feat: Turnstile captcha, menu khách + nút tắt topbar cấu hình từ admin, ẩn setting nhạy cảm

- Turnstile (App\Support\Turnstile, middleware turnstile) cho login admin và login/register/forgot/reset của khách; cấu hình ở setting key=turnstile, secret mã hoá SignRSA. - Menu sidebar khách (setting client_menu) và nút tắt topbar (setting client_quick_links) do admin sửa qua administrator/client-menu[/quick-links], khách đọc v1/setting/menu, v1/setting/quick-links. - v1/setting và settings/public chỉ trả whitelist PublicSetting::FIELDS (trước đây lộ bot_token, inet_api_key). - Cài đặt tài khoản khách (preferences), rate limit theo IP cho register/resend-verify. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-12 15:53:43 +07:00
parent 823af4a56a
commit e888a6ed5d
33 changed files with 1022 additions and 52 deletions
@@ -29,10 +29,16 @@ jobs:
                      git fetch origin production
                      git reset --hard origin/production

+                      echo "==> Installing dependencies..."
+                      composer install --no-dev --no-interaction --prefer-dist --optimize-autoloader
+
                      echo "==> Running migrations..."
                      php artisan migrate --force

                      echo "==> Optimizing Laravel..."
                      php artisan optimize

+                      echo "==> Restarting queue workers..."
+                      php artisan queue:restart
+
                      echo "==> Deploy completed!"
@@ -47,7 +47,8 @@ class ReencryptSecrets extends Command
            $failed += $this->reencryptColumn($table, $column, fn (string $value) => Crypt::encryptString(Crypt::decryptString($value)));
        }

-        $failed += $this->reencryptSmtpSetting();
+        $failed += $this->reencryptJsonSetting('smtp', 'password');
+        $failed += $this->reencryptJsonSetting('turnstile', 'secret_key');

        return $failed === 0 ? self::SUCCESS : self::FAILURE;
    }
@@ -89,27 +90,27 @@ class ReencryptSecrets extends Command
        return $failed;
    }

-    private function reencryptSmtpSetting(): int
+    private function reencryptJsonSetting(string $key, string $field): int
    {
-        $setting = DB::table('setting')->where('key', 'smtp')->first();
-        $smtp = $setting ? json_decode((string) $setting->value, true) : null;
+        $setting = DB::table('setting')->where('key', $key)->first();
+        $value = $setting ? json_decode((string) $setting->value, true) : null;

-        if (empty($smtp['password'])) {
+        if (empty($value[$field])) {
            return 0;
        }

        try {
-            $smtp['password'] = SignRSA::EncryptFunc($this->decryptRsa($smtp['password']));
+            $value[$field] = SignRSA::EncryptFunc($this->decryptRsa($value[$field]));
        } catch (Throwable) {
-            $this->warn('setting[smtp].password: cannot decrypt with current or previous key');
+            $this->warn("setting[{$key}].{$field}: cannot decrypt with current or previous key");

            return 1;
        }

        if (!$this->option('dry-run')) {
-            DB::table('setting')->where('key', 'smtp')->update(['value' => json_encode($smtp)]);
+            DB::table('setting')->where('key', $key)->update(['value' => json_encode($value)]);
        }
-        $this->info('setting[smtp].password: re-encrypted');
+        $this->info("setting[{$key}].{$field}: re-encrypted");

        return 0;
    }
@@ -205,16 +205,16 @@ class ProductController extends Controller
    {
        $currency = $data['currency'] ?? 'VND';
        $cycles = [
-            'monthly'       => 'price_monthly',
-            'quarterly'     => 'price_quarterly',
-            'semi_annually' => 'price_semiannually',
-            'annually'      => 'price_annually',
-            'biennially'    => 'price_biennially',
-            'triennially'   => 'price_triennially',
-            'onetime'       => 'price_onetime',
+            'monthly'       => ['price_monthly', []],
+            'quarterly'     => ['price_quarterly', []],
+            'semi_annually' => ['price_semiannually', ['semiannually']],
+            'annually'      => ['price_annually', []],
+            'biennially'    => ['price_biennially', []],
+            'triennially'   => ['price_triennially', []],
+            'onetime'       => ['price_onetime', ['one_time']],
        ];

-        foreach ($cycles as $cycle => $field) {
+        foreach ($cycles as $cycle => [$field, $legacyCycles]) {
            if (!array_key_exists($field, $data)) {
                continue;
            }
@@ -226,9 +226,12 @@ class ProductController extends Controller
                    ['product_id' => $product->id, 'billing_cycle' => $cycle],
                    ['price' => $price, 'currency' => $currency, 'is_active' => true]
                );
+                ProductPricings::where('product_id', $product->id)
+                    ->whereIn('billing_cycle', $legacyCycles)
+                    ->delete();
            } else {
                ProductPricings::where('product_id', $product->id)
-                    ->where('billing_cycle', $cycle)
+                    ->whereIn('billing_cycle', [$cycle, ...$legacyCycles])
                    ->delete();
            }
        }
@@ -0,0 +1,46 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Controllers\Api\Admin\Setting;
+
+use App\Http\Controllers\Controller;
+use App\Support\ClientMenu;
+use App\Support\ClientQuickLinks;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+
+class ClientMenuController extends Controller
+{
+    public function show(): JsonResponse
+    {
+        return response()->json(['error' => false, 'data' => ClientMenu::items()]);
+    }
+
+    public function update(Request $request): JsonResponse
+    {
+        $validated = $request->validate(ClientMenu::rules());
+
+        return response()->json([
+            'error'   => false,
+            'message' => 'Đã lưu menu.',
+            'data'    => ClientMenu::save($validated['items']),
+        ]);
+    }
+
+    public function showQuickLinks(): JsonResponse
+    {
+        return response()->json(['error' => false, 'data' => ClientQuickLinks::items()]);
+    }
+
+    public function updateQuickLinks(Request $request): JsonResponse
+    {
+        $validated = $request->validate(ClientQuickLinks::rules());
+
+        return response()->json([
+            'error'   => false,
+            'message' => 'Đã lưu nút tắt.',
+            'data'    => ClientQuickLinks::save($validated['items']),
+        ]);
+    }
+}
@@ -9,6 +9,8 @@ use App\Http\Facade\SignRSA;
 use App\Http\Services\Telegram;
 use App\Models\Setting;
 use App\Support\Cache\CacheKey;
+use App\Support\PublicSetting;
+use App\Support\Turnstile;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Cache;
@@ -39,6 +41,7 @@ class SettingController extends Controller
            'data'  => [
                'setting' => $settingValue,
                'smtp'    => $smtpValue,
+                'turnstile' => Turnstile::forAdmin(),
            ],
        ]);
    }
@@ -49,18 +52,9 @@ class SettingController extends Controller
     */
    public function public(): JsonResponse
    {
-        $setting = Setting::where('key', 'setting')->first();
-        $value   = $setting ? json_decode((string) $setting->value, true) : [];
-
        return response()->json([
            'error' => false,
-            'data'  => [
-                'title'       => $value['title'] ?? '',
-                'company'     => $value['company'] ?? '',
-                'logo'        => $value['logo'] ?? '',
-                'favi_icon'   => $value['favi_icon'] ?? '',
-                'brand_color' => $value['brand_color'] ?? '',
-            ],
+            'data'  => PublicSetting::values() + ['turnstile_site_key' => Turnstile::siteKey()],
        ]);
    }

@@ -80,6 +74,10 @@ class SettingController extends Controller
            'smtp.encryption'       => 'sometimes|in:ssl,tls,starttls,',
            'smtp.from_name'        => 'sometimes|string|nullable',
            'smtp.from_address'     => 'sometimes|email|nullable',
+            'turnstile'             => 'sometimes|array',
+            'turnstile.enabled'     => 'sometimes|boolean',
+            'turnstile.site_key'    => 'sometimes|string|nullable|max:255',
+            'turnstile.secret_key'  => 'sometimes|string|nullable|max:255',
        ]);

        if ($validator->fails()) {
@@ -120,6 +118,14 @@ class SettingController extends Controller
            Cache::forget(CacheKey::build('settings', 'mail'));
        }

+        if ($request->has('turnstile')) {
+            try {
+                Turnstile::save($request->input('turnstile'));
+            } catch (\InvalidArgumentException $e) {
+                return response()->json(['error' => true, 'message' => $e->getMessage()], 422);
+            }
+        }
+
        return response()->json([
            'error'   => false,
            'message' => 'Cập nhật cài đặt thành công.',
@@ -9,6 +9,7 @@ use App\Services\Api\Client\ClientAuthService;

 use App\Http\Controllers\Api\Client\Concerns\HandlesClientAuthentication;
 use App\Http\Controllers\Api\Client\Concerns\HandlesClientPasswordReset;
+use App\Http\Controllers\Api\Client\Concerns\ManagesClientAccountSettings;
 use App\Http\Controllers\Api\Client\Concerns\ManagesClientProfile;
 /**
 * @OA\Tag(
@@ -20,6 +21,7 @@ class ClientController extends Controller
 {
    use HandlesClientAuthentication;
    use HandlesClientPasswordReset;
+    use ManagesClientAccountSettings;
    use ManagesClientProfile;

    protected $authService;
@@ -0,0 +1,72 @@
+<?php
+
+namespace App\Http\Controllers\Api\Client\Concerns;
+
+use App\Http\Requests\Api\Client\ClientPreferencesRequest;
+use App\Http\Resources\Api\Client\ClientResource;
+use App\Models\ActivityLog;
+use Illuminate\Http\Request;
+
+trait ManagesClientAccountSettings
+{
+    public function loginHistory(Request $request)
+    {
+        $validated = $request->validate([
+            'page' => ['sometimes', 'integer', 'min:1'],
+            'per_page' => ['sometimes', 'integer', 'in:10,20,50'],
+        ]);
+        $customer = auth('client')->user();
+
+        $history = ActivityLog::query()
+            ->where('log_name', 'auth')
+            ->where('causer_type', 'customer')
+            ->where('causer_id', $customer->id)
+            ->whereIn('event', ['login', 'logout'])
+            ->latest('created_at')
+            ->paginate($validated['per_page'] ?? 10);
+
+        return response()->json([
+            'error' => false,
+            'data' => collect($history->items())->map(fn (ActivityLog $log) => [
+                'id' => $log->id,
+                'event' => $log->event,
+                'ip_address' => $log->ip_address,
+                'user_agent' => $log->user_agent,
+                'created_at' => $log->created_at?->toIso8601String(),
+            ])->values(),
+            'meta' => [
+                'current_page' => $history->currentPage(),
+                'per_page' => $history->perPage(),
+                'total' => $history->total(),
+                'last_page' => $history->lastPage(),
+            ],
+        ]);
+    }
+
+    public function updatePreferences(ClientPreferencesRequest $request)
+    {
+        $customer = auth('client')->user();
+        $oldValues = $customer->only(['email_marketing', 'receive_deposit']);
+
+        $customer->fill($request->validated());
+        $dirty = $customer->getDirty();
+        $customer->save();
+
+        if ($dirty !== []) {
+            $this->activityLogger->log(
+                event: 'preferences_update',
+                logName: 'Customer',
+                description: "Customer {$customer->email} cập nhật tuỳ chọn tài khoản",
+                subject: $customer,
+                oldValues: array_intersect_key($oldValues, $dirty),
+                newValues: $dirty,
+            );
+        }
+
+        return response()->json([
+            'error' => false,
+            'message' => 'Đã lưu cài đặt tài khoản.',
+            'data' => ['client' => new ClientResource($customer->fresh())],
+        ]);
+    }
+}
@@ -4,6 +4,10 @@ namespace App\Http\Controllers\Api\Setting;

 use App\Http\Controllers\Controller;
 use App\Models\Setting;
+use App\Support\ClientMenu;
+use App\Support\ClientQuickLinks;
+use App\Support\PublicSetting;
+use App\Support\Turnstile;

 /**
 * @OA\Tag(
@@ -19,7 +23,7 @@ class SettingController extends Controller
     *     operationId="getSetting",
     *     tags={"Settings"},
     *     summary="Get application settings",
-     *     description="Returns the application settings",
+     *     description="Returns the public application settings (title, company, logo, favi_icon, brand_color)",
     *     @OA\Response(
     *         response=200,
     *         description="Successful operation",
@@ -31,11 +35,10 @@ class SettingController extends Controller
     *     )
     * )
     */
-    public function getSetting()
+    public function getSetting(): \Illuminate\Http\JsonResponse
    {
-        $setting = Setting::where('key', 'setting')->first();
        return response()->json([
-            'data' => $setting->value,
+            'data' => PublicSetting::values(),
            'message' => 'Get setting successfully',
            'error' => false
        ]);
@@ -53,4 +56,28 @@ class SettingController extends Controller
            ],
        ]);
    }
-}
+
+    public function getTurnstileSetting(): \Illuminate\Http\JsonResponse
+    {
+        return response()->json([
+            'error' => false,
+            'data'  => ['site_key' => Turnstile::siteKey()],
+        ]);
+    }
+
+    public function getMenu(): \Illuminate\Http\JsonResponse
+    {
+        return response()->json([
+            'error' => false,
+            'data'  => ClientMenu::items(),
+        ]);
+    }
+
+    public function getQuickLinks(): \Illuminate\Http\JsonResponse
+    {
+        return response()->json([
+            'error' => false,
+            'data'  => ClientQuickLinks::items(),
+        ]);
+    }
+}
@@ -87,5 +87,6 @@ class Kernel extends HttpKernel
        'client.access-token' => \App\Http\Middleware\ClientAccessTokenCheck::class,
        'perm'     => \App\Http\Middleware\CheckPermission::class,
        'restrict.local' => \App\Http\Middleware\RestrictToLocalEnvironment::class,
+        'turnstile' => \App\Http\Middleware\VerifyTurnstile::class,
    ];
 }
@@ -0,0 +1,25 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Middleware;
+
+use App\Support\Turnstile;
+use Closure;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpFoundation\Response;
+
+class VerifyTurnstile
+{
+    public function handle(Request $request, Closure $next): Response
+    {
+        if (!Turnstile::verify($request->input(Turnstile::TOKEN_FIELD), $request->ip())) {
+            return response()->json([
+                'error'   => true,
+                'message' => 'Xác minh bảo mật (captcha) không hợp lệ hoặc đã hết hạn. Vui lòng thử lại.',
+            ], 422);
+        }
+
+        return $next($request);
+    }
+}
@@ -0,0 +1,21 @@
+<?php
+
+namespace App\Http\Requests\Api\Client;
+
+use Illuminate\Foundation\Http\FormRequest;
+
+class ClientPreferencesRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return auth('client')->check();
+    }
+
+    public function rules(): array
+    {
+        return [
+            'email_marketing' => ['required', 'boolean'],
+            'receive_deposit' => ['required', 'boolean'],
+        ];
+    }
+}
@@ -27,7 +27,7 @@ class ClientRegisterRequest extends FormRequest
                'max:255'
            ],
            'phone' => [
-                'required',
+                'nullable',
                'digits:10',
                'unique:customers,phone'
            ],
@@ -59,7 +59,6 @@ class ClientRegisterRequest extends FormRequest
    {
        return [
            'fullname.required' => 'Tên là bắt buộc',
-            'phone.required' => 'Số điện thoại là bắt buộc',
            'phone.digits' => 'Số điện thoại phải có 10 chữ số',
            'phone.unique' => 'Số điện thoại đã tồn tại',
            'email.required' => 'Email là bắt buộc',
@@ -40,21 +40,19 @@ class ProductResource extends JsonResource
            'setup_fee'    => $this->setup_fee,
            'min_price'    => $minPrice,
            'billing_type' => $this->whenLoaded('pricings', function () {
-                // 'one_time' (with underscore) is the convention used everywhere else in the
-                // app (OrderHelper::cycleToMonths, ServiceExpiry, renewService, product_pricings
-                // migration comment) — this used to check 'onetime' and never matched real rows.
-                $hasOnetime  = $this->pricings->where('billing_cycle', 'one_time')->isNotEmpty();
-                $hasRecurring = $this->pricings->where('billing_cycle', '!=', 'one_time')->isNotEmpty();
-                return ($hasOnetime && !$hasRecurring) ? 'one_time' : 'recurring';
+                $oneTimeCycles = ['onetime', 'one_time'];
+                $hasOnetime = $this->pricings->whereIn('billing_cycle', $oneTimeCycles)->isNotEmpty();
+                $hasRecurring = $this->pricings->whereNotIn('billing_cycle', $oneTimeCycles)->isNotEmpty();
+                return ($hasOnetime && !$hasRecurring) ? 'onetime' : 'recurring';
            }),
            'currency'           => $this->whenLoaded('pricings', fn () => $this->pricings->first()?->currency ?? 'VND'),
            'price_monthly'      => $this->whenLoaded('pricings', fn () => optional($this->pricings->firstWhere('billing_cycle', 'monthly'))->price),
            'price_quarterly'    => $this->whenLoaded('pricings', fn () => optional($this->pricings->firstWhere('billing_cycle', 'quarterly'))->price),
-            'price_semiannually' => $this->whenLoaded('pricings', fn () => optional($this->pricings->firstWhere('billing_cycle', 'semi_annually'))->price),
+            'price_semiannually' => $this->whenLoaded('pricings', fn () => optional($this->pricings->first(fn ($pricing) => in_array($pricing->billing_cycle, ['semi_annually', 'semiannually'], true)))->price),
            'price_annually'     => $this->whenLoaded('pricings', fn () => optional($this->pricings->firstWhere('billing_cycle', 'annually'))->price),
            'price_biennially'   => $this->whenLoaded('pricings', fn () => optional($this->pricings->firstWhere('billing_cycle', 'biennially'))->price),
            'price_triennially'  => $this->whenLoaded('pricings', fn () => optional($this->pricings->firstWhere('billing_cycle', 'triennially'))->price),
-            'price_onetime'      => $this->whenLoaded('pricings', fn () => optional($this->pricings->firstWhere('billing_cycle', 'one_time'))->price),
+            'price_onetime'      => $this->whenLoaded('pricings', fn () => optional($this->pricings->first(fn ($pricing) => in_array($pricing->billing_cycle, ['onetime', 'one_time'], true)))->price),
            'is_active'    => $this->is_active,
            'created_at'   => $this->created_at,
            'os_ids'       => $osIds,
@@ -40,6 +40,8 @@ class ClientResource extends JsonResource
                'fb_link' => null,
                'active_2fa' => 0,
                'off_mail_marketing' => $this->off_mail_marketing,
+                'email_marketing' => (bool) $this->email_marketing,
+                'receive_deposit' => (bool) $this->receive_deposit,
                'is_recharge_zalo' => 0,
                'is_verify_telegram' => 0,
            ],
@@ -78,8 +78,19 @@ class RouteServiceProvider extends ServiceProvider
        // IP gần như luôn là IP của Next → khoá theo route + email, không theo IP (tránh chặn chung mọi khách).
        RateLimiter::for('client-auth', function (Request $request) {
            $email = strtolower(trim((string) $request->input('email')));
+            $route = $request->route()?->getName();
+            $byEmail = Limit::perMinute(5)->by($route . '|' . ($email ?: $request->ip()));

-            return Limit::perMinute(5)->by($request->route()?->getName() . '|' . ($email ?: $request->ip()));
+            $perIpHourly = [
+                'api.client.register'      => 5,
+                'api.client.resend-verify' => 10,
+            ];
+
+            if (!isset($perIpHourly[$route])) {
+                return $byEmail;
+            }
+
+            return [$byEmail, Limit::perHour($perIpHourly[$route])->by($route . '|ip|' . $request->ip())];
        });
    }
 }
@@ -86,7 +86,7 @@ class ClientAuthService

        $client = $this->clientRepository->create([
            'fullname'                    => $data['fullname'],
-            'phone'                       => $data['phone'],
+            'phone'                       => $data['phone'] ?? null,
            'email'                       => $data['email'],
            'password'                    => bcrypt($data['password']),
            'status'                      => 0,
@@ -0,0 +1,75 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Support;
+
+use App\Models\Setting;
+
+final class ClientMenu
+{
+    public const SETTING_KEY = 'client_menu';
+
+    public const HREF_PATTERN = '#^(/(?!/)|https?://)#i';
+
+    public const ICON_PATTERN = '/^[a-z0-9-]+:[a-z0-9-]+$/i';
+
+    /**
+     * @return list<array{title: string, icon: ?string, href: ?string, disabled: bool, children: list<array{title: string, icon: ?string, href: string, disabled: bool}>}>
+     */
+    public static function items(): array
+    {
+        $value = json_decode((string) Setting::where('key', self::SETTING_KEY)->value('value'), true);
+
+        return is_array($value) ? $value : [];
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    public static function rules(): array
+    {
+        return [
+            'items'                       => 'present|array|max:30',
+            'items.*'                     => 'array',
+            'items.*.title'               => 'required|string|max:60',
+            'items.*.icon'                => ['nullable', 'string', 'max:100', 'regex:' . self::ICON_PATTERN],
+            'items.*.href'                => ['nullable', 'required_without:items.*.children', 'string', 'max:255', 'regex:' . self::HREF_PATTERN],
+            'items.*.disabled'            => 'sometimes|boolean',
+            'items.*.children'            => 'sometimes|array|max:20',
+            'items.*.children.*.title'    => 'required|string|max:60',
+            'items.*.children.*.icon'     => ['nullable', 'string', 'max:100', 'regex:' . self::ICON_PATTERN],
+            'items.*.children.*.href'     => ['required', 'string', 'max:255', 'regex:' . self::HREF_PATTERN],
+            'items.*.children.*.disabled' => 'sometimes|boolean',
+        ];
+    }
+
+    /**
+     * @param  array<int, array<string, mixed>>  $items
+     */
+    public static function save(array $items): array
+    {
+        $normalized = array_map(fn (array $item) => [
+            ...self::normalizeLink($item),
+            'children' => array_map(self::normalizeLink(...), array_values($item['children'] ?? [])),
+        ], array_values($items));
+
+        Setting::updateOrCreate(['key' => self::SETTING_KEY], ['value' => json_encode($normalized, JSON_UNESCAPED_UNICODE)]);
+
+        return $normalized;
+    }
+
+    /**
+     * @param  array<string, mixed>  $item
+     * @return array{title: string, icon: ?string, href: ?string, disabled: bool}
+     */
+    public static function normalizeLink(array $item): array
+    {
+        return [
+            'title'    => trim((string) $item['title']),
+            'icon'     => ($item['icon'] ?? '') !== '' ? (string) $item['icon'] : null,
+            'href'     => ($item['href'] ?? '') !== '' ? (string) $item['href'] : null,
+            'disabled' => (bool) ($item['disabled'] ?? false),
+        ];
+    }
+}
@@ -0,0 +1,49 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Support;
+
+use App\Models\Setting;
+
+final class ClientQuickLinks
+{
+    public const SETTING_KEY = 'client_quick_links';
+
+    /**
+     * @return list<array{title: string, icon: ?string, href: string, disabled: bool}>
+     */
+    public static function items(): array
+    {
+        $value = json_decode((string) Setting::where('key', self::SETTING_KEY)->value('value'), true);
+
+        return is_array($value) ? $value : [];
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    public static function rules(): array
+    {
+        return [
+            'items'            => 'present|array|max:6',
+            'items.*'          => 'array',
+            'items.*.title'    => 'required|string|max:40',
+            'items.*.icon'     => ['nullable', 'string', 'max:100', 'regex:' . ClientMenu::ICON_PATTERN],
+            'items.*.href'     => ['required', 'string', 'max:255', 'regex:' . ClientMenu::HREF_PATTERN],
+            'items.*.disabled' => 'sometimes|boolean',
+        ];
+    }
+
+    /**
+     * @param  array<int, array<string, mixed>>  $items
+     */
+    public static function save(array $items): array
+    {
+        $normalized = array_map(ClientMenu::normalizeLink(...), array_values($items));
+
+        Setting::updateOrCreate(['key' => self::SETTING_KEY], ['value' => json_encode($normalized, JSON_UNESCAPED_UNICODE)]);
+
+        return $normalized;
+    }
+}
@@ -0,0 +1,20 @@
+<?php
+
+namespace App\Support;
+
+use App\Models\Setting;
+
+final class PublicSetting
+{
+    public const FIELDS = ['title', 'company', 'logo', 'favi_icon', 'brand_color'];
+
+    /**
+     * @return array<string, string>
+     */
+    public static function values(): array
+    {
+        $value = json_decode((string) Setting::where('key', 'setting')->value('value'), true) ?: [];
+
+        return array_map(fn (string $field) => (string) ($value[$field] ?? ''), array_combine(self::FIELDS, self::FIELDS));
+    }
+}
@@ -0,0 +1,113 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Support;
+
+use App\Http\Facade\SignRSA;
+use App\Models\Setting;
+use Illuminate\Support\Facades\Http;
+use Illuminate\Support\Facades\Log;
+use InvalidArgumentException;
+use Throwable;
+
+final class Turnstile
+{
+    public const SETTING_KEY = 'turnstile';
+
+    public const TOKEN_FIELD = 'cf-turnstile-response';
+
+    public const SECRET_MASK = '********';
+
+    private const VERIFY_URL = 'https://challenges.cloudflare.com/turnstile/v0/siteverify';
+
+    /**
+     * @return array{enabled: bool, site_key: string, secret_key: string}
+     */
+    public static function stored(): array
+    {
+        $value = json_decode((string) Setting::where('key', self::SETTING_KEY)->value('value'), true) ?: [];
+
+        return [
+            'enabled'    => (bool) ($value['enabled'] ?? false),
+            'site_key'   => (string) ($value['site_key'] ?? ''),
+            'secret_key' => (string) ($value['secret_key'] ?? ''),
+        ];
+    }
+
+    public static function siteKey(): ?string
+    {
+        $config = self::stored();
+
+        return $config['enabled'] && $config['site_key'] !== '' && $config['secret_key'] !== ''
+            ? $config['site_key']
+            : null;
+    }
+
+    public static function verify(?string $token, ?string $ip): bool
+    {
+        if (self::siteKey() === null) {
+            return true;
+        }
+
+        if ($token === null || $token === '' || strlen($token) > 2048) {
+            return false;
+        }
+
+        try {
+            $response = Http::asForm()->timeout(10)->post(self::VERIFY_URL, array_filter([
+                'secret'   => SignRSA::DecryptFunc(self::stored()['secret_key']),
+                'response' => $token,
+                'remoteip' => $ip,
+            ]));
+        } catch (Throwable $e) {
+            Log::warning('Turnstile siteverify failed', ['error' => $e->getMessage()]);
+
+            return false;
+        }
+
+        if ($response->json('success') !== true) {
+            Log::info('Turnstile rejected', ['codes' => $response->json('error-codes')]);
+
+            return false;
+        }
+
+        return true;
+    }
+
+    /**
+     * @param array<string, mixed> $input
+     */
+    public static function save(array $input): void
+    {
+        $current = self::stored();
+        $secret = (string) ($input['secret_key'] ?? self::SECRET_MASK);
+
+        $config = [
+            'enabled'    => (bool) ($input['enabled'] ?? $current['enabled']),
+            'site_key'   => trim((string) ($input['site_key'] ?? $current['site_key'])),
+            'secret_key' => match (true) {
+                $secret === self::SECRET_MASK => $current['secret_key'],
+                trim($secret) === ''          => '',
+                default                       => SignRSA::EncryptFunc(trim($secret)),
+            },
+        ];
+
+        if ($config['enabled'] && ($config['site_key'] === '' || $config['secret_key'] === '')) {
+            throw new InvalidArgumentException('Cần nhập Site key và Secret key trước khi bật Turnstile.');
+        }
+
+        Setting::updateOrCreate(['key' => self::SETTING_KEY], ['value' => json_encode($config)]);
+    }
+
+    /**
+     * @return array{enabled: bool, site_key: string, secret_key: string}
+     */
+    public static function forAdmin(): array
+    {
+        $config = self::stored();
+        $config['secret_key'] = $config['secret_key'] === '' ? '' : self::SECRET_MASK;
+
+        return $config;
+    }
+}
@@ -0,0 +1,55 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Support\Facades\DB;
+
+return new class extends Migration
+{
+    private const KEY = 'client_menu';
+
+    public function up(): void
+    {
+        if (DB::table('setting')->where('key', self::KEY)->exists()) {
+            return;
+        }
+
+        $link = fn (string $title, string $icon, ?string $href, array $children = []) => [
+            'title' => $title, 'icon' => $icon, 'href' => $href, 'disabled' => false, 'children' => $children,
+        ];
+        $child = fn (string $title, string $icon, string $href) => [
+            'title' => $title, 'icon' => $icon, 'href' => $href, 'disabled' => false,
+        ];
+
+        $menu = [
+            $link('Dashboard', 'hugeicons:dashboard-square-01', '/'),
+            $link('Đăng ký dịch vụ', 'hugeicons:cloud', null, [
+                $child('VPS', 'hugeicons:archive-04', '/san-pham/vps'),
+                $child('Tên miền', 'hugeicons:tags', '/dang-ky-ten-mien'),
+                $child('Hosting', 'hugeicons:hard-drive', '/san-pham/hosting'),
+            ]),
+            $link('Quản lý dịch vụ', 'hugeicons:3-d-view', null, [
+                $child('VPS', 'hugeicons:archive-04', '/dich-vu/vps'),
+                $child('Domain', 'hugeicons:global', '/dich-vu/domain'),
+                $child('Hosting', 'hugeicons:hard-drive', '/dich-vu/hosting'),
+            ]),
+            $link('Quản lý thanh toán', 'hugeicons:layer', '/don-hang'),
+            $link('Ticket hỗ trợ', 'hugeicons:customer-service', '/tickets'),
+            $link('Trung tâm hướng dẫn', 'hugeicons:book-open-01', '/docs'),
+            $link('Nạp tiền', 'hugeicons:coins-dollar', '/nap-tien'),
+            $link('Lịch sử giao dịch', 'hugeicons:settings-02', '/lich-su-giao-dich'),
+            $link('Thông báo', 'hugeicons:notification-03', '/thong-bao'),
+        ];
+
+        DB::table('setting')->insert([
+            'key'        => self::KEY,
+            'value'      => json_encode($menu, JSON_UNESCAPED_UNICODE),
+            'created_at' => now(),
+            'updated_at' => now(),
+        ]);
+    }
+
+    public function down(): void
+    {
+        DB::table('setting')->where('key', self::KEY)->delete();
+    }
+};
@@ -0,0 +1,30 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Support\Facades\DB;
+
+return new class extends Migration
+{
+    private const KEY = 'client_quick_links';
+
+    public function up(): void
+    {
+        if (DB::table('setting')->where('key', self::KEY)->exists()) {
+            return;
+        }
+
+        DB::table('setting')->insert([
+            'key'        => self::KEY,
+            'value'      => json_encode([
+                ['title' => 'Tạo Cloud VPS', 'icon' => 'lucide:cloud', 'href' => '/san-pham/vps', 'disabled' => false],
+            ], JSON_UNESCAPED_UNICODE),
+            'created_at' => now(),
+            'updated_at' => now(),
+        ]);
+    }
+
+    public function down(): void
+    {
+        DB::table('setting')->where('key', self::KEY)->delete();
+    }
+};
@@ -19,7 +19,7 @@ Route::prefix('v1')
    /* Api for Admin */
    ->group(function () {
        Route::prefix('administrator')->group(function () {
-            Route::post('login', [AuthController::class, 'login'])->middleware('throttle:30,1');
+            Route::post('login', [AuthController::class, 'login'])->middleware(['throttle:30,1', 'turnstile']);

            Route::middleware('api.auth:admin')->group(function () {
                require __DIR__.'/api/admin/auth.php';
@@ -4,6 +4,7 @@ use App\Http\Controllers\Api\Admin\ActivityLog\ActivityLogController;
 use App\Http\Controllers\Api\Admin\EmailLog\EmailLogController;
 use App\Http\Controllers\Api\Admin\EmailTemplate\EmailTemplateController;
 use App\Http\Controllers\Api\Admin\MailCampaign\MailCampaignController;
+use App\Http\Controllers\Api\Admin\Setting\ClientMenuController;
 use App\Http\Controllers\Api\Admin\Setting\SettingController as AdminSettingController;
 use App\Http\Controllers\Api\Admin\Staff\StaffOnlineController;
 use App\Http\Controllers\Api\Admin\Ticket\TicketController as AdminTicketController;
@@ -21,6 +22,16 @@ Route::prefix('settings')
        Route::post('test-telegram', 'testTelegram');
    });

+Route::prefix('client-menu')
+    ->controller(ClientMenuController::class)
+    ->middleware('perm:setting.manager')
+    ->group(function () {
+        Route::get('/', 'show');
+        Route::put('/', 'update');
+        Route::get('quick-links', 'showQuickLinks');
+        Route::put('quick-links', 'updateQuickLinks');
+    });
+
 // VAT settings per service type (module: settings)
 Route::prefix('vat-settings')
    ->controller(AdminSettingController::class)
@@ -31,13 +31,13 @@ Route::prefix('v1')
            ->as('client.')
            ->group(function () {
                Route::controller(ClientController::class)->group(function () {
-                    Route::post('login', 'login')->middleware('throttle:client-auth')->name('login');
-                    Route::post('register', 'register')->middleware('throttle:client-auth')->name('register');
+                    Route::post('login', 'login')->middleware(['throttle:client-auth', 'turnstile'])->name('login');
+                    Route::post('register', 'register')->middleware(['throttle:client-auth', 'turnstile'])->name('register');
                    Route::post('verify-email', 'verifyEmail')->middleware('throttle:client-auth')->name('verify-email');
                    Route::post('resend-verify', 'resendVerifyCode')->middleware('throttle:client-auth')->name('resend-verify');
                    Route::post('refresh', 'refresh')->name('refresh');
-                    Route::post('forgot-password', 'forgotPassword')->middleware('throttle:client-auth')->name('forgot-password');
-                    Route::post('reset-password', 'resetPassword')->middleware('throttle:client-auth')->name('reset-password');
+                    Route::post('forgot-password', 'forgotPassword')->middleware(['throttle:client-auth', 'turnstile'])->name('forgot-password');
+                    Route::post('reset-password', 'resetPassword')->middleware(['throttle:client-auth', 'turnstile'])->name('reset-password');
                    // Ảnh CCCD nằm trên disk private, chỉ truy cập qua URL ký (ClientResource cấp, hết hạn 60 phút)
                    Route::get('cccd/{customer}/{side}', 'cccdImage')
                        ->whereNumber('customer')
@@ -50,6 +50,8 @@ Route::prefix('v1')
                        Route::get('me', 'me')->name('me');
                        Route::post('logout', 'logout')->name('logout');
                        Route::put('update', 'update')->name('update');
+                        Route::get('login-history', 'loginHistory')->name('login-history');
+                        Route::put('preferences', 'updatePreferences')->name('preferences.update');
                        Route::post('update-cccd', 'updateCccd')->name('update-cccd');
                        Route::put('change-password', 'changePassword')->name('change-password');
                    });
@@ -195,6 +197,9 @@ Route::prefix('v1')
                Route::controller(SettingController::class)->group(function () {
                    Route::get('/', 'getSetting')->name('get');
                    Route::get('email', 'getEmailSetting')->name('email');
+                    Route::get('turnstile', 'getTurnstileSetting')->name('turnstile');
+                    Route::get('menu', 'getMenu')->name('menu');
+                    Route::get('quick-links', 'getQuickLinks')->name('quick-links');
                });
            });

@@ -0,0 +1,89 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tests\Feature\Api\Admin;
+
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Spatie\Permission\Models\Permission;
+use Spatie\Permission\Models\Role;
+use Tests\TestCase;
+
+class ClientMenuTest extends TestCase
+{
+    use RefreshDatabase;
+
+    private function admin(): User
+    {
+        $role = Role::create(['name' => 'role-' . uniqid(), 'guard_name' => 'admin']);
+        $role->givePermissionTo(Permission::firstOrCreate(['name' => 'setting.manager', 'guard_name' => 'admin']));
+        $admin = User::factory()->create();
+        $admin->assignRole($role);
+
+        return $admin;
+    }
+
+    public function test_admin_saves_menu_and_client_reads_it(): void
+    {
+        $items = [
+            ['title' => 'Dashboard', 'icon' => 'hugeicons:home-01', 'href' => '/'],
+            ['title' => 'Dịch vụ', 'icon' => null, 'href' => null, 'children' => [
+                ['title' => 'VPS', 'href' => '/dich-vu/vps', 'disabled' => true],
+            ]],
+        ];
+
+        $this->actingAs($this->admin(), 'admin')
+            ->putJson('/api/v1/administrator/client-menu', ['items' => $items])
+            ->assertOk();
+
+        $this->withHeaders(['x-access-token' => $this->buildClientAccessToken()])
+            ->getJson('/v1/setting/menu')
+            ->assertOk()
+            ->assertJsonPath('data.0.title', 'Dashboard')
+            ->assertJsonPath('data.0.children', [])
+            ->assertJsonPath('data.1.href', null)
+            ->assertJsonPath('data.1.children.0.href', '/dich-vu/vps')
+            ->assertJsonPath('data.1.children.0.disabled', true);
+    }
+
+    public function test_rejects_unsafe_href_and_leaf_without_href(): void
+    {
+        $admin = $this->admin();
+
+        $this->actingAs($admin, 'admin')
+            ->putJson('/api/v1/administrator/client-menu', ['items' => [
+                ['title' => 'X', 'href' => 'javascript:alert(1)'],
+                ['title' => 'Y', 'href' => '//evil.example'],
+                ['title' => 'Z', 'href' => null],
+                ['title' => 'W', 'href' => null, 'children' => [['title' => 'C', 'href' => 'data:text/html,x']]],
+            ]])
+            ->assertStatus(422)
+            ->assertJsonValidationErrors(['items.0.href', 'items.1.href', 'items.2.href', 'items.3.children.0.href']);
+    }
+
+    public function test_admin_saves_quick_links_and_client_reads_them(): void
+    {
+        $admin = $this->admin();
+
+        $this->actingAs($admin, 'admin')
+            ->putJson('/api/v1/administrator/client-menu/quick-links', ['items' => [
+                ['title' => 'Tạo Cloud VPS', 'icon' => 'lucide:cloud', 'href' => '/san-pham/vps'],
+            ]])
+            ->assertOk();
+
+        $this->withHeaders(['x-access-token' => $this->buildClientAccessToken()])
+            ->getJson('/v1/setting/quick-links')
+            ->assertOk()
+            ->assertJsonPath('data.0.title', 'Tạo Cloud VPS')
+            ->assertJsonPath('data.0.disabled', false);
+
+        $this->actingAs($admin, 'admin')
+            ->putJson('/api/v1/administrator/client-menu/quick-links', ['items' => [
+                ['title' => 'X', 'href' => 'javascript:alert(1)'],
+                ['title' => 'Y', 'href' => null],
+            ]])
+            ->assertStatus(422)
+            ->assertJsonValidationErrors(['items.0.href', 'items.1.href']);
+    }
+}
@@ -56,6 +56,7 @@ class PermissionGatingTest extends TestCase
    {
        return [
            'settings index'            => ['GET', '/api/v1/administrator/settings', 'setting.manager'],
+            'client-menu index'         => ['GET', '/api/v1/administrator/client-menu', 'setting.manager'],
            'banks index'               => ['GET', '/api/v1/administrator/banks', 'setting.manager'],
            'domain-pricing index'      => ['GET', '/api/v1/administrator/domain-pricing', 'setting.manager'],
            'email-templates index'     => ['GET', '/api/v1/administrator/email-templates', 'email-template.manager'],
@@ -0,0 +1,89 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tests\Feature\Api\Client;
+
+use App\Models\ActivityLog;
+use App\Models\Customer;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Tests\TestCase;
+
+class ClientAccountSettingsTest extends TestCase
+{
+    use RefreshDatabase;
+
+    private function api(): static
+    {
+        return $this->withHeaders(['x-access-token' => $this->buildClientAccessToken()]);
+    }
+
+    public function test_customer_can_only_read_their_own_login_history(): void
+    {
+        $customer = Customer::factory()->create(['status' => 1]);
+        $other = Customer::factory()->create(['status' => 1]);
+
+        ActivityLog::create([
+            'log_name' => 'auth',
+            'event' => 'login',
+            'description' => 'customer login',
+            'causer_type' => 'customer',
+            'causer_id' => $customer->id,
+            'causer_name' => $customer->email,
+            'ip_address' => '203.0.113.10',
+            'user_agent' => 'Mozilla/5.0 Chrome/130.0',
+        ]);
+        ActivityLog::create([
+            'log_name' => 'auth',
+            'event' => 'login',
+            'description' => 'other customer login',
+            'causer_type' => 'customer',
+            'causer_id' => $other->id,
+            'causer_name' => $other->email,
+            'ip_address' => '198.51.100.20',
+        ]);
+
+        $response = $this->actingAs($customer, 'client')
+            ->api()
+            ->getJson('/v1/client/login-history?per_page=10')
+            ->assertOk()
+            ->assertJsonPath('meta.total', 1)
+            ->assertJsonPath('data.0.ip_address', '203.0.113.10');
+
+        $this->assertCount(1, $response->json('data'));
+    }
+
+    public function test_customer_can_update_account_preferences(): void
+    {
+        $customer = Customer::factory()->create([
+            'status' => 1,
+            'email_marketing' => 1,
+            'receive_deposit' => 1,
+        ]);
+
+        $this->actingAs($customer, 'client')
+            ->api()
+            ->putJson('/v1/client/preferences', [
+                'email_marketing' => false,
+                'receive_deposit' => true,
+            ])
+            ->assertOk()
+            ->assertJsonPath('data.client.customer.email_marketing', false)
+            ->assertJsonPath('data.client.customer.receive_deposit', true);
+
+        $customer->refresh();
+        $this->assertSame(0, (int) $customer->email_marketing);
+        $this->assertSame(1, (int) $customer->receive_deposit);
+    }
+
+    public function test_preferences_require_both_boolean_values(): void
+    {
+        $customer = Customer::factory()->create(['status' => 1]);
+
+        $this->actingAs($customer, 'client')
+            ->api()
+            ->putJson('/v1/client/preferences', ['email_marketing' => 'yes'])
+            ->assertStatus(422)
+            ->assertJsonValidationErrors(['email_marketing', 'receive_deposit']);
+    }
+}
@@ -0,0 +1,42 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tests\Feature\Api\Client;
+
+use App\Models\Setting;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Tests\TestCase;
+
+class PublicSettingTest extends TestCase
+{
+    use RefreshDatabase;
+
+    public function test_public_setting_endpoints_expose_only_whitelisted_fields(): void
+    {
+        Setting::updateOrCreate(['key' => 'setting'], ['value' => json_encode([
+            'title'             => 'Portal',
+            'brand_color'       => '#EF6824',
+            'bot_token'         => 'secret-bot-token',
+            'inet_api_key'      => 'secret-inet-key',
+            'telegram_group_id' => '-100123',
+            'admin_email'       => 'admin@example.com',
+        ])]);
+
+        $client = $this->withHeaders(['x-access-token' => $this->buildClientAccessToken()])
+            ->getJson('/v1/setting')
+            ->assertOk()
+            ->assertJsonPath('data.title', 'Portal')
+            ->assertJsonPath('data.brand_color', '#EF6824');
+
+        $admin = $this->getJson('/api/v1/settings/public')->assertOk();
+
+        foreach ([$client, $admin] as $response) {
+            $body = $response->getContent();
+            $this->assertStringNotContainsString('secret-bot-token', $body);
+            $this->assertStringNotContainsString('secret-inet-key', $body);
+            $this->assertStringNotContainsString('-100123', $body);
+            $this->assertStringNotContainsString('admin@example.com', $body);
+        }
+    }
+}
@@ -30,13 +30,12 @@ class SecurityHardeningTest extends TestCase
    {
        $response = $this->withHeaders(['x-access-token' => $this->buildClientAccessToken()])->postJson('/v1/client/register', [
            'fullname' => 'Nguyen Van B',
-            'phone'    => '0912345679',
            'email'    => 'long-pass@example.com',
            'password' => 'abcdefghij',
            'password_confirmation' => 'abcdefghij',
        ]);

-        $response->assertJsonMissingValidationErrors('password');
+        $response->assertJsonMissingValidationErrors(['password', 'phone']);
    }

    public function test_cccd_upload_rejects_svg(): void
@@ -0,0 +1,36 @@
+<?php
+
+namespace Tests\Feature\Support;
+
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\RateLimiter;
+use Illuminate\Support\Facades\Route;
+use Tests\TestCase;
+
+class RegisterThrottleTest extends TestCase
+{
+    private function limitsFor(string $routeName): mixed
+    {
+        $route = Route::getRoutes()->getByName($routeName);
+        $request = Request::create('/' . $route->uri(), 'POST', ['email' => 'a@example.com'], [], [], ['REMOTE_ADDR' => '9.9.9.9']);
+        $request->setRouteResolver(fn () => $route);
+
+        return RateLimiter::limiter('client-auth')($request);
+    }
+
+    public function test_email_sending_routes_are_limited_per_ip_across_emails(): void
+    {
+        foreach (['api.client.register' => 5, 'api.client.resend-verify' => 10] as $name => $max) {
+            $limits = $this->limitsFor($name);
+
+            $this->assertCount(2, $limits);
+            $this->assertSame($name . '|ip|9.9.9.9', $limits[1]->key);
+            $this->assertSame($max, $limits[1]->maxAttempts);
+        }
+    }
+
+    public function test_other_auth_routes_keep_single_email_limit(): void
+    {
+        $this->assertInstanceOf(\Illuminate\Cache\RateLimiting\Limit::class, $this->limitsFor('api.client.login'));
+    }
+}
@@ -0,0 +1,72 @@
+<?php
+
+namespace Tests\Feature\Support;
+
+use App\Http\Facade\SignRSA;
+use App\Models\Setting;
+use App\Support\Turnstile;
+use Illuminate\Foundation\Testing\DatabaseTransactions;
+use Illuminate\Support\Facades\Http;
+use InvalidArgumentException;
+use Tests\TestCase;
+
+class TurnstileTest extends TestCase
+{
+    use DatabaseTransactions;
+
+    private function configure(bool $enabled): void
+    {
+        Setting::updateOrCreate(['key' => Turnstile::SETTING_KEY], ['value' => json_encode([
+            'enabled'    => $enabled,
+            'site_key'   => 'site',
+            'secret_key' => SignRSA::EncryptFunc('secret'),
+        ])]);
+    }
+
+    public function test_disabled_passes_without_token(): void
+    {
+        $this->configure(false);
+        Http::fake();
+
+        $this->assertNull(Turnstile::siteKey());
+        $this->assertTrue(Turnstile::verify(null, null));
+        Http::assertNothingSent();
+    }
+
+    public function test_enabled_requires_valid_token(): void
+    {
+        $this->configure(true);
+        Http::fake(['challenges.cloudflare.com/*' => Http::sequence()
+            ->push(['success' => true])
+            ->push(['success' => false, 'error-codes' => ['timeout-or-duplicate']])]);
+
+        $this->assertSame('site', Turnstile::siteKey());
+        $this->assertFalse(Turnstile::verify('', '1.1.1.1'));
+        $this->assertTrue(Turnstile::verify('ok', '1.1.1.1'));
+        $this->assertFalse(Turnstile::verify('reused', '1.1.1.1'));
+        Http::assertSent(fn ($request) => $request['secret'] === 'secret' && $request['response'] === 'ok');
+    }
+
+    public function test_save_keeps_masked_secret_and_rejects_enabling_without_keys(): void
+    {
+        $this->configure(false);
+
+        Turnstile::save(['enabled' => true, 'site_key' => 'new-site', 'secret_key' => Turnstile::SECRET_MASK]);
+        $this->assertSame('secret', SignRSA::DecryptFunc(Turnstile::stored()['secret_key']));
+        $this->assertSame(['enabled' => true, 'site_key' => 'new-site', 'secret_key' => Turnstile::SECRET_MASK], Turnstile::forAdmin());
+
+        $this->expectException(InvalidArgumentException::class);
+        Turnstile::save(['secret_key' => '']);
+    }
+
+    public function test_admin_login_rejects_missing_token_when_enabled(): void
+    {
+        $this->configure(true);
+        Http::fake();
+
+        $this->postJson('/api/v1/administrator/login', ['username' => 'x', 'password' => 'y'])
+            ->assertStatus(422)
+            ->assertJsonPath('error', true);
+        Http::assertNothingSent();
+    }
+}
@@ -0,0 +1,64 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tests\Unit;
+
+use App\Http\Resources\Api\Admin\ProductResource;
+use App\Models\Product;
+use App\Models\ProductPricings;
+use Illuminate\Support\Collection;
+use Tests\TestCase;
+
+class AdminProductResourceTest extends TestCase
+{
+    public function test_it_reads_legacy_pricing_cycle_names_without_returning_null(): void
+    {
+        $product = new Product([
+            'name' => 'Legacy product',
+            'is_active' => true,
+            'setup_fee' => 0,
+        ]);
+        $product->id = 4;
+        $product->setRelation('pricings', new Collection([
+            new ProductPricings([
+                'billing_cycle' => 'semiannually',
+                'price' => 7200000,
+                'currency' => 'VND',
+            ]),
+            new ProductPricings([
+                'billing_cycle' => 'one_time',
+                'price' => 15000000,
+                'currency' => 'VND',
+            ]),
+        ]));
+
+        $data = (new ProductResource($product))->resolve(request());
+
+        $this->assertSame('7200000.00', $data['price_semiannually']);
+        $this->assertSame('15000000.00', $data['price_onetime']);
+        $this->assertSame('recurring', $data['billing_type']);
+    }
+
+    public function test_legacy_one_time_only_product_uses_frontend_billing_value(): void
+    {
+        $product = new Product([
+            'name' => 'One-time product',
+            'is_active' => true,
+            'setup_fee' => 0,
+        ]);
+        $product->id = 5;
+        $product->setRelation('pricings', new Collection([
+            new ProductPricings([
+                'billing_cycle' => 'one_time',
+                'price' => 15000000,
+                'currency' => 'VND',
+            ]),
+        ]));
+
+        $data = (new ProductResource($product))->resolve(request());
+
+        $this->assertSame('onetime', $data['billing_type']);
+        $this->assertSame('15000000.00', $data['price_onetime']);
+    }
+}