, but not ready to implement yet. The safe next step is to freeze the current local baseline and build automated/manual verification around the routes, pages, models, tables, and workflows listed here. After that, implementation can proceed stage by stage with explicit approval for each risky package decision.