NyanLinnPai/famous-ly4-ev
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Phase 6: security & ops hardening (T6.1-T6.5)

Browse Source 
- T6.1: named rate limiters (api-read/api-write/api-auth/api-webhooks),
  applied per module route group with tighter limits on booking/payment
  writes and the KBZ webhook than read-only catalog/routing endpoints.
- T6.2: install spatie/laravel-activitylog; LogsActivity on Booking/
  Payment/Refund status transitions and catalog/pricing admin CRUD
  (EvCompany, Destination, DepartureTimeSlot, EvRoute, RoutePricing).
  New IdentityPlugin with a read-only AuditLogResource gated by
  view_audit_log.
- T6.3: JSON error envelope for api/* in bootstrap/app.php (401/403/404/
  405/429/500 fallback), plus PaymentGatewayException (422 declined /
  502 unavailable).
- T6.4: feature tests proving the FastAPI agent token gets 403 on
  refund/cancel-not-owned and 405 (no write handler) on catalog/routing
  writes.
- T6.5: install gboquizosanchez/filament-log-viewer with a custom
  Filament admin theme (required for its views' Tailwind classes to
  compile), LOG_CHANNEL/FILAMENT_LOG_VIEWER_DRIVER=daily, registered
  under Operations in the sidebar.

252 tests passing.
This commit is contained in:
Nyan Lin Paing
2026-08-09 20:59:00 +07:00
parent e2e7902307
commit 46f9b8d5a3
43 changed files with 1176 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app-modules/booking/routes/booking-routes.php
+1 -1
View File
@@ -3,7 +3,7 @@
use Illuminate\Support\Facades\Route;
use Modules\Booking\Http\Controllers\BookingController;
Route::prefix('api/v1')->middleware(['api', 'auth:sanctum', 'throttle:60,1'])->group(function () {
Route::prefix('api/v1')->middleware(['api', 'auth:sanctum', 'throttle:api-write'])->group(function () {
Route::get('/bookings', [BookingController::class, 'index'])->name('booking.bookings.index');
Route::get('/bookings/{booking:booking_ref}', [BookingController::class, 'show'])->name('booking.bookings.show');
Route::post('/bookings', [BookingController::class, 'store'])->name('booking.bookings.store');