Routes and Middleware Reference

Where every route comes from, what wraps it, and the names to use so your plugin's routes sit comfortably next to the core's. To see the live list on a site, run php artisan route:list --path=admin/bookings (or any prefix).

Route files

File	Loaded	Contains
`routes/web.php`	By Laravel, in the `web` group	The two wrappers below, plus an installer compatibility route
`routes/admin.php`	Inside `AdminTheme`, prefix `config('dotartisan.admin_prefix')`, names `admin.*`	Every core admin screen, behind `auth`, `verified`, `2fa` and a `->can()` per route
`routes/admin_auth.php`	Required by `admin.php`	Admin sign-in, password reset and e-mail verification
`routes/front.php`	Inside `FrontTheme`	Home, contact, blog, category and tag pages, the demo showcase; requires `auth.php`
`routes/auth.php`	Required by `front.php`	Visitor sign-in, registration, password reset, social sign-in (localized)
`routes/app.php`	Inside `FrontTheme`	The signed-in visitor area `/user/*`: dashboard, profile, security, API tokens, teams, tickets
`routes/api.php`	By Laravel, prefix `api`, `api` group	One Sanctum endpoint: `GET /api/v1/whoami`
`routes/breadcrumbs.php`	By the breadcrumbs package	Breadcrumb definitions for core named routes
`routes/console.php`	By Laravel	Core schedule (`pages:refresh-bound` hourly)
`routes/channels.php`	By Laravel	The default private user channel (broadcasting is not used)
catch-all`{slug}`	`FrontendRoutingServiceProvider`, after every other route	`resolve.show`: pages, posts, Booking services and anything else with a resolvable slug
`Modules//routes/.php`	Each module's `RouteServiceProvider`	Never required from core route files

Middleware aliases

Alias	Purpose
`auth`, `guest`	Session authentication
`verified`	E-mail verified (Laravel)
`2fa`	Two-factor check for admin routes
`role`, `permission`, `role_or_permission`	Role and permission guards, for example `permission:access trupayments` on a group
`AdminTheme`	Admin theme, core sidebar and settings, then the `AdminBooting` event
`FrontTheme`	Public theme, compiled stylesheet URL, locale from the session, text direction
`doCache`, `doNotCache`	Response cache opt-in and opt-out
`RedirectIfInstalled`	Installer-only routes
`throttle:page-builder-ai`	The AI assistant's rate limiter

Two classes are used directly rather than by alias: App\Http\Middleware\TwoFactorMiddleware protects the public account area and the catch-all route, and App\Http\Middleware\DemoClearance runs in the web group and blocks write routes for the demo accounts when APP_DEMO is on.

Stacks to copy

Modules/Testimonials/app/Providers/RouteServiceProvider.php

use App\Http\Middleware\AdminTheme;
use App\Http\Middleware\FrontTheme;

public function map(): void
{
    // Admin screens: same protection as the core admin
    Route::middleware(['web', 'auth', 'verified', '2fa', AdminTheme::class])
        ->as('admin.testimonials.')
        ->prefix(config('dotartisan.admin_prefix', 'admin') . '/testimonials')
        ->group(module_path($this->name, '/routes/admin.php'));

    // Public pages
    Route::middleware(['web', FrontTheme::class])
        ->as('testimonials.')
        ->prefix('testimonials')                     // also list it in module.json "public_paths"
        ->group(module_path($this->name, '/routes/front.php'));
}

Inside the admin file, gate every route: Route::get('/', ...)->name('index')->can('manage testimonials');
Admin routes need AdminTheme or your pages render without the sidebar and without your settings links.
Public routes need FrontTheme or they render with the admin theme or none.
The bundled modules wrap their admin groups in web, auth and AdminTheme only; adding verified and 2fa as above gives your screens the same protection as the core admin.

Naming

Kind	Pattern	Example
Core admin	`admin.{resource}[.{action}]`	`admin.pages.edit`
Module admin	`admin.{alias}.{resource}.{action}`	`admin.booking.services.store`
Module public	`{alias}.{page}`	`booking.services.index`, `trucommerce.shop.index`
Visitor area	`user.*`	`user.profile`
Payments	`trupayments.*`	`trupayments.pay`, `trupayments.webhook`

End admin write routes in .store, .update, .destroy or .delete: demo mode blocks the demo accounts by route-name patterns such as admin.*.store and admin.*.*.update. Give every named page route a breadcrumb definition, or the admin layout throws.

URLs that cannot be used

First segments in config('slugs.reserved'): admin, api, build, storage, themes, vendor, up.
Every module's public_paths and lower-case module name, and the first segment of every registered route. The catch-all {slug} route excludes them, and the slug manager refuses to give a page such a slug.
install/* belongs to the installer.

Useful commands

php artisan route:list --path=admin/testimonials     # one prefix
php artisan route:list --name=testimonials           # by name
php artisan route:list --except-vendor               # skip package routes
php artisan route:clear                               # after editing route files on a site with cached routes