feat: harden admin auth and ticket workflows

- add rotating admin refresh tokens and password gates\n- expand ticket galleries, exports, and client resources\n- improve IP allocation auditing and dashboard data\n- enforce encrypted client access tokens on public routes
2026-10-16 17:00:55 +07:00
parent 0cdf224309
commit 0b08689ea4
52 changed files with 1421 additions and 118 deletions
@@ -25,6 +25,22 @@ class ClientAuthSecurityTest extends TestCase
        return $this->withHeaders(['x-access-token' => $this->buildClientAccessToken()]);
    }

+    public function test_client_routes_require_a_valid_encrypted_application_token(): void
+    {
+        $this->getJson('/v1/posts/featured')
+            ->assertForbidden()
+            ->assertJsonPath('message', 'Invalid access token');
+
+        $this->withHeaders(['x-access-token' => 'forged-token'])
+            ->getJson('/v1/posts/featured')
+            ->assertForbidden()
+            ->assertJsonPath('message', 'Invalid access token');
+
+        $this->withHeaders(['x-access-token' => $this->buildClientAccessToken()])
+            ->getJson('/v1/posts/featured')
+            ->assertOk();
+    }
+
    public function test_access_token_older_than_skew_window_is_rejected(): void
    {
        $this->withHeaders(['x-access-token' => $this->buildClientAccessToken(time() - 3600)])