Phase 6: security & ops hardening (T6.1-T6.5)

- T6.1: named rate limiters (api-read/api-write/api-auth/api-webhooks),
  applied per module route group with tighter limits on booking/payment
  writes and the KBZ webhook than read-only catalog/routing endpoints.
- T6.2: install spatie/laravel-activitylog; LogsActivity on Booking/
  Payment/Refund status transitions and catalog/pricing admin CRUD
  (EvCompany, Destination, DepartureTimeSlot, EvRoute, RoutePricing).
  New IdentityPlugin with a read-only AuditLogResource gated by
  view_audit_log.
- T6.3: JSON error envelope for api/* in bootstrap/app.php (401/403/404/
  405/429/500 fallback), plus PaymentGatewayException (422 declined /
  502 unavailable).
- T6.4: feature tests proving the FastAPI agent token gets 403 on
  refund/cancel-not-owned and 405 (no write handler) on catalog/routing
  writes.
- T6.5: install gboquizosanchez/filament-log-viewer with a custom
  Filament admin theme (required for its views' Tailwind classes to
  compile), LOG_CHANNEL/FILAMENT_LOG_VIEWER_DRIVER=daily, registered
  under Operations in the sidebar.

252 tests passing.

app-modules/identity/tests/Feature/AgentAbilityAuditTest.php

@@ -0,0 +1,82 @@
+<?php
+
+use App\Models\User;
+use Modules\Booking\Enums\BookingStatus;
+use Modules\Booking\Models\Booking;
+use Modules\Identity\Enums\TokenAbility;
+use Modules\Payment\Enums\PaymentMethod;
+use Modules\Payment\Models\Payment;
+
+/**
+ * T6.4 — full policy + agent-ability audit (domain.md §8). The FastAPI
+ * agent's token is scoped to route:read/booking:create/booking:read only;
+ * this proves that scope is actually enforced end-to-end (via the existing
+ * role/permission-based policies, not a token-ability route middleware) and
+ * that catalog/pricing writes have no customer-facing route at all.
+ */
+beforeEach(function () {
+    $this->agent = User::factory()->create();
+    $this->agentToken = $this->agent->createToken('fastapi-agent', TokenAbility::fastApiAgentAbilities())->plainTextToken;
+});
+
+test('the agent token cannot refund a confirmed booking', function () {
+    $booking = Booking::factory()->create(['status' => BookingStatus::Confirmed, 'price' => 15000]);
+    Payment::factory()->completed()->create([
+        'booking_id' => $booking->id,
+        'gateway' => PaymentMethod::KbzMiniApp,
+        'amount' => 15000,
+        'gateway_transaction_id' => 'EVB-AGENT-AUDIT-1',
+    ]);
+
+    $this->withHeader('Authorization', "Bearer {$this->agentToken}")
+        ->postJson("/api/v1/bookings/{$booking->booking_ref}/refund", [
+            'amount' => 15000,
+            'reason' => 'agent should never reach this',
+        ])
+        ->assertForbidden();
+
+    expect($booking->refresh()->status)->toBe(BookingStatus::Confirmed);
+});
+
+test('the agent token cannot cancel a booking it does not own', function () {
+    $owner = User::factory()->create();
+    $booking = Booking::factory()->create(['user_id' => $owner->id, 'status' => BookingStatus::PendingPayment]);
+
+    $this->withHeader('Authorization', "Bearer {$this->agentToken}")
+        ->postJson("/api/v1/bookings/{$booking->booking_ref}/cancel")
+        ->assertForbidden();
+
+    expect($booking->refresh()->status)->toBe(BookingStatus::PendingPayment);
+});
+
+test('catalog writes have no customer-facing route at all', function () {
+    // These paths only exist as GET (read) routes — a POST to them is
+    // rejected as 405 (method not allowed), not routed to any write
+    // handler, proving no write endpoint was ever registered.
+    $this->withHeader('Authorization', "Bearer {$this->agentToken}")
+        ->postJson('/api/v1/companies', ['name' => 'Should Not Exist'])
+        ->assertStatus(405);
+
+    $this->withHeader('Authorization', "Bearer {$this->agentToken}")
+        ->postJson('/api/v1/destinations', ['name' => 'Should Not Exist'])
+        ->assertStatus(405);
+});
+
+test('routing/pricing writes have no customer-facing route at all', function () {
+    $this->withHeader('Authorization', "Bearer {$this->agentToken}")
+        ->postJson('/api/v1/routes', ['ev_company_id' => 1])
+        ->assertStatus(405);
+});
+
+test('the agent token can still read routes and create/read bookings', function () {
+    $this->withHeader('Authorization', "Bearer {$this->agentToken}")
+        ->getJson('/api/v1/routes')
+        ->assertSuccessful();
+
+    $booking = Booking::factory()->create(['user_id' => $this->agent->id]);
+
+    $this->withHeader('Authorization', "Bearer {$this->agentToken}")
+        ->getJson('/api/v1/bookings')
+        ->assertSuccessful()
+        ->assertJsonPath('data.0.id', $booking->id);
+});

app-modules/identity/tests/Feature/AuditLogTest.php

@@ -0,0 +1,67 @@
+<?php
+
+use App\Models\User;
+use Modules\Booking\Enums\BookingStatus;
+use Modules\Booking\Models\Booking;
+use Modules\Catalog\Models\EvCompany;
+use Spatie\Activitylog\Models\Activity;
+use Spatie\Permission\Models\Permission;
+use Spatie\Permission\Models\Role;
+
+/**
+ * T6.2 — LogsActivity is attached to Booking status transitions and to
+ * catalog admin CRUD; the read-only AuditLogResource (Filament) is gated by
+ * view_audit_log.
+ */
+test('a booking status transition is recorded in the audit log', function () {
+    $booking = Booking::factory()->create(['status' => BookingStatus::PendingPayment]);
+
+    $booking->update(['status' => BookingStatus::Confirmed]);
+
+    $activity = Activity::where('subject_type', Booking::class)
+        ->where('subject_id', $booking->id)
+        ->where('log_name', 'booking')
+        ->latest('id')
+        ->first();
+
+    expect($activity)->not->toBeNull();
+    expect($activity->attribute_changes->get('attributes'))->toMatchArray(['status' => BookingStatus::Confirmed->value]);
+});
+
+test('a catalog CRUD write is recorded in the audit log', function () {
+    $company = EvCompany::factory()->create(['name' => 'Original Name']);
+
+    $company->update(['name' => 'Renamed Company']);
+
+    $activity = Activity::where('subject_type', EvCompany::class)
+        ->where('subject_id', $company->id)
+        ->where('log_name', 'catalog')
+        ->latest('id')
+        ->first();
+
+    expect($activity)->not->toBeNull();
+    expect($activity->attribute_changes->get('attributes')['name'])->toBe('Renamed Company');
+});
+
+test('a user without view_audit_log cannot list the audit log via Filament', function () {
+    Permission::findOrCreate('view_audit_log', 'web');
+    $role = Role::findOrCreate('support', 'web');
+    $user = User::factory()->create();
+    $user->assignRole($role);
+
+    $this->actingAs($user)
+        ->get('/admin/audit-logs')
+        ->assertForbidden();
+});
+
+test('a user with view_audit_log can list the audit log via Filament', function () {
+    Permission::findOrCreate('view_audit_log', 'web');
+    $role = Role::findOrCreate('support', 'web');
+    $role->givePermissionTo('view_audit_log');
+    $user = User::factory()->create();
+    $user->assignRole($role);
+
+    $this->actingAs($user)
+        ->get('/admin/audit-logs')
+        ->assertSuccessful();
+});