App

Active contributors: Taylor Otwell, Nuno Maduro

Purpose

The app/ directory holds everything in the App\ PHP namespace — the application's actual code, as opposed to the framework. In a fresh skeleton it contains exactly three files: one Eloquent model, one service provider, and an empty controllers directory.

Directory layout

app/
├── Http/
│   └── Controllers/      # Empty — no files
├── Models/
│   └── User.php          # Eloquent user model
└── Providers/
    └── AppServiceProvider.php

That is the whole tree. PSR-4 from composer.json maps App\\ → app/, so app/Http/Controllers/HomeController.php would resolve to App\Http\Controllers\HomeController.

App\Models\User

The single bundled model:

namespace App\Models;

use Database\Factories\UserFactory;
use Illuminate\Database\Eloquent\Attributes\Fillable;
use Illuminate\Database\Eloquent\Attributes\Hidden;
use Illuminate\Database\Eloquent\Factories\HasFactory;
use Illuminate\Foundation\Auth\User as Authenticatable;
use Illuminate\Notifications\Notifiable;

#[Fillable(['name', 'email', 'password'])]
#[Hidden(['password', 'remember_token'])]
class User extends Authenticatable
{
    /** @use HasFactory<UserFactory> */
    use HasFactory, Notifiable;

    /**
     * Get the attributes that should be cast.
     *
     * @return array<string, string>
     */
    protected function casts(): array
    {
        return [
            'email_verified_at' => 'datetime',
            'password' => 'hashed',
        ];
    }
}

Highlights:

• #[Fillable(...)] and #[Hidden(...)] are PHP 8 attributes shipped by Eloquent. They replace the older protected $fillable and protected $hidden array properties.
• Extends Illuminate\Foundation\Auth\User (aliased to Authenticatable), which adds the Authenticatable, Authorizable, MustVerifyEmail (optional), CanResetPassword, and notification-routing concerns.
• HasFactory<UserFactory> ties the model to Database\Factories\UserFactory for testing/seeding.
• Notifiable lets you call $user->notify(...).
• casts() declares two casts: email_verified_at becomes a Carbon instance, and any value assigned to password is automatically run through Hash::make() thanks to the hashed cast.

The MustVerifyEmail interface is mentioned in a commented-out use statement at the top of the file but not implemented. Uncomment it (and add Notifiable, MustVerifyEmail to the class signature) to opt into email verification.

App\Providers\AppServiceProvider

The single bundled provider — and it's deliberately empty:

namespace App\Providers;

use Illuminate\Support\ServiceProvider;

class AppServiceProvider extends ServiceProvider
{
    /**
     * Register any application services.
     */
    public function register(): void
    {
        //
    }

    /**
     * Bootstrap any application services.
     */
    public function boot(): void
    {
        //
    }
}

Both methods exist so that future application code has somewhere obvious to land:

• register() runs first, before any other provider's boot(). Use it for $this->app->bind(), $this->app->singleton(), and $this->mergeConfigFrom().
• boot() runs after every provider has registered. Use it for Schema::defaultStringLength(...), Gate::define(...), Blade::directive(...), and so on.

Adding a new provider means creating another class in app/Providers/ and listing it in bootstrap/providers.php. See Bootstrap.

App\Http\Controllers/

This directory exists in the tree but contains no files. Generating php artisan make:controller HomeController will create app/Http/Controllers/HomeController.php extending the framework's bundled base controller — no App\Http\Controllers\Controller base class is shipped here either.

The empty directory is intentional. Laravel 11+ removed many auto-generated stubs to keep the surface area small.

Where things you might add will go

Thing	Path	Generated by
Controller	app/Http/Controllers/	php artisan make:controller
Form request	app/Http/Requests/	php artisan make:request
Middleware	app/Http/Middleware/	php artisan make:middleware
Eloquent model	app/Models/	php artisan make:model
Console command (class-based)	app/Console/Commands/	php artisan make:command
Job	app/Jobs/	php artisan make:job
Mailable	app/Mail/	php artisan make:mail
Notification	app/Notifications/	php artisan make:notification
Policy	app/Policies/	php artisan make:policy
Service provider	app/Providers/	php artisan make:provider (then add to bootstrap/providers.php)

None of these directories ship with the skeleton — Artisan creates them on demand.

Integration points

• bootstrap/providers.php registers AppServiceProvider.

• config/auth.php points the default user provider at App\Models\User:

  'providers' => [
      'users' => [
          'driver' => 'eloquent',
          'model' => env('AUTH_MODEL', User::class),
      ],
  ],

• database/factories/UserFactory.php produces fake User instances for tests/seeders.

• database/migrations/0001_01_01_000000_create_users_table.php defines the schema this model maps to.

Entry points for modification

• Adding services / bindings. App\Providers\AppServiceProvider::register() and boot().
• Adding domain models. Drop new classes in app/Models/, mirroring the User pattern (PHP 8 attributes for fillable/hidden, casts() method, factory tied via HasFactory).
• Adding HTTP behaviour. Generate controllers under app/Http/Controllers/ and reference them from routes/web.php.
• Adding background work. Create app/Jobs/ classes; the database queue connection is wired by default and the composer dev script already runs php artisan queue:listen.

Key source files

File	Purpose
app/Models/User.php	The default authenticated user
app/Providers/AppServiceProvider.php	Empty register/boot hooks for application code
app/Http/Controllers/	Empty directory — controllers go here

See Database for the matching schema, and Bootstrap for how providers are registered.