php - Laravel 5.3 - Structuring controllers into Modules with separate sessions, authorisation requirements and standard functionality/services -

we have built , continue develop web application in php, based on in-house web-framework. our web-framework written before ruby on rails anywhere , before similar available in php (ie before symfony). have reviewed using more standard framework, until there functionality missing doing (particularly queues, jobs etc).

we believe frameworks laravel 5+ cover our framework , more. it's more modern, more expressive, etc, considering rewriting our application using laravel 5, because easier obtain programming resources etc. have been researching laravel, have little experience it.

this question how approach general architecture using laravel controllers, providers , middleware, auth, routing etc. our application has 250 controllers , our model has 110 sql tables using propel orm (which migrate eloquent). 250 controllers structured call "modules", each of targeted @ different subset of userbase. our application serves "organisations" have "members" of whom "administrators" organisation. outline of "module" structure:

modules

pub : publicly viewable pages, no login or session, trivial really

org : publicly viewable pages each organisation every (!) page has context of organisation , routes have "slug" org in them

sec : extends "org" module, member has logged in, every page/route has context of member , org. facilitates transactions between member , organisation.

orgadm : extends "org" module, organisation administrator logged in. can access modified versions of "org" pages , separate "orgadm" routes/pages administering data of organisation.

mem : there no org context here (ie no org slug), member has logged in , can see of organisations belong, manage own personal data, etc...

adm : superadmins (internal staff) can view/manage orgs , members

sysadm : sysadmins monitoring jobs/queues etc...

restapi : self explanatory

sessions

pub : requires no login or session

org, sec, orgadm, mem : share session / cookie.

edit: in response 1 of comments clarification of mean "shared session". examples

1. almost e-commerce site, has session on public pages cart/basket. once user logs in same cart contents continue in session, user_id (or similar) present. user has access account / payment details , can enter transaction merchant. this, in simplified way, similar happening in our org & sec modules respectively.
2. on wordpress site, if user logged , has administrative privileges public ui modified include "admin" nav in bar @ top of pages (or similar) , following nav, leads entirely separate "administrative interface". this, in simplified way, similar how our org , orgadm modules work.

the sessions between org/sec/orgadm (also mem) "shared". appreciate feedback, reasonably confident makes sense.

adm , sysadm : share different session / cookie. cookie has "path" set, routes have prefix, , user db separate (and quite small).

common "services" , functionality

org,sec,orgadm : extend same base , offer services of controllers in modules.

initial ideas laravel architecture & specific questions

with our, reasonably naive, understanding of laravel 5.3, simplest ideas address each of above seems be:

• write abstract controller classes represent "modules". concrete controlers each "module" extend appropriate abstract class. abstract class provides common functionality module either containing methods or acting conduit laravel "provider" write each of our "modules". sane in laravel terms? think might work org,sec,mem,orgadm (the core of app)?

• to differentiate between our org, sec , orgadm modules, have our own concept of "roles in organisation". not sure fits laravel authorisation, maybe that's not insurmountable?

• for adm , sysadm have no idea how implement "seperate session/cookie" aspect. think important security perspective. our thought in laravel world use subdomains , separate apps accessing same backend db instead?

• restapi: similar adm etc...really should done entirely separate app well? provides api orgadm data, extended include org module data (ie publicly visible org stuff), organisations can implement own frontends.

this stackoverflow question:

what correct way break larger laravel 5 project modules?

seems make partial suggestions of above aspects (ie division modules routing , controller direcetory sytructure perpective), nothing auth/session stuff.

this blogpost:

http://kamranahmed.info/blog/2015/12/03/creating-a-modular-application-in-laravel/

addresses similar issues, , goes little further in terms of namespaces, loading controllers/models/views active module using serviceprovider. still not address auth/session aspects.

sorry detail, hope questions clear.