Nyan Lin Paing
46f9b8d5a3
- T6.1: named rate limiters (api-read/api-write/api-auth/api-webhooks), applied per module route group with tighter limits on booking/payment writes and the KBZ webhook than read-only catalog/routing endpoints. - T6.2: install spatie/laravel-activitylog; LogsActivity on Booking/ Payment/Refund status transitions and catalog/pricing admin CRUD (EvCompany, Destination, DepartureTimeSlot, EvRoute, RoutePricing). New IdentityPlugin with a read-only AuditLogResource gated by view_audit_log. - T6.3: JSON error envelope for api/* in bootstrap/app.php (401/403/404/ 405/429/500 fallback), plus PaymentGatewayException (422 declined / 502 unavailable). - T6.4: feature tests proving the FastAPI agent token gets 403 on refund/cancel-not-owned and 405 (no write handler) on catalog/routing writes. - T6.5: install gboquizosanchez/filament-log-viewer with a custom Filament admin theme (required for its views' Tailwind classes to compile), LOG_CHANNEL/FILAMENT_LOG_VIEWER_DRIVER=daily, registered under Operations in the sidebar. 252 tests passing.
19 lines
1001 B
PHP
19 lines
1001 B
PHP
<?php
|
|
|
|
use Illuminate\Support\Facades\Route;
|
|
use Modules\Payment\Http\Controllers\PaymentController;
|
|
use Modules\Payment\Http\Controllers\PaymentWebhookController;
|
|
use Modules\Payment\Http\Controllers\RefundController;
|
|
|
|
Route::prefix('api/v1')->middleware(['api', 'auth:sanctum', 'throttle:api-write'])->group(function () {
|
|
Route::post('/payments/{booking:booking_ref}/initiate', [PaymentController::class, 'initiate'])->name('payment.payments.initiate');
|
|
Route::post('/bookings/{booking:booking_ref}/refund', [RefundController::class, 'refund'])->name('payment.bookings.refund');
|
|
});
|
|
|
|
// No auth:sanctum — the gateway authenticates itself via its own signed
|
|
// payload (verified inside each gateway's handleWebhook()), not a bearer
|
|
// token (domain.md §6).
|
|
Route::prefix('api/v1')->middleware(['api', 'throttle:api-webhooks'])->group(function () {
|
|
Route::post('/webhooks/{method}/{encryptBookingId?}', [PaymentWebhookController::class, 'handle'])->name('payment.webhooks.handle');
|
|
});
|