Proyek: REST API Todo Lengkap

composer create-project laravel/laravel todo-api
cd todo-api
php artisan install:api   # memasang Sanctum + routes/api.php
php artisan make:model Todo -m

// database/migrations/xxxx_xx_xx_create_todos_table.php
Schema::create('todos', function (Blueprint $table) {
    $table->id();
    $table->foreignId('user_id')->constrained()->cascadeOnDelete();
    $table->string('title', 255);
    $table->boolean('done')->default(false);
    $table->timestamps();
});

// app/Models/Todo.php
namespace App\Models;

use Illuminate\Database\Eloquent\Model;

class Todo extends Model
{
    protected $fillable = ['title', 'done'];
    protected $casts = ['done' => 'boolean'];

    public function user()
    {
        return $this->belongsTo(User::class);
    }
}

// app/Http/Controllers/Api/AuthController.php
namespace App\Http\Controllers\Api;

use App\Http\Controllers\Controller;
use App\Models\User;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Hash;

class AuthController extends Controller
{
    public function register(Request $request)
    {
        $data = $request->validate([
            'name' => 'required|string|max:255',
            'email' => 'required|email|unique:users',
            'password' => 'required|min:8|confirmed',
        ]);

        $user = User::create([...$data, 'password' => Hash::make($data['password'])]);

        return response()->json([
            'token' => $user->createToken('api')->plainTextToken,
        ], 201);
    }

    public function login(Request $request)
    {
        $data = $request->validate(['email' => 'required|email', 'password' => 'required']);
        $user = User::where('email', $data['email'])->first();

        if (! $user || ! Hash::check($data['password'], $user->password)) {
            return response()->json(['message' => 'Kredensial salah.'], 401);
        }

        return response()->json(['token' => $user->createToken('api')->plainTextToken]);
    }
}

// app/Http/Requests/StoreTodoRequest.php
public function rules(): array
{
    return ['title' => 'required|string|max:255', 'done' => 'sometimes|boolean'];
}

// app/Http/Resources/TodoResource.php
public function toArray(Request $request): array
{
    return [
        'id' => $this->id,
        'title' => $this->title,
        'done' => $this->done,
        'created_at' => $this->created_at->toISOString(),
    ];
}

php artisan make:policy TodoPolicy --model=Todo

// app/Policies/TodoPolicy.php
public function view(User $user, Todo $todo): bool
{
    return $user->id === $todo->user_id;
}
// update() dan delete() polanya identik

// app/Http/Controllers/Api/TodoController.php
class TodoController extends Controller
{
    public function index()
    {
        // query via relasi: user mustahil melihat todo orang lain
        return TodoResource::collection(
            auth()->user()->todos()->latest()->paginate(10)
        );
    }

    public function store(StoreTodoRequest $request)
    {
        $todo = auth()->user()->todos()->create($request->validated());

        return new TodoResource($todo);
    }

    public function show(Todo $todo)
    {
        $this->authorize('view', $todo);

        return new TodoResource($todo);
    }

    public function update(StoreTodoRequest $request, Todo $todo)
    {
        $this->authorize('update', $todo);
        $todo->update($request->validated());

        return new TodoResource($todo);
    }

    public function destroy(Todo $todo)
    {
        $this->authorize('delete', $todo);
        $todo->delete();

        return response()->json(null, 204);
    }
}

// routes/api.php
Route::post('/register', [AuthController::class, 'register']);
Route::post('/login', [AuthController::class, 'login']);

Route::middleware('auth:sanctum')->group(function () {
    Route::apiResource('todos', TodoController::class);
});

# register -> simpan tokennya
curl -X POST http://localhost:8000/api/register -H "Content-Type: application/json" \
  -d '{"name":"Budi","email":"[email protected]","password":"rahasia123","password_confirmation":"rahasia123"}'

# buat todo (ganti TOKEN)
curl -X POST http://localhost:8000/api/todos -H "Authorization: Bearer TOKEN" \
  -H "Content-Type: application/json" -d '{"title":"Belajar Laravel"}'

# list dengan paginasi
curl http://localhost:8000/api/todos -H "Authorization: Bearer TOKEN"