What makes a Laravel codebase expensive to maintain

Laravel makes it easy to build quickly, which also makes it easy to build badly. When we audit an inherited codebase, the same four issues account for most of the pain.

1. Business logic in controllers #

A controller should translate a request into a call and a response into a view. Once pricing rules or state machines live inside it, that logic cannot be reused by a queued job or a console command without duplication.

2. N+1 queries on every list view #

A list of fifty records that each lazily load two relations issues a hundred and one queries. It is invisible with ten rows of seed data and painful with real volume.

// Fails loudly in development rather than quietly in production.
Model::preventLazyLoading(! app()->isProduction());

3. Authorisation checked in the wrong place #

Route-level middleware answers "may this user reach this endpoint". It does not answer "may this user see this record". Enforce ownership at the query or policy layer, where it cannot be bypassed by a different entry point.

4. No tests on the paths that carry money #

Full coverage is rarely worth chasing. Coverage of checkout, billing, permissions and anything that writes financial records almost always is.