No Need for response()->json()

Another thing I noticed is how OrderController is returning response()->json() everywhere:

app/Http/Controllers/Api/OrderController.php:

public function show($order_id)
{
    // ...
 
    return response()->json(new OrderResource($order), Response::HTTP_OK);
}

The thing is that if Laravel detects the API call, it automatically returns JSON, so you don't need to specify this manually.

The Response::HTTP_OK (200 status code) is also returned automatically by Laravel.

So, in this case, the "Laravel way" code would be just this:

app/Http/Controllers/Api/OrderController.php:

public function show($order_id)
{
    // ...
 
    return new OrderResource($order);
}

The only reason why it may be beneficial to specify response()->json() and the status code is if the project code is maintained/reviewed by other non-Laravel developers: they would be able to clearly read what's returned in a verbose way, without knowing about the Laravel internal "magic".

What's that Response::HTTP_OK?

If you're unfamiliar with the Response::HTTP_OK syntax, this is one of the Response HTTP Status code constants from the Symfony framework used by Laravel. Again, you may use them instead of just writing 200 or other HTTP status numbers to make the code more verbose and human-readable.

Here's the list of the most popular status codes:

public const HTTP_OK = 200;
public const HTTP_CREATED = 201;
public const HTTP_NO_CONTENT = 204;
 
public const HTTP_MOVED_PERMANENTLY = 301;
public const HTTP_FOUND = 302;
public const HTTP_NOT_MODIFIED = 304;
 
public const HTTP_BAD_REQUEST = 400;
public const HTTP_UNAUTHORIZED = 401;
public const HTTP_FORBIDDEN = 403;
public const HTTP_NOT_FOUND = 404;
public const HTTP_METHOD_NOT_ALLOWED = 405;
public const HTTP_REQUEST_ENTITY_TOO_LARGE = 413;
public const HTTP_REQUEST_URI_TOO_LONG = 414;
public const HTTP_UNPROCESSABLE_ENTITY = 422;
public const HTTP_TOO_MANY_REQUESTS = 429;
 
public const HTTP_INTERNAL_SERVER_ERROR = 500;
public const HTTP_BAD_GATEWAY = 502;
public const HTTP_SERVICE_UNAVAILABLE = 503;
public const HTTP_GATEWAY_TIMEOUT = 504;

You can see the complete list of the codes here on GitHub.

Shorten index() Method

Similarly, we shorten the index() method of the Controller. Along the way, we also remove the try-catch block, because it's not actually functioning: there's no Authorization check in this method, so an AuthorizationException will never get thrown.

app/Http/Controllers/Api/OrderController.php:

public function index(OrderFilter $filter)
{
    try { 
        return response()->json(new OrderCollection(
            Order::filter($filter)->paginate()
        ), Response::HTTP_OK);
    } catch (AuthorizationException $eAuthorizationException) {
        return $this->notAuthorized();
    } 
    return new OrderCollection( 
        Order::filter($filter)->paginate()
    ); 
}

Here's the full GitHub commit for this change.