Senior & Lead Engineer
Interview Mastery Hub

gRPC with Protocol Buffers in PHP

1. Binary Serialization vs JSON: Protocol Buffers serialize payloads into compact binary format, reducing payload size by 70% and CPU deserialization time by 80%.
2. HTTP/2 Multiplexing: Multiple bidirectional gRPC RPC calls share a single persistent TCP connection, preventing ephemeral port exhaustion.
3. RoadRunner gRPC Plugin: Run Laravel worker processes through Spiral RoadRunner gRPC server for native C-level gRPC transport.

Backed Enum with Methods & Traits

enum OrderStatus: string implements HasLabel
{
    case PENDING = 'pending';
    case PROCESSING = 'processing';
    case COMPLETED = 'completed';
    case CANCELLED = 'cancelled';

    public function label(): string
    {
        return match($this) {
            self::PENDING => 'Awaiting Payment',
            self::PROCESSING => 'In Progress',
            self::COMPLETED => 'Order Delivered',
            self::CANCELLED => 'Order Cancelled',
        };
    }

    public function canCancel(): bool
    {
        return in_array($this, [self::PENDING, self::PROCESSING], true);
    }
}

Functional Index on JSON Expressions

ALTER TABLE orders ADD INDEX idx_customer_code ((CAST(details->>'$.customer_code' AS CHAR(30))));

MySQL 8 allows indexing expressions directly without needing stored physical columns.

CREATE INDEX CONCURRENTLY

Standard CREATE INDEX takes an ACCESS EXCLUSIVE lock blocking writes.

CREATE INDEX CONCURRENTLY idx_users_email ON users (email);

• Scans table twice and builds the index without blocking INSERT/UPDATE/DELETE operations.
• Note: Cannot run inside a multi-statement transaction block.

Active-Active vs Active-Passive

• Active-Passive (Warm Standby): Primary region handles 100% traffic. Secondary region replicates data. DNS failover (Route 53) flips traffic if primary fails. RTO: 2-5 mins.
• Active-Active (Multi-Region): Both US-East and EU-Central serve local traffic. Requires globally distributed conflict-free replicated data types (CRDTs) or distributed database like CockroachDB / Spanner.

Sticky Connections in Laravel config/database.php

Enable the sticky option:

'mysql' => [
    'read' => [
        'host' => ['192.168.1.10', '192.168.1.11'],
    ],
    'write' => [
        'host' => ['192.168.1.5'],
    ],
    'sticky' => true, // Reads in the same request/lifecycle immediately route to Write DB
],

Force Primary Read on Critical Reads:

$user = User::onWriteConnection()->find($id);

Timing Attacks & Constant-Time String Comparison

Standard string comparisons (===) fail fast at the first differing byte. An attacker measuring millisecond response timing can deduce character by character.

$computedSignature = hash_hmac('sha256', $rawPayload, $secretKey);

// VULNERABLE to timing attacks:
// if ($computedSignature === $incomingSignature) { ... }

// SECURE constant-time verification:
if (! hash_equals($computedSignature, $incomingSignature)) {
    throw new SecurityException("Invalid webhook signature.");
}

innodb_flush_log_at_trx_commit Settings

• 1 (Default / Strict ACID): Redo log is flushed to disk on every single transaction commit. Maximum safety, high disk IOPS.
• 2: Redo log is written to OS cache on commit and flushed to disk once per second. If OS crashes, at most 1 second of data is lost, but write throughput increases up to 10x.
• 0: Flushed once per second in memory.

Controlling CTE Inlining

• WITH my_cte AS NOT MATERIALIZED (...): Forces the query planner to inline the CTE directly into the parent query, allowing index pushdown and filter sharing.
• WITH my_cte AS MATERIALIZED (...): Forces PostgreSQL to compute the CTE once into a temporary buffer, preventing repetitive recalculation if referenced multiple times.

Distributed Context Propagation

1. The edge API gateway generates a unique trace_id and span_id.
2. Passed downstream across all HTTP/gRPC headers via W3C Trace Context (traceparent: 00-4bf92f3577b34da6a3ce929d0e0e4736-00f067aa0ba902b7-01).
3. Each microservice logs the trace_id and exports span metrics to OpenTelemetry collector / Jaeger for visual timeline waterfalls.

Laravel Reverb Architecture

Laravel Reverb is a first-party, high-performance WebSocket server written directly in PHP using asynchronous event loops.

• Epoll Event Loop: Capable of sustaining tens of thousands of open TCP sockets on a single server.
• Horizontal Scaling via Redis Pub/Sub: When server A broadcasts an event, it publishes to Redis; Server B, C, and D receive the pub/sub notification and relay the frame to their local connected client sockets.
• Zero Third-Party Billing: Direct drop-in replacement for Pusher.

APCu Direct RAM Access

APCu stores PHP variables directly in the web server process shared memory, avoiding TCP network roundtrips to Redis:

if (! apcu_exists('global_config')) {
    $config = loadHeavyConfig();
    apcu_store('global_config', $config, 3600);
} else {
    $config = apcu_fetch('global_config');
}

Latency is under 5 microseconds, compared to 0.5-2ms for Redis over TCP.

Best Practice for High-Scale Systems

Avoid heavy database-level cascading deletes. Instead, perform soft-deletes or chunked background queue deletions:

-- Delete in chunks of 5,000 to prevent long-held row locks
DELETE FROM order_items WHERE order_id = 12345 LIMIT 5000;

Optimal Memory Configuration

• shared_buffers: Set to 25% of total RAM (64GB). PostgreSQL relies heavily on the Linux OS Page Cache for the remaining 75%.
• work_mem: Allocated per-sort/hash operation per client (e.g. 32MB to 64MB). (Formula: (Available RAM / Max Connections) / 3).
• maintenance_work_mem: Allocated for VACUUM and CREATE INDEX (e.g. 4GB).
• effective_cache_size: Set to 75% of total RAM (192GB) to inform the optimizer of OS cache capacity.

Mutual TLS (mTLS) with Service Mesh (Istio / Linkerd)

• Both client and server authenticate each other using X.509 cryptographic certificates rotated automatically by the service mesh control plane.
• All internal pod-to-pod network traffic is encrypted with TLS 1.3.
• Combined with short-lived JWT scoped tokens to verify service-level authorization.

Event Sourcing Core Principles

1. Append-Only Event Store: State changes are stored as immutable past-tense events (PatientDiagnosed, PrescriptionIssued). The database table has NO UPDATE or DELETE permissions.
2. Replaying State:

   $record = new MedicalRecord();
   foreach ($eventStream as $event) {
       $record->apply($event);
   }
   

3. Projections (Read Models): Asynchronous queue listeners consume domain events and project denormalized read-optimized views into Elasticsearch or Postgres for fast querying.

Late Static Binding

• self:: resolves to the class where the method is written.
• static:: resolves to the class that was actually called at runtime.

class Model {
    public static function create(): static {
        return new static(); // Returns instance of User when called as User::create()
    }
}

class User extends Model {}

$user = User::create(); // Instance of User

Redo Log vs Undo Log

• Redo Log (Write-Ahead Logging / WAL): Records physical changes to data pages. During crash recovery, MySQL replays the redo log to restore committed transactions that were not yet flushed from RAM to table data files.
• Undo Log: Records the opposite actions needed to rollback uncommitted transactions active at the time of the crash.

Redis Sorted Sets ($O(\log N)$ Complexity)

# Add / update player score
ZADD leaderboard 4500 "user_9821"

# Get user current global rank (0-indexed)
ZREVRANK leaderboard "user_9821"

# Fetch top 10 players with scores
ZREVRANGE leaderboard 0 9 WITHSCORES

Internal SkipList data structure delivers sub-millisecond lookups across millions of elements.

Sanctum Dual-Mode Authentication

1. SPA (Cookie-Based Stateful Auth):
   • Client calls GET /sanctum/csrf-cookie to set XSRF-TOKEN cookie.
   • Client includes X-XSRF-TOKEN header and withCredentials: true.
   • Domain must match SANCTUM_STATEFUL_DOMAINS in .env.
2. Mobile Apps (Bearer Tokens):
   • Issue token via $user->createToken('iphone')->plainTextToken.
   • Stored in hashed format in personal_access_tokens table.
   • Included as Authorization: Bearer <token> header without CSRF requirements.