Nyan Lin Paing
914b7f97f3
Two-step flow: request a one-time code by email/phone (RegistrationVerification, mailed via RegistrationCodeMail, rate-limited by the new api-otp limiter keyed to the identifier), then verify the code and register with RegistrationController. User gains a phone column/fillable.
73 lines
2.5 KiB
PHP
73 lines
2.5 KiB
PHP
<?php
|
|
|
|
namespace App\Providers;
|
|
|
|
use Illuminate\Cache\RateLimiting\Limit;
|
|
use Illuminate\Http\Request;
|
|
use Illuminate\Support\Facades\RateLimiter;
|
|
use Illuminate\Support\Facades\URL;
|
|
use Illuminate\Support\ServiceProvider;
|
|
|
|
class AppServiceProvider extends ServiceProvider
|
|
{
|
|
/**
|
|
* Register any application services.
|
|
*/
|
|
public function register(): void
|
|
{
|
|
//
|
|
}
|
|
|
|
/**
|
|
* Bootstrap any application services.
|
|
*/
|
|
public function boot(): void
|
|
{
|
|
$this->configureRateLimiting();
|
|
|
|
// Belt-and-suspenders alongside bootstrap/app.php's trustProxies():
|
|
// that already makes url()/asset() respect the proxy's
|
|
// X-Forwarded-Proto, but if that header is ever missing or a proxy
|
|
// is misconfigured, this still forces https:// asset/route URLs on
|
|
// any environment whose APP_URL is itself https — so a plain-http
|
|
// request never causes a mixed-content-blocked asset again.
|
|
if (str(config('app.url'))->startsWith('https://')) {
|
|
URL::forceScheme('https');
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Named api/* rate limiters (T6.1, domain.md §8) — read-only catalog/
|
|
* routing endpoints get a looser limit than the write-heavy booking/
|
|
* payment endpoints; auth/token issuance and the inbound KBZ webhook
|
|
* each get their own tighter limiter.
|
|
*/
|
|
private function configureRateLimiting(): void
|
|
{
|
|
RateLimiter::for('api-read', function (Request $request) {
|
|
return Limit::perMinute(120)->by($request->user()?->id ?: $request->ip());
|
|
});
|
|
|
|
RateLimiter::for('api-write', function (Request $request) {
|
|
return Limit::perMinute(20)->by($request->user()?->id ?: $request->ip());
|
|
});
|
|
|
|
RateLimiter::for('api-auth', function (Request $request) {
|
|
return Limit::perMinute(10)->by($request->ip());
|
|
});
|
|
|
|
// Tighter than api-auth: layered on top of it for the
|
|
// registration-code request endpoint specifically, keyed by the
|
|
// identifier being verified (falling back to IP) so one target
|
|
// can't be bombed with codes even from rotating IPs, and one IP
|
|
// can't spray codes across many identifiers.
|
|
RateLimiter::for('api-otp', function (Request $request) {
|
|
return Limit::perMinutes(10, 3)->by($request->string('identifier')->toString() ?: $request->ip());
|
|
});
|
|
|
|
RateLimiter::for('api-webhooks', function (Request $request) {
|
|
return Limit::perMinute(30)->by($request->ip());
|
|
});
|
|
}
|
|
}
|