Nyan Lin Paing
46f9b8d5a3
- T6.1: named rate limiters (api-read/api-write/api-auth/api-webhooks), applied per module route group with tighter limits on booking/payment writes and the KBZ webhook than read-only catalog/routing endpoints. - T6.2: install spatie/laravel-activitylog; LogsActivity on Booking/ Payment/Refund status transitions and catalog/pricing admin CRUD (EvCompany, Destination, DepartureTimeSlot, EvRoute, RoutePricing). New IdentityPlugin with a read-only AuditLogResource gated by view_audit_log. - T6.3: JSON error envelope for api/* in bootstrap/app.php (401/403/404/ 405/429/500 fallback), plus PaymentGatewayException (422 declined / 502 unavailable). - T6.4: feature tests proving the FastAPI agent token gets 403 on refund/cancel-not-owned and 405 (no write handler) on catalog/routing writes. - T6.5: install gboquizosanchez/filament-log-viewer with a custom Filament admin theme (required for its views' Tailwind classes to compile), LOG_CHANNEL/FILAMENT_LOG_VIEWER_DRIVER=daily, registered under Operations in the sidebar. 252 tests passing.
40 lines
867 B
PHP
40 lines
867 B
PHP
<?php
|
|
|
|
namespace Modules\Identity\Policies;
|
|
|
|
use App\Models\User;
|
|
use Spatie\Activitylog\Models\Activity;
|
|
|
|
/**
|
|
* The audit trail (T6.2) is read-only from the admin panel — nothing ever
|
|
* creates/edits/deletes an Activity row through Filament, only the
|
|
* LogsActivity trait writes here. Gated by view_audit_log per domain.md §8.
|
|
*/
|
|
class AuditLogPolicy
|
|
{
|
|
public function viewAny(User $user): bool
|
|
{
|
|
return $user->can('view_audit_log');
|
|
}
|
|
|
|
public function view(User $user, Activity $activity): bool
|
|
{
|
|
return $user->can('view_audit_log');
|
|
}
|
|
|
|
public function create(User $user): bool
|
|
{
|
|
return false;
|
|
}
|
|
|
|
public function update(User $user, Activity $activity): bool
|
|
{
|
|
return false;
|
|
}
|
|
|
|
public function delete(User $user, Activity $activity): bool
|
|
{
|
|
return false;
|
|
}
|
|
}
|