Controller Cleanup

Use this skill when controllers become difficult to understand, test, or maintain.

Controllers should stay thin and focused on HTTP orchestration. They should not contain long business workflows, provider payload construction, repeated query logic, or file-processing loops.

Responsibilities

A controller may:

• receive route-bound models and requests;
• call $this->authorize() or rely on middleware/Form Request authorization;
• call a Form Request's validated() data;
• invoke an Action or Service;
• return redirects, views, JSON resources, streams, or downloads;
• attach session flash messages.

A controller should not: