Category Archives: Laravel

Multi tenancy in Laravel using stancl/tenancy

Posted on May 26, 2026 by ronaldpringadi

I spent a day inside stancl/tenancy (the database-per-tenant Laravel package) shipping a real change to a multi-tenant Software-as-a-Service (SaaS) application, and a few things finally clicked for me — none of which were obvious from the documentation alone. 💡 Here … Continue reading →

Posted in Laravel, PHP | Tagged , , , , | Comments Off on Multi tenancy in Laravel using stancl/tenancy

Scribe for Laravel: API Docs That Stay Fresh, and a Calm Way to Upgrade Them

Posted on May 6, 2026 by ronaldpringadi

Most Laravel teams reach a point where their API documentation is either out of date, written somewhere it shouldn’t be (Confluence, anyone?), or just doesn’t exist. Scribe is the package that quietly fixes this — it reads your routes, controllers, … Continue reading →

Posted in Laravel, PHP | Tagged , , | Comments Off on Scribe for Laravel: API Docs That Stay Fresh, and a Calm Way to Upgrade Them

Reading Laravel Config From a Queued Job — and the env() Trap That Bites You in Production

Posted on May 5, 2026 by ronaldpringadi

Today’s lesson came from a perfectly innocent-looking change in a Laravel app. We had a magic number — a chunk size — sprinkled across three call sites: 123foreach (array_chunk($userIds, 100) as $chunk) {     SendOnboardingEmailJob::dispatch($chunk); } One reviewer flagged … Continue reading →

Posted in Laravel, PHP | Tagged , , | Comments Off on Reading Laravel Config From a Queued Job — and the env() Trap That Bites You in Production

BOLA in a Laravel Livewire app: when client-side state is the only thing standing between users and admin actions

Posted on November 26, 2025 by ronaldpringadi

A penetration test landed an interesting finding on a Livewire-powered admin panel I work on. The summary on the report read: Broken Object-Level Authorization (BOLA). A standard user can change a tenant-wide “who can access these assets” setting by replaying … Continue reading →

Posted in Laravel, PHP | Tagged , , , , , , | Comments Off on BOLA in a Laravel Livewire app: when client-side state is the only thing standing between users and admin actions

Azure AD, Google Directory, and SCIM: picking a user-sync story for a multi-tenant Laravel app

Posted on December 5, 2024 by ronaldpringadi

Late 2024 I spent a few weeks digging into how a multi-tenant Laravel platform I was working on should let tenant administrators pull users in from external identity providers. The customer asks were predictable — “we use Azure,” “we use … Continue reading →

Posted in Laravel | Tagged , , , , | Comments Off on Azure AD, Google Directory, and SCIM: picking a user-sync story for a multi-tenant Laravel app

Free Azure AD SCIM provisioning to a Laravel app on your laptop, via home router + dynamic DNS

Posted on November 22, 2024 by ronaldpringadi

In the last post I sketched why SCIM (System for Cross-domain Identity Management) won out over direct Azure Active Directory (Azure AD) and Google Directory integrations for a multi-tenant Laravel app I was working on. This one is the hands-on … Continue reading →

Posted in Laravel | Tagged , , , , | Comments Off on Free Azure AD SCIM provisioning to a Laravel app on your laptop, via home router + dynamic DNS

Laravel Jobs, Queues, Batches, and Redis: A Field Guide

Posted on June 15, 2024 by ronaldpringadi

Laravel’s queue system is one of those features you can use for years without really understanding what’s happening underneath. You call SomeJob::dispatch(), a worker somewhere picks it up, and life goes on. But the moment a job mysteriously runs twice, … Continue reading →

Posted in Laravel | Tagged , , , | Comments Off on Laravel Jobs, Queues, Batches, and Redis: A Field Guide