- T6.1: named rate limiters (api-read/api-write/api-auth/api-webhooks),
applied per module route group with tighter limits on booking/payment
writes and the KBZ webhook than read-only catalog/routing endpoints.
- T6.2: install spatie/laravel-activitylog; LogsActivity on Booking/
Payment/Refund status transitions and catalog/pricing admin CRUD
(EvCompany, Destination, DepartureTimeSlot, EvRoute, RoutePricing).
New IdentityPlugin with a read-only AuditLogResource gated by
view_audit_log.
- T6.3: JSON error envelope for api/* in bootstrap/app.php (401/403/404/
405/429/500 fallback), plus PaymentGatewayException (422 declined /
502 unavailable).
- T6.4: feature tests proving the FastAPI agent token gets 403 on
refund/cancel-not-owned and 405 (no write handler) on catalog/routing
writes.
- T6.5: install gboquizosanchez/filament-log-viewer with a custom
Filament admin theme (required for its views' Tailwind classes to
compile), LOG_CHANNEL/FILAMENT_LOG_VIEWER_DRIVER=daily, registered
under Operations in the sidebar.
252 tests passing.
Implements Phase 3 in full: EvRoute model with company/destination relations
and a from/to-must-differ guard; the ev_route_time_slots pivot; RoutePricing
with a per-route is_blocked flag (every route auto-manages exactly one price
row per vehicle option via a fixed-row Filament repeater on both create and
edit); PricingService::quote() with a shared VehicleOption enum; RoutingPlugin
with the EvRouteResource admin UI (activation gated on non-blocked options
being priced); the /api/v1/routes read API (list/show/pricing/time-slots,
AI-agent-friendly nested shape); and Redis-tag-based response caching
invalidated via EvRoute/RoutePricing observers.
Adds the shared DepartureTimeSlot catalog entity with its Filament
resource, and public GET /api/v1/companies + /api/v1/destinations
endpoints (auth:sanctum + throttled) for the mini app/mobile/agent
clients to consume.
Registers CatalogPlugin with the admin panel so catalog Filament
resources auto-discover, and adds the EvCompany model/migration/
factory plus its Filament resource (auto-generated slug on create).
Implements T1.1-T1.4: Spatie role/permission seeding, Sanctum token
issuance for customer channels and the FastAPI agent (with an
ability-exact-match middleware to tell them apart), Filament admin
panel access restricted to admin-tier roles with the navigation group
order, and skeleton BookingPolicy/RoutePolicy gated on the seeded
permissions ahead of their models landing in later phases.
Nyan Lin Paing