# HUB API Contributor Guide

## Architecture

- Keep this repository as an API-only Laravel application; do not introduce frontend frameworks or Blade pages.
- Place public endpoints under the versioned `/api/v1` prefix.
- Keep controllers thin and put business logic in focused services.
- Isolate external systems behind generic adapters such as `CrmClient` and `LearningPlatformClient`.
- Prefer framework conventions and avoid dependencies unless they provide a clear, current requirement.

## White-label naming

- The public product name is **HUB API** and its public domain is `https://hub.iutestcenter.com`.
- Never expose vendor names publicly, including in routes, response bodies, validation messages, logs returned to clients, or documentation intended for API consumers.
- Use generic integration terms such as CRM and learning platform in code and configuration.

## Security

- Never commit credentials, access tokens, secrets, production data, or populated environment files.
- Never return server paths, infrastructure details, tokens, stack traces, exception messages, or internal implementation details to clients.
- Treat inbound data as untrusted; validate it and use least-privilege access for integrations.
- Keep `.env.example` limited to safe placeholders.

## Required workflow

- Install: `composer install` followed by `cp .env.example .env`, `php artisan key:generate`, and `touch database/database.sqlite`.
- Lint: `vendor/bin/pint --test` (use `vendor/bin/pint` to apply formatting).
- Test: `php artisan test`.
- Add or update automated tests for every behavior change.