Zadira Dine Documentation 0.1.0-prototype

Laravel + four storefronts

One menu contract, four customer experiences.

Install the Laravel API and admin area, then choose React, Vue, Angular, or static HTML and one of three storefront designs.

Start here

From clean install to reviewed deployment

01

Installation

PHP, Node, database, backend, and storefront setup.

 02

Choose a storefront

Compare build and configuration paths for all four variants.

 03

Customize

Identity, three visual presets, bilingual content, menu data, money, and design tokens.

 04

Deploy

Production configuration, builds, CORS, smoke tests, and operations.

Installation

A clean, guarded first run.

Use PHP 8.3+, Composer 2, PDO, and a supported database. SQLite is the local/test default. Use Node.js 24 LTS and npm 11 for the compiled storefronts; static HTML has no build step.

Install Laravel

cd apps/backend
composer install
cp .env.example .env
php artisan key:generate
php artisan restaurant:install \
  --email=owner@example.com \
  --name="Restaurant Owner"
php artisan serve

Edit database and URL values in .env before the installer. It checks the database, asks for a 12-character-or-longer password, migrates, creates the first administrator, and writes an install lock. Use --demo only on a disposable local database.

Install a compiled client

cd apps/storefront-react  # or storefront-vue/angular
npm ci
npm run build

React and Vue read VITE_API_BASE_URL at build time. Angular and static HTML read apiBase from their deployed config.js. Use the backend origin only, without /api/v1.

Full installation and verification guide

One implementation per deployment

Choose by the buyer's stack.

VariantConfigurationOutputBest fit
ReactVITE_API_BASE_URLdist/React component teams
VueVITE_API_BASE_URLdist/Vue single-file components
Angularpublic/config.jsdist/storefront-angular/browser/Angular CLI workflows
Static HTMLconfig.jsSource directorySimple static hosting

The bundled catalog.json is a read-only offline demonstration. With Laravel connected, the server is authoritative for availability and money. Read the full comparison.

Request-only workflow

No checkout or payment claim.

The public clients submit order and reservation requests. A restaurant operator must confirm them separately. The server controls menu availability and recalculates all price snapshots in integer minor units.

GET /api/v1/bootstrap GET /api/v1/branches POST /api/v1/orders POST /api/v1/reservations

Read the API guide · OpenAPI 3.1

Customization

Change source, content, and tokens—not compiled files.

  • Replace the demonstration name, bilingual interface copy, menu fixture, favicon, and brand treatment with reviewed human-authored work.
  • Keep English and Arabic keys aligned and set document lang/dir together.
  • Choose or customize the Terracotta, Garden, and Midnight visual presets in each storefront stylesheet.
  • Customize framework-neutral color, spacing, type, focus, and motion values in packages/design-tokens/zadira.css.
  • Store prices as integer minor units. Never accept a browser total as authoritative.
  • Use stable variation/add-on IDs and IANA branch timezones.
  • Add only original or redistribution-safe media and record every right in the asset manifest.

Full customization guide

Deployment and security

Protect the application before real data arrives.

APP_ENV=production
APP_DEBUG=false
APP_URL=https://api.restaurant.example
SESSION_SECURE_COOKIE=true
FRONTEND_URLS=https://www.restaurant.example
  • Point the Laravel virtual host only to apps/backend/public and enforce HTTPS.
  • Keep .env, secrets, databases, logs, backups, dependencies, and preview-only media outside the public archive/web root.
  • Delete all demo credentials and use a unique APP_KEY, least-privilege database user, secure cookies, reviewed headers, and encrypted tested backups.
  • Allow only exact HTTPS frontend origins. Configure trusted proxies so the 30-per-minute public API limiter sees the real client IP.
  • Define privacy, retention, deletion, monitoring, incident response, and a private vulnerability contact before storing names, phones, email, or notes.

Deployment guide · Security guide

Updates and assets

Back up, stage, migrate, smoke-test.

Before an update, record the current checksum/version, test a restore, rehearse against a sanitized staging copy, and merge customizations rather than overwriting them. Run Composer from the backend lockfile and npm from the selected storefront lockfile. Never replace production .env, storage, uploads, or data with package examples.

After deployment, test health, catalog caching, idempotent order creation, pending reservations, admin authorization, LTR/RTL, keyboard flow, and the no-payment request notice.

No stock photography, web-font binary, or icon pack is required by the customer source. Preview AI media is excluded. The Angular scaffold favicon remains a placeholder that must be replaced and credited.

Update procedure · Changelog · Asset credits

Reference

Security and release material