Home › Laravel › Laravel Filament admin panel CLAUDE.md

Laravel Filament admin panel CLAUDE.md

CLAUDE.md for Laravel apps with Filament admin panels: resources, forms and tables, policies for authorization, relation managers, actions, and Pest tests.

Claude Code (CLAUDE.md)Laravel

Copy CLAUDE.md

How to use

Save this as CLAUDE.md in your repository root, commit it, and your agent will pick it up automatically. Edit the commands to match your project.

Note: Review and test before use. Provided as is, without warranty. See Terms.

# CLAUDE.md: Laravel + Filament

## Commands
- `php artisan test` (Pest or PHPUnit) · `./vendor/bin/pint` (format) · `./vendor/bin/phpstan analyse` if configured.
- Generate, don't hand-scaffold: `php artisan make:filament-resource Post --generate`, `make:filament-relation-manager`, `make:filament-page`, `make:filament-widget`.
- Check the installed Filament major in `composer.json` before writing code: v3 and v4 differ (v4 moves forms and infolists onto unified schemas and changes some namespaces). Follow the version's docs; don't mix APIs.

## Resources
- One resource per model under `app/Filament/Resources`. In v4 keep form/table definitions in the generated schema and table classes; in v3 keep them in `form()` and `table()`.
- Forms: validation rules on fields (`->required()`, `->maxLength()`, `->unique(ignoreRecord: true)`), relationship selects with `->relationship()` and `->searchable()->preload()` only for small sets.
- Tables: eager-load what columns use (`modifyQueryUsing(fn ($q) => $q->with('author'))`) to avoid N+1; add filters and searchable/sortable columns deliberately.
- Business logic stays in models, actions or services. Filament actions call them; they don't contain domain logic or raw queries.

## Authorization
- Every resource is backed by a Laravel policy (`php artisan make:policy PostPolicy --model=Post`). Filament respects `viewAny`, `create`, `update`, `delete`; never rely on hiding navigation for security.
- Panel access via `canAccessPanel()` on the `User` model (implements `FilamentUser`); never return `true` for everyone in production.
- Destructive actions use `->requiresConfirmation()`; bulk actions respect policies too.

## Tests
Livewire tests for resource pages: `livewire(ListPosts::class)->assertCanSeeTableRecords($posts)`, create/edit form submission with `->fillForm()->call('create')->assertHasNoFormErrors()`, and authorization tests per role.

## Done when
Pint clean, tests pass, and `php artisan filament:upgrade` / asset publishing ran if a Filament version bump was part of the change.