fix dashboard and apis

app-modules/booking/src/Http/Controllers/BookingController.php

@@ -31,10 +31,21 @@ class BookingController extends Controller
 
     public function index(Request $request): AnonymousResourceCollection
     {
-        Gate::authorize('viewAny', Booking::class);
+        $openid = $request->attributes->get('fastapi_openid');
 
-        $bookings = Booking::query()
-            ->where('user_id', $request->user()->id)
+        $query = Booking::query();
+
+        if ($openid !== null) {
+            // FastAPI agent (JWT auth, no Laravel user) — scoped to the
+            // verified token's own openid, never a client-supplied value,
+            // so one agent session can't list another customer's bookings.
+            $query->where('openid', $openid);
+        } else {
+            Gate::authorize('viewAny', Booking::class);
+            $query->where('user_id', $request->user()->id);
+        }
+
+        $bookings = $query
             ->with(self::EAGER_LOADS)
             ->latest()
             ->paginate();
@@ -42,9 +53,15 @@ class BookingController extends Controller
         return BookingResource::collection($bookings);
     }
 
-    public function show(Booking $booking): BookingResource
+    public function show(Request $request, Booking $booking): BookingResource
     {
-        Gate::authorize('view', $booking);
+        $openid = $request->attributes->get('fastapi_openid');
+
+        if ($openid !== null) {
+            abort_if($booking->openid !== $openid, 404);
+        } else {
+            Gate::authorize('view', $booking);
+        }
 
         return new BookingResource($booking->load(self::EAGER_LOADS));
     }
@@ -52,6 +69,11 @@ class BookingController extends Controller
     public function store(StoreBookingRequest $request): JsonResponse
     {
         $validated = $request->validated();
+        $openid = $request->attributes->get('fastapi_openid');
+
+        if ($openid === null) {
+            Gate::authorize('create', Booking::class);
+        }
 
         $selections = array_map(
             fn (array $selection) => new VehicleSelectionData(
@@ -61,6 +83,14 @@ class BookingController extends Controller
             $validated['selections'],
         );
 
+        // The agent's own auth path always wins over anything a header could
+        // claim; customer channels come from Device-Type, not a
+        // client-supplied body field (BookingChannel::fromDeviceTypeHeader
+        // already refuses to hand back Agent/Admin from a header value).
+        $channel = $openid !== null
+            ? BookingChannel::Agent
+            : BookingChannel::fromDeviceTypeHeader($request->header('Device-Type'));
+
         $booking = $this->createBookingAction->handle(new CreateBookingData(
             evRouteId: $validated['ev_route_id'],
             departureTimeSlotId: $validated['departure_time_slot_id'],
@@ -70,11 +100,12 @@ class BookingController extends Controller
             passengerPhone: $validated['passenger_phone'],
             pickupAddress: $validated['pickup_address'],
             dropoffAddress: $validated['dropoff_address'],
-            createdByChannel: isset($validated['created_by_channel'])
-                ? BookingChannel::from($validated['created_by_channel'])
-                : BookingChannel::MiniApp,
+            createdByChannel: $channel,
+            // A verified FastAPI JWT's own openid always wins over a
+            // client-supplied one — a request can never claim a different
+            // customer's identity than its own token proves.
             userId: $request->user()?->id,
-            openid: $validated['openid'] ?? null,
+            openid: $openid ?? $validated['openid'] ?? null,
             pickupLat: $validated['pickup_lat'] ?? null,
             pickupLng: $validated['pickup_lng'] ?? null,
             dropoffLat: $validated['dropoff_lat'] ?? null,