fix dashboard and apis

app-modules/identity/src/Http/Middleware/AuthenticateSanctumOrFastApiJwt.php

@@ -0,0 +1,59 @@
+<?php
+
+namespace Modules\Identity\Http\Middleware;
+
+use Closure;
+use Firebase\JWT\JWT;
+use Firebase\JWT\Key;
+use Illuminate\Contracts\Auth\Middleware\AuthenticatesRequests;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\Support\Facades\Log;
+use Symfony\Component\HttpFoundation\Response;
+use Throwable;
+
+/**
+ * Accepts either of two bearer schemes on the same routes:
+ *
+ * - A Sanctum personal access token, for real database users (mini app,
+ *   mobile, web, admin) — resolved exactly as `auth:sanctum` would.
+ * - A self-signed JWT minted by the FastAPI AI agent, carrying the real
+ *   end-customer's identity in its `sub` claim. No Laravel `User` is
+ *   created or attached for this path — the verified claim is stashed as
+ *   the `fastapi_openid` request attribute for controllers to scope by
+ *   (domain.md §8; the agent has no database identity of its own).
+ *
+ * Payment/refund routes deliberately keep plain `auth:sanctum` instead of
+ * this middleware, so a JWT-authenticated request can never reach them.
+ */
+class AuthenticateSanctumOrFastApiJwt implements AuthenticatesRequests
+{
+    public function handle(Request $request, Closure $next): Response
+    {
+        if (Auth::guard('sanctum')->check()) {
+            Auth::shouldUse('sanctum');
+
+            return $next($request);
+        }
+
+        if ($token = $request->bearerToken()) {
+            try {
+                $payload = JWT::decode($token, new Key(
+                    config('services.fastapi_agent.jwt_secret'),
+                    config('services.fastapi_agent.jwt_algorithm'),
+                ));
+
+                $request->attributes->set('fastapi_openid', $payload->sub);
+
+                return $next($request);
+            } catch (Throwable $e) {
+                // Expired/malformed/wrong-signature tokens are routine auth
+                // failures, not application errors — log at debug level
+                // only, never report() to the error tracker.
+                Log::debug('FastAPI agent JWT rejected.', ['reason' => $e->getMessage()]);
+            }
+        }
+
+        abort(401, 'Unauthenticated.');
+    }
+}

app-modules/identity/tests/Feature/AuthenticateSanctumOrFastApiJwtTest.php

@@ -0,0 +1,73 @@
+<?php
+
+use App\Models\User;
+use Firebase\JWT\JWT;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Route;
+
+beforeEach(function () {
+    config(['services.fastapi_agent.jwt_secret' => 'test-fastapi-agent-secret-0123456789ABCDEF']);
+    config(['services.fastapi_agent.jwt_algorithm' => 'HS256']);
+
+    Route::middleware(['api.auth'])
+        ->get('/__test/sanctum-or-fastapi-jwt', fn (Request $request) => response()->json([
+            'openid' => $request->attributes->get('fastapi_openid'),
+            'user_id' => $request->user()?->id,
+        ]));
+});
+
+function fastApiJwt(array $overrides = []): string
+{
+    $payload = array_merge([
+        'sub' => 'mini-app-openid-123',
+        'iat' => time(),
+        'exp' => time() + 3600,
+    ], $overrides);
+
+    return JWT::encode($payload, 'test-fastapi-agent-secret-0123456789ABCDEF', 'HS256');
+}
+
+test('a valid Sanctum token authenticates as a real user, no openid attribute set', function () {
+    $user = User::factory()->create();
+    $token = $user->createToken('test-token')->plainTextToken;
+
+    $this->withHeader('Authorization', "Bearer {$token}")
+        ->getJson('/__test/sanctum-or-fastapi-jwt')
+        ->assertSuccessful()
+        ->assertJson(['openid' => null, 'user_id' => $user->id]);
+});
+
+test('a valid FastAPI JWT authenticates with the verified openid claim and no user', function () {
+    $token = fastApiJwt(['sub' => 'agent-openid-456']);
+
+    $this->withHeader('Authorization', "Bearer {$token}")
+        ->getJson('/__test/sanctum-or-fastapi-jwt')
+        ->assertSuccessful()
+        ->assertJson(['openid' => 'agent-openid-456', 'user_id' => null]);
+});
+
+test('an expired FastAPI JWT is rejected', function () {
+    $token = fastApiJwt(['exp' => time() - 60]);
+
+    $this->withHeader('Authorization', "Bearer {$token}")
+        ->getJson('/__test/sanctum-or-fastapi-jwt')
+        ->assertUnauthorized();
+});
+
+test('a FastAPI JWT signed with the wrong secret is rejected', function () {
+    $token = JWT::encode(['sub' => 'agent-openid-456', 'exp' => time() + 3600], 'wrong-secret-0123456789ABCDEFGHIJKLMNOP', 'HS256');
+
+    $this->withHeader('Authorization', "Bearer {$token}")
+        ->getJson('/__test/sanctum-or-fastapi-jwt')
+        ->assertUnauthorized();
+});
+
+test('a malformed bearer token is rejected', function () {
+    $this->withHeader('Authorization', 'Bearer not-a-real-token')
+        ->getJson('/__test/sanctum-or-fastapi-jwt')
+        ->assertUnauthorized();
+});
+
+test('a request with no Authorization header is rejected', function () {
+    $this->getJson('/__test/sanctum-or-fastapi-jwt')->assertUnauthorized();
+});