update rm deadcode

app/Http/Controllers/Api/Admin/Auth/AuthController.php

@@ -9,11 +9,15 @@ use App\Services\ActivityLogger;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Auth;
+use Illuminate\Support\Facades\RateLimiter;
 use Tymon\JWTAuth\Facades\JWTAuth;
 use Tymon\JWTAuth\Exceptions\JWTException;
 
 class AuthController extends Controller
 {
+    private const LOGIN_MAX_ATTEMPTS = 5;
+    private const LOGIN_DECAY_SECONDS = 60;
+
     public function __construct(private readonly ActivityLogger $activityLogger) {}
 
     public function login(Request $request): JsonResponse
@@ -23,9 +27,20 @@ class AuthController extends Controller
             'password' => 'required|string',
         ]);
 
+        $throttleKey = 'admin-login:' . strtolower($request->string('username')->toString()) . '|' . $request->ip();
+
+        if (RateLimiter::tooManyAttempts($throttleKey, self::LOGIN_MAX_ATTEMPTS)) {
+            return response()->json([
+                'error'   => true,
+                'message' => 'Bạn đã đăng nhập sai quá nhiều lần. Vui lòng thử lại sau ít phút.',
+            ], 429);
+        }
+
         $token = Auth::guard('admin')->attempt($request->only('username', 'password'));
 
         if (!$token) {
+            RateLimiter::hit($throttleKey, self::LOGIN_DECAY_SECONDS);
+
             $this->activityLogger->log(
                 event: 'login_failed',
                 logName: 'auth',
@@ -37,6 +52,8 @@ class AuthController extends Controller
             ], 401);
         }
 
+        RateLimiter::clear($throttleKey);
+
         $user = Auth::guard('admin')->user();
 
         $this->activityLogger->logAuth('login', 'admin', $user->id, $user->username ?? $user->email);

app/Http/Controllers/Api/Admin/Customer/CustomerController.php

@@ -362,6 +362,8 @@ class CustomerController extends Controller
             'started_at' => 'nullable|date',
             'expires_at' => 'nullable|date',
             'note' => 'nullable|string',
+            'requirements' => 'nullable|string',
+            'feedback' => 'nullable|string',
             'price' => 'nullable|numeric|min:0',
             'os_id' => 'nullable|integer|exists:os,id',
             'vm_cpu' => 'nullable|integer|min:1',

app/Http/Controllers/Api/Admin/DnsManager/RegistrarController.php

@@ -0,0 +1,18 @@
+<?php
+
+namespace App\Http\Controllers\Api\Admin\DnsManager;
+
+use App\Http\Controllers\Controller;
+use App\Models\Registrar;
+use Illuminate\Http\JsonResponse;
+
+class RegistrarController extends Controller
+{
+    public function index(): JsonResponse
+    {
+        return response()->json([
+            'error' => false,
+            'data'  => Registrar::where('status', 'active')->orderBy('name')->get(['id', 'name', 'short_name', 'website']),
+        ]);
+    }
+}

app/Http/Controllers/Api/Admin/Employee/EmployeeController.php

@@ -92,6 +92,11 @@ class EmployeeController extends Controller
 
         $request->validated();
 
+        $guardError = $this->guardEmployeeMutation($employee, $request->role);
+        if ($guardError) {
+            return $guardError;
+        }
+
         try {
             DB::beginTransaction();
 
@@ -138,6 +143,14 @@ class EmployeeController extends Controller
             ], 404);
         }
 
+        $currentUser = auth('admin')->user();
+        if ($employee->hasRole('Full Administrator') && !$currentUser->hasRole('Full Administrator')) {
+            return response()->json([
+                'error'   => true,
+                'message' => 'Bạn không có quyền xoá tài khoản Full Administrator.',
+            ], 403);
+        }
+
         try {
             DB::beginTransaction();
             $this->employeeRepository->delete($id);
@@ -156,6 +169,34 @@ class EmployeeController extends Controller
         }
     }
 
+    private function guardEmployeeMutation($employee, string $requestedRole): ?JsonResponse
+    {
+        $currentUser = auth('admin')->user();
+
+        if ($employee->hasRole('Full Administrator') && !$currentUser->hasRole('Full Administrator')) {
+            return response()->json([
+                'error'   => true,
+                'message' => 'Bạn không có quyền sửa tài khoản Full Administrator.',
+            ], 403);
+        }
+
+        if ($employee->id === $currentUser->id && !$currentUser->hasRole($requestedRole)) {
+            return response()->json([
+                'error'   => true,
+                'message' => 'Bạn không thể tự đổi vai trò của chính mình.',
+            ], 403);
+        }
+
+        if (in_array($requestedRole, ['Administrator', 'Full Administrator'], true) && !$currentUser->hasRole('Full Administrator')) {
+            return response()->json([
+                'error'   => true,
+                'message' => 'Chỉ Full Administrator mới có quyền gán vai trò này.',
+            ], 403);
+        }
+
+        return null;
+    }
+
     public function roles(): JsonResponse
     {
         $roles = Role::where('guard_name', 'admin')->get(['id', 'name']);

app/Http/Controllers/Api/Admin/Product/ProductController.php

@@ -194,13 +194,13 @@ class ProductController extends Controller
     {
         $currency = $data['currency'] ?? 'VND';
         $cycles = [
-            'monthly'      => 'price_monthly',
-            'quarterly'    => 'price_quarterly',
-            'semiannually' => 'price_semiannually',
-            'annually'     => 'price_annually',
-            'biennially'   => 'price_biennially',
-            'triennially'  => 'price_triennially',
-            'onetime'      => 'price_onetime',
+            'monthly'       => 'price_monthly',
+            'quarterly'     => 'price_quarterly',
+            'semi_annually' => 'price_semiannually',
+            'annually'      => 'price_annually',
+            'biennially'    => 'price_biennially',
+            'triennially'   => 'price_triennially',
+            'onetime'       => 'price_onetime',
         ];
 
         foreach ($cycles as $cycle => $field) {

app/Http/Controllers/Api/Admin/Service/ServiceController.php

@@ -36,7 +36,7 @@ class ServiceController extends Controller
 
     public function show(int $id): JsonResponse
     {
-        $service = Service::with(['customer', 'product', 'orderItem', 'invoice', 'vmware.os.osGroup', 'addons'])
+        $service = Service::with(['customer', 'product', 'orderItem', 'invoice', 'vmware.os.osGroup', 'addons', ...Service::HOSTING_ACCOUNT_RELATIONS])
             ->findOrFail($id);
 
         ModuleVmware::resolveVirtualMachineIds([$service->vmware]);

app/Http/Controllers/Api/Admin/Setting/SettingController.php

@@ -186,7 +186,7 @@ class SettingController extends Controller
     public function uploadMedia(Request $request): JsonResponse
     {
         $request->validate([
-            'file' => 'required|file|mimes:jpg,jpeg,png,webp,svg|max:5120',
+            'file' => 'required|file|mimes:jpg,jpeg,png,webp|max:5120',
         ]);
 
         $path = $request->file('file')->store('system-config', 'public');

app/Http/Controllers/Api/Admin/Transaction/AdminTransactionController.php

@@ -64,7 +64,7 @@ class AdminTransactionController extends Controller
             'type'         => $t->type,
             'status'       => $t->status,
             'status_label' => TransactionStatus::from((int) $t->status)->label(),
-            'proof_image'  => $t->proof_image ? Storage::disk('public')->url($t->proof_image) : null,
+            'proof_image'  => $t->proof_image_urls[0] ?? null,
             'created_at'   => $t->created_at?->toISOString(),
             'customer'     => $t->customer ? [
                 'uuid'     => $t->customer->uuid,
@@ -287,4 +287,21 @@ class AdminTransactionController extends Controller
             'message' => 'Đã từ chối giao dịch',
         ]);
     }
+
+    public function proofImage(Transaction $transaction, int $index = 0)
+    {
+        abort_unless($transaction->proof_image, 404);
+
+        $paths = json_decode((string) $transaction->proof_image, true);
+        $paths = is_array($paths) ? array_values($paths) : [$transaction->proof_image];
+        $path = $paths[$index] ?? null;
+
+        abort_unless(is_string($path) && $path !== '', 404);
+
+        $disk = Storage::disk('local')->exists($path) ? 'local' : 'public';
+
+        abort_unless(Storage::disk($disk)->exists($path), 404);
+
+        return Storage::disk($disk)->response($path, null, ['Cache-Control' => 'private, no-store']);
+    }
 }