# Takaful forms: agent notes

Laravel 13 backend + React SPA in `resources/js`, served from one origin. See README.md
for setup and layout.

- The React app talks to Laravel only through `resources/js/lib/api.ts` (using
  `lib/http.ts`, which sends the `X-XSRF-TOKEN` header). Add endpoints in `routes/api.php`
  and wrap them there; do not call `fetch` from components.
- API routes are loaded under the **web** middleware group (`routes/web.php`), so they use
  the session cookie and CSRF. `trimStrings` and `convertEmptyStringsToNull` are disabled
  for `api/*` so form JSON is stored exactly as typed.
- Forms store questions/settings/theme as JSON on `forms`; answers are JSON on `responses`
  keyed by question id. This keeps the builder flexible without schema changes per
  question type. Object-shaped JSON columns use `App\Casts\JsonObject` so `{}` never turns
  into `[]`.
- Access is decided by `Form::roleFor()` (owner / admin / editor / viewer). Every
  controller action checks it; keep that rule when adding endpoints.
- `Model::shouldBeStrict()` is on: eager-load relations (`$model->load('form')`), and
  only fill attributes that are in `$fillable`.
- Routes are file-based (`resources/js/routes`). `resources/js/routeTree.gen.ts` is
  generated by the TanStack Router Vite plugin on `npm run dev` / `npm run build`. Don't
  edit it by hand.
- Run `php artisan test`, `npm run typecheck` and `npm test` before finishing a change.