PHP/Laravel: routes inside Route::prefix()->group() produce no Route nodes

[paolo-blocklabs]

Version: 0.8.1 (linux-amd64-portable) · Language: PHP 8.4 / Laravel 12

Summary

Routes defined inside Route::prefix()->group() (the dominant pattern in production Laravel apps) produce no Route nodes. Flat definitions in the same file extract fine.

Repro

routes/api.php:

// extracts correctly → Route node __route__GET__/api/welcome
Route::get('/api/welcome', WelcomeController::class);

// produces NO Route nodes at all
Route::prefix('/users')->middleware(DomainCheckMiddleware::class)->group(function (): void {
    Route::get('/me', GetCurrentUserController::class);
    Route::post('/login', LoginUserController::class);
});

// nested prefixes also invisible
Route::prefix('companies/tenants/users')->group(function (): void { ... });

After index_repository (mode=full):

MATCH (n:Route) WHERE n.name CONTAINS 'users' RETURN n  → 0 rows

while the flat /api/welcome, /_test/* routes from the same file are present.

Impact

cross-repo-intelligence cannot match any caller to a Laravel service — in our 24-repo fleet (Go + PHP + TS) the pass returns cross_http_calls: 0 despite live FE→gateway traffic (GET /users/me). Since virtually all real Laravel apps group routes, PHP services are effectively invisible to cross-repo HTTP matching.

Same class of bug as #734 (Spring class-level @RequestMapping prefix dropped), but here the grouped routes are not merely missing their prefix — they are missing entirely.

[DeusData]

Thanks for the Laravel route-chain repro. Triage: this is a PHP route extraction bug for Route::prefix()->group() chains; I am putting it under parsing quality. This does not look covered by the v0.9.0 release, so it should stay open until we have a targeted fix and regression test.

[DeusData]

Investigation status — the bug is deeper than prefix composition. Verified on main (db330bf) with a minimal facade-based fixture (use Illuminate\Support\Facades\Route; + flat Route::get('/api/welcome', ...) + a prefix('/users')->group(...) block):

• Sequential path (1 file): zero Route nodes — even the flat control.
• Parallel path (56 files): zero Route nodes as well.

So for facade-style Laravel code (every real app — the facade class lives in vendor/, which isn't indexed), the empty-resolution route fallback (pass_parallel.c callee-suffix promotion) is not engaging at all; prefix composition is necessary but not sufficient. Two additional things to pin down before the fix:

1. What callee name the PHP extractor actually records for Route::get(...) (scoped_call_expression) — the fallback keys on cbm_service_pattern_route_method(callee) matching a ::get-style suffix, and the zero-node result says that chain breaks somewhere before or at that check.
2. Why the existing handles_laravel_php test stays green: its fixture defines an in-tree Laravel\Route class, so the callee resolves and classification runs on the resolved QN — masking the facade case that this issue is actually about.

Plan: reproduce-first tests for three layers (facade flat route, facade prefixed group — with exact route-name-set assertions so prefix-drop vs missing is distinguished — and the in-tree control), then fix the fallback engagement and add extraction-time prefix()->group() composition (walking the receiver chain of the enclosing group closure, composing outer→inner for nested groups, ignoring middleware/name/domain). Same class as #734's Spring prefix work.

[paolo-blocklabs]

@DeusData not sure if it could work as the easiest option to do this, but if you run https://laravel.com/docs/13.x/routing#listing-your-routes you get back a parsable list of all routes with related controller in this format

+--------+----------+------------------------+------------------+---------------------------------------------+------------+
| Domain | Method   | URI                    | Name             | Action                                      | Middleware |
+--------+----------+------------------------+------------------+---------------------------------------------+------------+
|        | GET|HEAD | /                      | home             | App\Http\Controllers\HomeController@index   | web        |
|        | GET|HEAD | api/user               | api.user.index   | App\Http\Controllers\UserController@index   | api,auth   |
|        | POST     | api/user               | api.user.store   | App\Http\Controllers\UserController@store   | api,auth   |
|        | GET|HEAD | posts/{post}           | posts.show       | App\Http\Controllers\PostController@show    | web        |
|        | DELETE   | posts/{post}           | posts.destroy    | App\Http\Controllers\PostController@destroy | web,auth   |
+--------+----------+------------------------+------------------+---------------------------------------------+------------+

Maybe it could be a possible workaround to read this to get it working until you get all the facades and parsing properly in place, let me know if this could help.

UPDATE: if I'm not wrong there is a --json option too that gives you back an easier parsable format.

[DeusData]

Fixed on main by 4ecfe4c (merged in 2469ecc, PR #1059), shipping in v0.9.1.

As the investigation trail above showed, this went deeper than prefix composition — for facade-style registration (every real Laravel app, since Illuminate lives in vendor/) the graph minted zero Route nodes, flat or grouped. Three fixes landed together:

1. Route::get(...) now records its callee as the qualified Route::get, so the route-registration fallback can classify it (scope-gated: Cache::get keeps its bare name and can never mint junk routes).
2. The sequential pipeline gained the ROUTE_REG fallback it was missing entirely.
3. prefix('/users')->group(...) chains — including nested groups and chains with middleware()/name() links in between — now compose into the route path at extraction: /users/me, /users/login, /companies/tenants/list.

Your verification query (MATCH (n:Route) WHERE n.name CONTAINS 'users') now returns the composed routes, and cross_http_calls has real join targets on the Laravel side. Known limitation, documented in-code: use ...\Route as Router; facade aliases aren't recognized — if your codebase uses that pattern, say so and it becomes a follow-up.

A retest on v0.9.1 against your service fleet would be very welcome — especially the cross_http_calls count you originally flagged as 0.

[paolo-blocklabs]

just saw you linked it with the PR, I'll upgrade your package tomorrow (or Tuesday) and give it a retry and let you know 🙏