```
**Step 5: Simplify Livewire Component**
```php
// src/App/Livewire/Ipaas/Flows/IndexFlows.php
class IndexFlows extends Component
{
// ✅ Remove all delete-related methods
// No more: deleteFlowConfirmed(), confirmDelete(), cancel(), etc.
// Alpine.js handles everything via HTTP DELETE
protected $listeners = [
'refresh-flows-index' => '$refresh', // Listen for Alpine.js refresh event
];
public function render()
{
return view('livewire.ipaas.flows.index-flows', [
'flows' => Flow::all(),
]);
}
}
```
#### Pattern Benefits
**✅ Security:**
1. CSRF protection automatically applied
2. All route middlewares engaged (auth, tenant context, etc.)
3. Proper authorization checks via policies if configured
4. Cannot bypass security via direct method calls
**✅ Laravel Standards:**
1. Uses standard RESTful DELETE routes
2. Controller methods handle HTTP concerns
3. Consistent with framework conventions
4. Easy to understand for new developers
**✅ User Experience:**
1. No page reload (AJAX + Livewire refresh)
2. Instant visual feedback
3. Consistent modal design across application
4. Loading states during deletion
**✅ Maintainability:**
1. Reusable component across all resources
2. Single source of truth for delete confirmation UI
3. Easy to test HTTP DELETE routes
4. Clear separation of concerns
#### Refactoring Checklist
When migrating from Livewire direct calls to secure HTTP DELETE:
- [ ] Create reusable Alpine.js delete modal component
- [ ] Update controller `destroy()` method to support JSON responses
- [ ] Ensure explicit DELETE route exists in `routes/tenant.php`
- [ ] Update Blade view to use `onclick="confirmDelete(...)"`
- [ ] Remove Livewire delete methods from component class
- [ ] Add `$listeners` for refresh event in Livewire component
- [ ] Test CSRF protection is working
- [ ] Test delete functionality in browser
- [ ] Verify Livewire component refreshes without page reload
- [ ] Check logs for proper security context (user_id, IP, etc.)
#### Testing Requirements
```php
// tests/Feature/Http/Controllers/Ipaas/FlowsControllerTest.php
test('can delete a flow successfully via HTTP DELETE', function () {
// Arrange: Create flow
$flow = Flow::create(['name' => 'Test Flow']);
// Act: Send DELETE request (mimics Alpine.js fetch)
$response = $this->deleteTenantJson("/ipaas/flows/destroy/{$flow->id}");
// Assert: JSON response
$response->assertStatus(200)
->assertJson([
'success' => true,
'message' => 'Flow deleted successfully'
]);
// Assert: Flow was deleted
expect(Flow::find($flow->id))->toBeNull();
});
test('returns 404 when deleting non-existent flow', function () {
$response = $this->deleteTenantJson("/ipaas/flows/destroy/999999");
$response->assertStatus(404)
->assertJson([
'success' => false,
'message' => 'Flow not found'
]);
});
test('CSRF protection is enforced on DELETE', function () {
// This test verifies that without CSRF token, the request fails
// Laravel's TestCase automatically includes CSRF, so we test by removing it
$flow = Flow::create(['name' => 'Test Flow']);
// Make raw request without CSRF
$response = $this->withoutMiddleware(\App\Http\Middleware\VerifyCsrfToken::class)
->deleteTenantJson("/ipaas/flows/destroy/{$flow->id}");
// Without CSRF middleware, this would fail in production
// This test documents the security requirement
});
```
#### Why This Pattern Exists
**Root Cause of the anti-pattern:** Livewire components calling controller methods directly bypass the HTTP middleware stack entirely — CSRF validation, route middleware (`auth`, tenant context), FormRequest validation, and authorization checks are all skipped. The call looks legitimate from PHP's perspective but carries no HTTP-layer security guarantees.
**The rule:** Any action that mutates or deletes a resource MUST be triggered via an HTTP route, not via a direct method call from a Livewire component. The HTTP route is the security boundary. Everything behind it (CSRF, auth, middleware, policies) depends on the request going through it.
---