fix dashboard and apis

app-modules/booking/src/Enums/BookingChannel.php

@@ -7,10 +7,29 @@ namespace Modules\Booking\Enums;
  */
 enum BookingChannel: string
 {
-    case MiniApp = 'mini_app';
+    case MiniApp = 'kbz_miniapp';
     case Android = 'android';
     case Ios = 'ios';
     case Web = 'web';
     case Agent = 'agent';
     case Admin = 'admin';
+
+    /**
+     * Resolve the client's channel from its `Device-Type` header, defaulting
+     * to MiniApp when the header is missing or unrecognized. Agent/Admin are
+     * deliberately excluded from what a header can select — those two are
+     * derived from how the request authenticated (FastAPI JWT, Filament),
+     * never a client-supplied value, so a customer can't spoof one via the
+     * header.
+     */
+    public static function fromDeviceTypeHeader(?string $deviceType): self
+    {
+        $channel = self::tryFrom((string) $deviceType);
+
+        if ($channel === null || in_array($channel, [self::Agent, self::Admin], true)) {
+            return self::MiniApp;
+        }
+
+        return $channel;
+    }
 }

app-modules/booking/src/Http/Controllers/BookingController.php

@@ -31,10 +31,21 @@ class BookingController extends Controller
 
     public function index(Request $request): AnonymousResourceCollection
     {
-        Gate::authorize('viewAny', Booking::class);
+        $openid = $request->attributes->get('fastapi_openid');
 
-        $bookings = Booking::query()
-            ->where('user_id', $request->user()->id)
+        $query = Booking::query();
+
+        if ($openid !== null) {
+            // FastAPI agent (JWT auth, no Laravel user) — scoped to the
+            // verified token's own openid, never a client-supplied value,
+            // so one agent session can't list another customer's bookings.
+            $query->where('openid', $openid);
+        } else {
+            Gate::authorize('viewAny', Booking::class);
+            $query->where('user_id', $request->user()->id);
+        }
+
+        $bookings = $query
             ->with(self::EAGER_LOADS)
             ->latest()
             ->paginate();
@@ -42,9 +53,15 @@ class BookingController extends Controller
         return BookingResource::collection($bookings);
     }
 
-    public function show(Booking $booking): BookingResource
+    public function show(Request $request, Booking $booking): BookingResource
     {
-        Gate::authorize('view', $booking);
+        $openid = $request->attributes->get('fastapi_openid');
+
+        if ($openid !== null) {
+            abort_if($booking->openid !== $openid, 404);
+        } else {
+            Gate::authorize('view', $booking);
+        }
 
         return new BookingResource($booking->load(self::EAGER_LOADS));
     }
@@ -52,6 +69,11 @@ class BookingController extends Controller
     public function store(StoreBookingRequest $request): JsonResponse
     {
         $validated = $request->validated();
+        $openid = $request->attributes->get('fastapi_openid');
+
+        if ($openid === null) {
+            Gate::authorize('create', Booking::class);
+        }
 
         $selections = array_map(
             fn (array $selection) => new VehicleSelectionData(
@@ -61,6 +83,14 @@ class BookingController extends Controller
             $validated['selections'],
         );
 
+        // The agent's own auth path always wins over anything a header could
+        // claim; customer channels come from Device-Type, not a
+        // client-supplied body field (BookingChannel::fromDeviceTypeHeader
+        // already refuses to hand back Agent/Admin from a header value).
+        $channel = $openid !== null
+            ? BookingChannel::Agent
+            : BookingChannel::fromDeviceTypeHeader($request->header('Device-Type'));
+
         $booking = $this->createBookingAction->handle(new CreateBookingData(
             evRouteId: $validated['ev_route_id'],
             departureTimeSlotId: $validated['departure_time_slot_id'],
@@ -70,11 +100,12 @@ class BookingController extends Controller
             passengerPhone: $validated['passenger_phone'],
             pickupAddress: $validated['pickup_address'],
             dropoffAddress: $validated['dropoff_address'],
-            createdByChannel: isset($validated['created_by_channel'])
-                ? BookingChannel::from($validated['created_by_channel'])
-                : BookingChannel::MiniApp,
+            createdByChannel: $channel,
+            // A verified FastAPI JWT's own openid always wins over a
+            // client-supplied one — a request can never claim a different
+            // customer's identity than its own token proves.
             userId: $request->user()?->id,
-            openid: $validated['openid'] ?? null,
+            openid: $openid ?? $validated['openid'] ?? null,
             pickupLat: $validated['pickup_lat'] ?? null,
             pickupLng: $validated['pickup_lng'] ?? null,
             dropoffLat: $validated['dropoff_lat'] ?? null,

app-modules/booking/src/Http/Requests/StoreBookingRequest.php

@@ -4,7 +4,6 @@ namespace Modules\Booking\Http\Requests;
 
 use Illuminate\Foundation\Http\FormRequest;
 use Illuminate\Validation\Rule;
-use Modules\Booking\Enums\BookingChannel;
 use Modules\Shared\Enums\VehicleOption;
 
 /**
@@ -41,11 +40,8 @@ class StoreBookingRequest extends FormRequest
             'dropoff_address' => ['required', 'string', 'max:500'],
             'dropoff_lat' => ['nullable', 'numeric', 'between:-90,90'],
             'dropoff_lng' => ['nullable', 'numeric', 'between:-180,180'],
-            'openid' => ['nullable', 'string', 'max:255'],
             'is_round_trip' => ['sometimes', 'boolean'],
             'return_travel_date' => ['nullable', 'date', 'required_if:is_round_trip,true'],
-            // Admin-created bookings go through the Filament resource (T4.7), not this API.
-            'created_by_channel' => ['sometimes', Rule::enum(BookingChannel::class)->except(BookingChannel::Admin)],
         ];
     }
 }