Nyan Lin Paing
46f9b8d5a3
- T6.1: named rate limiters (api-read/api-write/api-auth/api-webhooks), applied per module route group with tighter limits on booking/payment writes and the KBZ webhook than read-only catalog/routing endpoints. - T6.2: install spatie/laravel-activitylog; LogsActivity on Booking/ Payment/Refund status transitions and catalog/pricing admin CRUD (EvCompany, Destination, DepartureTimeSlot, EvRoute, RoutePricing). New IdentityPlugin with a read-only AuditLogResource gated by view_audit_log. - T6.3: JSON error envelope for api/* in bootstrap/app.php (401/403/404/ 405/429/500 fallback), plus PaymentGatewayException (422 declined / 502 unavailable). - T6.4: feature tests proving the FastAPI agent token gets 403 on refund/cancel-not-owned and 405 (no write handler) on catalog/routing writes. - T6.5: install gboquizosanchez/filament-log-viewer with a custom Filament admin theme (required for its views' Tailwind classes to compile), LOG_CHANNEL/FILAMENT_LOG_VIEWER_DRIVER=daily, registered under Operations in the sidebar. 252 tests passing.
53 lines
1.4 KiB
PHP
53 lines
1.4 KiB
PHP
<?php
|
|
|
|
namespace App\Providers;
|
|
|
|
use Illuminate\Cache\RateLimiting\Limit;
|
|
use Illuminate\Http\Request;
|
|
use Illuminate\Support\Facades\RateLimiter;
|
|
use Illuminate\Support\ServiceProvider;
|
|
|
|
class AppServiceProvider extends ServiceProvider
|
|
{
|
|
/**
|
|
* Register any application services.
|
|
*/
|
|
public function register(): void
|
|
{
|
|
//
|
|
}
|
|
|
|
/**
|
|
* Bootstrap any application services.
|
|
*/
|
|
public function boot(): void
|
|
{
|
|
$this->configureRateLimiting();
|
|
}
|
|
|
|
/**
|
|
* Named api/* rate limiters (T6.1, domain.md §8) — read-only catalog/
|
|
* routing endpoints get a looser limit than the write-heavy booking/
|
|
* payment endpoints; auth/token issuance and the inbound KBZ webhook
|
|
* each get their own tighter limiter.
|
|
*/
|
|
private function configureRateLimiting(): void
|
|
{
|
|
RateLimiter::for('api-read', function (Request $request) {
|
|
return Limit::perMinute(120)->by($request->user()?->id ?: $request->ip());
|
|
});
|
|
|
|
RateLimiter::for('api-write', function (Request $request) {
|
|
return Limit::perMinute(20)->by($request->user()?->id ?: $request->ip());
|
|
});
|
|
|
|
RateLimiter::for('api-auth', function (Request $request) {
|
|
return Limit::perMinute(10)->by($request->ip());
|
|
});
|
|
|
|
RateLimiter::for('api-webhooks', function (Request $request) {
|
|
return Limit::perMinute(30)->by($request->ip());
|
|
});
|
|
}
|
|
}
|