bao/portal-api
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: Turnstile captcha, menu khách + nút tắt topbar cấu hình từ admin, ẩn setting nhạy cảm

Browse Source 
- Turnstile (App\Support\Turnstile, middleware turnstile) cho login admin và login/register/forgot/reset của khách; cấu hình ở setting key=turnstile, secret mã hoá SignRSA.
- Menu sidebar khách (setting client_menu) và nút tắt topbar (setting client_quick_links) do admin sửa qua administrator/client-menu[/quick-links], khách đọc v1/setting/menu, v1/setting/quick-links.
- v1/setting và settings/public chỉ trả whitelist PublicSetting::FIELDS (trước đây lộ bot_token, inet_api_key).
- Cài đặt tài khoản khách (preferences), rate limit theo IP cho register/resend-verify.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
baodev0
2026-10-12 15:53:43 +07:00
co-authored by Claude Opus 5.5
parent 823af4a56a
commit e888a6ed5d
33 changed files with 1022 additions and 52 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/Http/Controllers/Api/Admin/Product/ProductController.php
+12 -9
View File
@@ -205,16 +205,16 @@ class ProductController extends Controller
{
$currency = $data['currency'] ?? 'VND';
$cycles = [
'monthly' => 'price_monthly',
'quarterly' => 'price_quarterly',
'semi_annually' => 'price_semiannually',
'annually' => 'price_annually',
'biennially' => 'price_biennially',
'triennially' => 'price_triennially',
'onetime' => 'price_onetime',
'monthly' => ['price_monthly', []],
'quarterly' => ['price_quarterly', []],
'semi_annually' => ['price_semiannually', ['semiannually']],
'annually' => ['price_annually', []],
'biennially' => ['price_biennially', []],
'triennially' => ['price_triennially', []],
'onetime' => ['price_onetime', ['one_time']],
];
foreach ($cycles as $cycle => $field) {
foreach ($cycles as $cycle => [$field, $legacyCycles]) {
if (!array_key_exists($field, $data)) {
continue;
}
@@ -226,9 +226,12 @@ class ProductController extends Controller
['product_id' => $product->id, 'billing_cycle' => $cycle],
['price' => $price, 'currency' => $currency, 'is_active' => true]
);
ProductPricings::where('product_id', $product->id)
->whereIn('billing_cycle', $legacyCycles)
->delete();
} else {
ProductPricings::where('product_id', $product->id)
->where('billing_cycle', $cycle)
->whereIn('billing_cycle', [$cycle, ...$legacyCycles])
->delete();
}
}
app/Http/Controllers/Api/Admin/Setting/ClientMenuController.php
+46
View File
@@ -0,0 +1,46 @@
<?php
declare(strict_types=1);
namespace App\Http\Controllers\Api\Admin\Setting;
use App\Http\Controllers\Controller;
use App\Support\ClientMenu;
use App\Support\ClientQuickLinks;
use Illuminate\Http\JsonResponse;
use Illuminate\Http\Request;
class ClientMenuController extends Controller
{
public function show(): JsonResponse
{
return response()->json(['error' => false, 'data' => ClientMenu::items()]);
}
public function update(Request $request): JsonResponse
{
$validated = $request->validate(ClientMenu::rules());
return response()->json([
'error' => false,
'message' => 'Đã lưu menu.',
'data' => ClientMenu::save($validated['items']),
]);
}
public function showQuickLinks(): JsonResponse
{
return response()->json(['error' => false, 'data' => ClientQuickLinks::items()]);
}
public function updateQuickLinks(Request $request): JsonResponse
{
$validated = $request->validate(ClientQuickLinks::rules());
return response()->json([
'error' => false,
'message' => 'Đã lưu nút tắt.',
'data' => ClientQuickLinks::save($validated['items']),
]);
}
}
app/Http/Controllers/Api/Admin/Setting/SettingController.php
+16 -10
View File
@@ -9,6 +9,8 @@ use App\Http\Facade\SignRSA;
use App\Http\Services\Telegram;
use App\Models\Setting;
use App\Support\Cache\CacheKey;
use App\Support\PublicSetting;
use App\Support\Turnstile;
use Illuminate\Http\JsonResponse;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Cache;
@@ -39,6 +41,7 @@ class SettingController extends Controller
'data' => [
'setting' => $settingValue,
'smtp' => $smtpValue,
'turnstile' => Turnstile::forAdmin(),
],
]);
}
@@ -49,18 +52,9 @@ class SettingController extends Controller
*/
public function public(): JsonResponse
{
$setting = Setting::where('key', 'setting')->first();
$value = $setting ? json_decode((string) $setting->value, true) : [];
return response()->json([
'error' => false,
'data' => [
'title' => $value['title'] ?? '',
'company' => $value['company'] ?? '',
'logo' => $value['logo'] ?? '',
'favi_icon' => $value['favi_icon'] ?? '',
'brand_color' => $value['brand_color'] ?? '',
],
'data' => PublicSetting::values() + ['turnstile_site_key' => Turnstile::siteKey()],
]);
}
@@ -80,6 +74,10 @@ class SettingController extends Controller
'smtp.encryption' => 'sometimes|in:ssl,tls,starttls,',
'smtp.from_name' => 'sometimes|string|nullable',
'smtp.from_address' => 'sometimes|email|nullable',
'turnstile' => 'sometimes|array',
'turnstile.enabled' => 'sometimes|boolean',
'turnstile.site_key' => 'sometimes|string|nullable|max:255',
'turnstile.secret_key' => 'sometimes|string|nullable|max:255',
]);
if ($validator->fails()) {
@@ -120,6 +118,14 @@ class SettingController extends Controller
Cache::forget(CacheKey::build('settings', 'mail'));
}
if ($request->has('turnstile')) {
try {
Turnstile::save($request->input('turnstile'));
} catch (\InvalidArgumentException $e) {
return response()->json(['error' => true, 'message' => $e->getMessage()], 422);
}
}
return response()->json([
'error' => false,
'message' => 'Cập nhật cài đặt thành công.',
app/Http/Controllers/Api/Client/ClientController.php
+2
View File
@@ -9,6 +9,7 @@ use App\Services\Api\Client\ClientAuthService;
use App\Http\Controllers\Api\Client\Concerns\HandlesClientAuthentication;
use App\Http\Controllers\Api\Client\Concerns\HandlesClientPasswordReset;
use App\Http\Controllers\Api\Client\Concerns\ManagesClientAccountSettings;
use App\Http\Controllers\Api\Client\Concerns\ManagesClientProfile;
/**
* @OA\Tag(
@@ -20,6 +21,7 @@ class ClientController extends Controller
{
use HandlesClientAuthentication;
use HandlesClientPasswordReset;
use ManagesClientAccountSettings;
use ManagesClientProfile;
protected $authService;
app/Http/Controllers/Api/Client/Concerns/ManagesClientAccountSettings.php
+72
View File
@@ -0,0 +1,72 @@
<?php
namespace App\Http\Controllers\Api\Client\Concerns;
use App\Http\Requests\Api\Client\ClientPreferencesRequest;
use App\Http\Resources\Api\Client\ClientResource;
use App\Models\ActivityLog;
use Illuminate\Http\Request;
trait ManagesClientAccountSettings
{
public function loginHistory(Request $request)
{
$validated = $request->validate([
'page' => ['sometimes', 'integer', 'min:1'],
'per_page' => ['sometimes', 'integer', 'in:10,20,50'],
]);
$customer = auth('client')->user();
$history = ActivityLog::query()
->where('log_name', 'auth')
->where('causer_type', 'customer')
->where('causer_id', $customer->id)
->whereIn('event', ['login', 'logout'])
->latest('created_at')
->paginate($validated['per_page'] ?? 10);
return response()->json([
'error' => false,
'data' => collect($history->items())->map(fn (ActivityLog $log) => [
'id' => $log->id,
'event' => $log->event,
'ip_address' => $log->ip_address,
'user_agent' => $log->user_agent,
'created_at' => $log->created_at?->toIso8601String(),
])->values(),
'meta' => [
'current_page' => $history->currentPage(),
'per_page' => $history->perPage(),
'total' => $history->total(),
'last_page' => $history->lastPage(),
],
]);
}
public function updatePreferences(ClientPreferencesRequest $request)
{
$customer = auth('client')->user();
$oldValues = $customer->only(['email_marketing', 'receive_deposit']);
$customer->fill($request->validated());
$dirty = $customer->getDirty();
$customer->save();
if ($dirty !== []) {
$this->activityLogger->log(
event: 'preferences_update',
logName: 'Customer',
description: "Customer {$customer->email} cập nhật tuỳ chọn tài khoản",
subject: $customer,
oldValues: array_intersect_key($oldValues, $dirty),
newValues: $dirty,
);
}
return response()->json([
'error' => false,
'message' => 'Đã lưu cài đặt tài khoản.',
'data' => ['client' => new ClientResource($customer->fresh())],
]);
}
}
app/Http/Controllers/Api/Setting/SettingController.php
+32 -5
View File
@@ -4,6 +4,10 @@ namespace App\Http\Controllers\Api\Setting;
use App\Http\Controllers\Controller;
use App\Models\Setting;
use App\Support\ClientMenu;
use App\Support\ClientQuickLinks;
use App\Support\PublicSetting;
use App\Support\Turnstile;
/**
* @OA\Tag(
@@ -19,7 +23,7 @@ class SettingController extends Controller
* operationId="getSetting",
* tags={"Settings"},
* summary="Get application settings",
* description="Returns the application settings",
* description="Returns the public application settings (title, company, logo, favi_icon, brand_color)",
* @OA\Response(
* response=200,
* description="Successful operation",
@@ -31,11 +35,10 @@ class SettingController extends Controller
* )
* )
*/
public function getSetting()
public function getSetting(): \Illuminate\Http\JsonResponse
{
$setting = Setting::where('key', 'setting')->first();
return response()->json([
'data' => $setting->value,
'data' => PublicSetting::values(),
'message' => 'Get setting successfully',
'error' => false
]);
@@ -53,4 +56,28 @@ class SettingController extends Controller
],
]);
}
}
public function getTurnstileSetting(): \Illuminate\Http\JsonResponse
{
return response()->json([
'error' => false,
'data' => ['site_key' => Turnstile::siteKey()],
]);
}
public function getMenu(): \Illuminate\Http\JsonResponse
{
return response()->json([
'error' => false,
'data' => ClientMenu::items(),
]);
}
public function getQuickLinks(): \Illuminate\Http\JsonResponse
{
return response()->json([
'error' => false,
'data' => ClientQuickLinks::items(),
]);
}
}
app/Http/Kernel.php
+1
View File
@@ -87,5 +87,6 @@ class Kernel extends HttpKernel
'client.access-token' => \App\Http\Middleware\ClientAccessTokenCheck::class,
'perm' => \App\Http\Middleware\CheckPermission::class,
'restrict.local' => \App\Http\Middleware\RestrictToLocalEnvironment::class,
'turnstile' => \App\Http\Middleware\VerifyTurnstile::class,
];
}
app/Http/Middleware/VerifyTurnstile.php
+25
View File
@@ -0,0 +1,25 @@
<?php
declare(strict_types=1);
namespace App\Http\Middleware;
use App\Support\Turnstile;
use Closure;
use Illuminate\Http\Request;
use Symfony\Component\HttpFoundation\Response;
class VerifyTurnstile
{
public function handle(Request $request, Closure $next): Response
{
if (!Turnstile::verify($request->input(Turnstile::TOKEN_FIELD), $request->ip())) {
return response()->json([
'error' => true,
'message' => 'Xác minh bảo mật (captcha) không hợp lệ hoặc đã hết hạn. Vui lòng thử lại.',
], 422);
}
return $next($request);
}
}
app/Http/Requests/Api/Client/ClientPreferencesRequest.php
+21
View File
@@ -0,0 +1,21 @@
<?php
namespace App\Http\Requests\Api\Client;
use Illuminate\Foundation\Http\FormRequest;
class ClientPreferencesRequest extends FormRequest
{
public function authorize(): bool
{
return auth('client')->check();
}
public function rules(): array
{
return [
'email_marketing' => ['required', 'boolean'],
'receive_deposit' => ['required', 'boolean'],
];
}
}
app/Http/Requests/Api/Client/ClientRegisterRequest.php
+1 -2
View File
@@ -27,7 +27,7 @@ class ClientRegisterRequest extends FormRequest
'max:255'
],
'phone' => [
'required',
'nullable',
'digits:10',
'unique:customers,phone'
],
@@ -59,7 +59,6 @@ class ClientRegisterRequest extends FormRequest
{
return [
'fullname.required' => 'Tên là bắt buộc',
'phone.required' => 'Số điện thoại là bắt buộc',
'phone.digits' => 'Số điện thoại phải có 10 chữ số',
'phone.unique' => 'Số điện thoại đã tồn tại',
'email.required' => 'Email là bắt buộc',
app/Http/Resources/Api/Admin/ProductResource.php
+6 -8
View File
@@ -40,21 +40,19 @@ class ProductResource extends JsonResource
'setup_fee' => $this->setup_fee,
'min_price' => $minPrice,
'billing_type' => $this->whenLoaded('pricings', function () {
// 'one_time' (with underscore) is the convention used everywhere else in the
// app (OrderHelper::cycleToMonths, ServiceExpiry, renewService, product_pricings
// migration comment) — this used to check 'onetime' and never matched real rows.
$hasOnetime = $this->pricings->where('billing_cycle', 'one_time')->isNotEmpty();
$hasRecurring = $this->pricings->where('billing_cycle', '!=', 'one_time')->isNotEmpty();
return ($hasOnetime && !$hasRecurring) ? 'one_time' : 'recurring';
$oneTimeCycles = ['onetime', 'one_time'];
$hasOnetime = $this->pricings->whereIn('billing_cycle', $oneTimeCycles)->isNotEmpty();
$hasRecurring = $this->pricings->whereNotIn('billing_cycle', $oneTimeCycles)->isNotEmpty();
return ($hasOnetime && !$hasRecurring) ? 'onetime' : 'recurring';
}),
'currency' => $this->whenLoaded('pricings', fn () => $this->pricings->first()?->currency ?? 'VND'),
'price_monthly' => $this->whenLoaded('pricings', fn () => optional($this->pricings->firstWhere('billing_cycle', 'monthly'))->price),
'price_quarterly' => $this->whenLoaded('pricings', fn () => optional($this->pricings->firstWhere('billing_cycle', 'quarterly'))->price),
'price_semiannually' => $this->whenLoaded('pricings', fn () => optional($this->pricings->firstWhere('billing_cycle', 'semi_annually'))->price),
'price_semiannually' => $this->whenLoaded('pricings', fn () => optional($this->pricings->first(fn ($pricing) => in_array($pricing->billing_cycle, ['semi_annually', 'semiannually'], true)))->price),
'price_annually' => $this->whenLoaded('pricings', fn () => optional($this->pricings->firstWhere('billing_cycle', 'annually'))->price),
'price_biennially' => $this->whenLoaded('pricings', fn () => optional($this->pricings->firstWhere('billing_cycle', 'biennially'))->price),
'price_triennially' => $this->whenLoaded('pricings', fn () => optional($this->pricings->firstWhere('billing_cycle', 'triennially'))->price),
'price_onetime' => $this->whenLoaded('pricings', fn () => optional($this->pricings->firstWhere('billing_cycle', 'one_time'))->price),
'price_onetime' => $this->whenLoaded('pricings', fn () => optional($this->pricings->first(fn ($pricing) => in_array($pricing->billing_cycle, ['onetime', 'one_time'], true)))->price),
'is_active' => $this->is_active,
'created_at' => $this->created_at,
'os_ids' => $osIds,
app/Http/Resources/Api/Client/ClientResource.php
+2
View File
@@ -40,6 +40,8 @@ class ClientResource extends JsonResource
'fb_link' => null,
'active_2fa' => 0,
'off_mail_marketing' => $this->off_mail_marketing,
'email_marketing' => (bool) $this->email_marketing,
'receive_deposit' => (bool) $this->receive_deposit,
'is_recharge_zalo' => 0,
'is_verify_telegram' => 0,
],