php-codeigniter-patterns

PHP CodeIgniter Patterns

This is the architecture layer for CodeIgniter 4 (CI4) applications: how a request flows from Router → Filters → Controller → Model → Entity, and where each concern belongs. It is not a testing guide (php-codeigniter-tdd), not a security checklist (php-codeigniter-security), and not a pre-deploy verification pipeline (php-codeigniter-verification) — apply those alongside this one.

The single biggest CI4-vs-Laravel difference: CI4's Model class is not an ORM. It has no relationship methods (hasMany, belongsTo), no eager loading, and no Active Record-style object graph. A Model is a thin wrapper that exposes Query Builder plus a handful of lifecycle conveniences (mass-assignment guarding, timestamps, soft deletes, validation). Per the CI4 Model user guide: "Once you get the Query Builder instance, you can call methods of the Query Builder. However, since Query Builder is not a Model, you cannot call methods of the Model." Related rows are fetched with an explicit second query or a manual JOIN in the Query Builder call — there is no ->with() to reach for, and no N+1-via-eager-loading gotcha to guard against, because eager loading doesn't exist. The N+1 risk in CI4 is the mirror image: a developer coming from Laravel/Eloquent instinctively expects a relationship method to exist and is surprised when it doesn't.

Layering

app/Controllers/  → routing + request/response shaping only
app/Filters/       → CI4's middleware equivalent (auth, rate limiting, CORS)
app/Models/        → Query Builder wrapper: allowedFields, validation, casts
app/Entities/      → typed row objects (optional; set via Model::$returnType)
app/Config/        → Services.php, Filters.php, Validation.php, Routes.php

Models: Query Builder, not an ORM

namespace App\Models;

use CodeIgniter\Model;

class ReservationModel extends Model
{
    protected $table            = 'reservations';
    protected $primaryKey       = 'id';
    protected $returnType       = \App\Entities\Reservation::class;
    protected $useTimestamps    = true;
    protected $useSoftDeletes   = true;

    // Fields the model will accept from insert()/update()/save() arrays.
    // Never include $primaryKey here.
    protected $allowedFields = ['guest_id', 'hotel_id', 'check_in', 'check_out', 'status'];

    protected $validationRules = [
        'guest_id'  => 'required|integer',
        'check_in'  => 'required|valid_date',
        'check_out' => 'required|valid_date',
    ];
}