A gym management system with a real permission hierarchy: an administrator above city managers, city managers above the gym managers in their region, and members below all of them.
That hierarchy is the design problem, not the CRUD. Every query has to be scoped to what the current role is allowed to see, and the correct answer differs at each level — a gym manager's "all members" and an administrator's "all members" are different sets, retrieved through the same screens.
Spatie's laravel-permission handles the role and ability wiring, Laravel Cashier runs subscription billing through Stripe, Sanctum issues tokens for the API surface, and laravel-ban suspends members without destroying their history — which matters, because a banned member's payment record still has to exist. The admin interface is built on AdminLTE and the whole thing was deployed to AWS.
Written in 2022, and the largest thing built in Laravel before the work moved to the JavaScript side.
