ADR-001: A Laravel API and a React portal

Status: accepted · Date: 14 October 2019 · Decided by: Rafael Duarte, Quinn Maas

Context

We are building sign-in and access for companies with many depots. The first customer wants people to sign in at depot terminals and administrators to manage access from head office. We are three engineers. Whatever we pick, we will run it ourselves for years, and customers will ask security questions about it from the first sale.

Options we looked at:

1. A server-rendered web app that does everything (Laravel with Blade views).
2. An API and a separate single-page admin app.
3. One Node.js codebase for both.

Decision

An API in Laravel (PHP) for sign-in, people, depots, roles and access requests, and a separate admin portal in React that only talks to that API.

• Two of us know Laravel well. Its authentication, queues, migrations and policies cover most of what we need on day one.
• Depot terminals, scanners and customers' own systems will need the same API the portal uses. Building the portal on the public API keeps us honest.
• A single-page portal lets us build the approvals inbox and people lists as live screens without page reloads.

Consequences

• Two repositories, two deploys, and an API we must version from the start.
• The portal holds no data. Everything it shows can be checked in the API, which keeps security answers simple.
• We need someone who is good at frontend work by the second year.
• Anything that sends messages will likely end up outside the API later. We don't build that now.

Updates

• 2 March 2020: the API is now called identity-service.
• 12 April 2021: the portal moved to TypeScript; new code is TypeScript only.