feat: Turnstile captcha, menu khách + nút tắt topbar cấu hình từ admin, ẩn setting nhạy cảm

- Turnstile (App\Support\Turnstile, middleware turnstile) cho login admin và login/register/forgot/reset của khách; cấu hình ở setting key=turnstile, secret mã hoá SignRSA. - Menu sidebar khách (setting client_menu) và nút tắt topbar (setting client_quick_links) do admin sửa qua administrator/client-menu[/quick-links], khách đọc v1/setting/menu, v1/setting/quick-links. - v1/setting và settings/public chỉ trả whitelist PublicSetting::FIELDS (trước đây lộ bot_token, inet_api_key). - Cài đặt tài khoản khách (preferences), rate limit theo IP cho register/resend-verify. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-12 15:53:43 +07:00
parent 823af4a56a
commit e888a6ed5d
33 changed files with 1022 additions and 52 deletions
@@ -205,16 +205,16 @@ class ProductController extends Controller
    {
        $currency = $data['currency'] ?? 'VND';
        $cycles = [
-            'monthly'       => 'price_monthly',
-            'quarterly'     => 'price_quarterly',
-            'semi_annually' => 'price_semiannually',
-            'annually'      => 'price_annually',
-            'biennially'    => 'price_biennially',
-            'triennially'   => 'price_triennially',
-            'onetime'       => 'price_onetime',
+            'monthly'       => ['price_monthly', []],
+            'quarterly'     => ['price_quarterly', []],
+            'semi_annually' => ['price_semiannually', ['semiannually']],
+            'annually'      => ['price_annually', []],
+            'biennially'    => ['price_biennially', []],
+            'triennially'   => ['price_triennially', []],
+            'onetime'       => ['price_onetime', ['one_time']],
        ];

-        foreach ($cycles as $cycle => $field) {
+        foreach ($cycles as $cycle => [$field, $legacyCycles]) {
            if (!array_key_exists($field, $data)) {
                continue;
            }
@@ -226,9 +226,12 @@ class ProductController extends Controller
                    ['product_id' => $product->id, 'billing_cycle' => $cycle],
                    ['price' => $price, 'currency' => $currency, 'is_active' => true]
                );
+                ProductPricings::where('product_id', $product->id)
+                    ->whereIn('billing_cycle', $legacyCycles)
+                    ->delete();
            } else {
                ProductPricings::where('product_id', $product->id)
-                    ->where('billing_cycle', $cycle)
+                    ->whereIn('billing_cycle', [$cycle, ...$legacyCycles])
                    ->delete();
            }
        }
@@ -0,0 +1,46 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Controllers\Api\Admin\Setting;
+
+use App\Http\Controllers\Controller;
+use App\Support\ClientMenu;
+use App\Support\ClientQuickLinks;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+
+class ClientMenuController extends Controller
+{
+    public function show(): JsonResponse
+    {
+        return response()->json(['error' => false, 'data' => ClientMenu::items()]);
+    }
+
+    public function update(Request $request): JsonResponse
+    {
+        $validated = $request->validate(ClientMenu::rules());
+
+        return response()->json([
+            'error'   => false,
+            'message' => 'Đã lưu menu.',
+            'data'    => ClientMenu::save($validated['items']),
+        ]);
+    }
+
+    public function showQuickLinks(): JsonResponse
+    {
+        return response()->json(['error' => false, 'data' => ClientQuickLinks::items()]);
+    }
+
+    public function updateQuickLinks(Request $request): JsonResponse
+    {
+        $validated = $request->validate(ClientQuickLinks::rules());
+
+        return response()->json([
+            'error'   => false,
+            'message' => 'Đã lưu nút tắt.',
+            'data'    => ClientQuickLinks::save($validated['items']),
+        ]);
+    }
+}
@@ -9,6 +9,8 @@ use App\Http\Facade\SignRSA;
 use App\Http\Services\Telegram;
 use App\Models\Setting;
 use App\Support\Cache\CacheKey;
+use App\Support\PublicSetting;
+use App\Support\Turnstile;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Cache;
@@ -39,6 +41,7 @@ class SettingController extends Controller
            'data'  => [
                'setting' => $settingValue,
                'smtp'    => $smtpValue,
+                'turnstile' => Turnstile::forAdmin(),
            ],
        ]);
    }
@@ -49,18 +52,9 @@ class SettingController extends Controller
     */
    public function public(): JsonResponse
    {
-        $setting = Setting::where('key', 'setting')->first();
-        $value   = $setting ? json_decode((string) $setting->value, true) : [];
-
        return response()->json([
            'error' => false,
-            'data'  => [
-                'title'       => $value['title'] ?? '',
-                'company'     => $value['company'] ?? '',
-                'logo'        => $value['logo'] ?? '',
-                'favi_icon'   => $value['favi_icon'] ?? '',
-                'brand_color' => $value['brand_color'] ?? '',
-            ],
+            'data'  => PublicSetting::values() + ['turnstile_site_key' => Turnstile::siteKey()],
        ]);
    }

@@ -80,6 +74,10 @@ class SettingController extends Controller
            'smtp.encryption'       => 'sometimes|in:ssl,tls,starttls,',
            'smtp.from_name'        => 'sometimes|string|nullable',
            'smtp.from_address'     => 'sometimes|email|nullable',
+            'turnstile'             => 'sometimes|array',
+            'turnstile.enabled'     => 'sometimes|boolean',
+            'turnstile.site_key'    => 'sometimes|string|nullable|max:255',
+            'turnstile.secret_key'  => 'sometimes|string|nullable|max:255',
        ]);

        if ($validator->fails()) {
@@ -120,6 +118,14 @@ class SettingController extends Controller
            Cache::forget(CacheKey::build('settings', 'mail'));
        }

+        if ($request->has('turnstile')) {
+            try {
+                Turnstile::save($request->input('turnstile'));
+            } catch (\InvalidArgumentException $e) {
+                return response()->json(['error' => true, 'message' => $e->getMessage()], 422);
+            }
+        }
+
        return response()->json([
            'error'   => false,
            'message' => 'Cập nhật cài đặt thành công.',
@@ -9,6 +9,7 @@ use App\Services\Api\Client\ClientAuthService;

 use App\Http\Controllers\Api\Client\Concerns\HandlesClientAuthentication;
 use App\Http\Controllers\Api\Client\Concerns\HandlesClientPasswordReset;
+use App\Http\Controllers\Api\Client\Concerns\ManagesClientAccountSettings;
 use App\Http\Controllers\Api\Client\Concerns\ManagesClientProfile;
 /**
 * @OA\Tag(
@@ -20,6 +21,7 @@ class ClientController extends Controller
 {
    use HandlesClientAuthentication;
    use HandlesClientPasswordReset;
+    use ManagesClientAccountSettings;
    use ManagesClientProfile;

    protected $authService;
@@ -0,0 +1,72 @@
+<?php
+
+namespace App\Http\Controllers\Api\Client\Concerns;
+
+use App\Http\Requests\Api\Client\ClientPreferencesRequest;
+use App\Http\Resources\Api\Client\ClientResource;
+use App\Models\ActivityLog;
+use Illuminate\Http\Request;
+
+trait ManagesClientAccountSettings
+{
+    public function loginHistory(Request $request)
+    {
+        $validated = $request->validate([
+            'page' => ['sometimes', 'integer', 'min:1'],
+            'per_page' => ['sometimes', 'integer', 'in:10,20,50'],
+        ]);
+        $customer = auth('client')->user();
+
+        $history = ActivityLog::query()
+            ->where('log_name', 'auth')
+            ->where('causer_type', 'customer')
+            ->where('causer_id', $customer->id)
+            ->whereIn('event', ['login', 'logout'])
+            ->latest('created_at')
+            ->paginate($validated['per_page'] ?? 10);
+
+        return response()->json([
+            'error' => false,
+            'data' => collect($history->items())->map(fn (ActivityLog $log) => [
+                'id' => $log->id,
+                'event' => $log->event,
+                'ip_address' => $log->ip_address,
+                'user_agent' => $log->user_agent,
+                'created_at' => $log->created_at?->toIso8601String(),
+            ])->values(),
+            'meta' => [
+                'current_page' => $history->currentPage(),
+                'per_page' => $history->perPage(),
+                'total' => $history->total(),
+                'last_page' => $history->lastPage(),
+            ],
+        ]);
+    }
+
+    public function updatePreferences(ClientPreferencesRequest $request)
+    {
+        $customer = auth('client')->user();
+        $oldValues = $customer->only(['email_marketing', 'receive_deposit']);
+
+        $customer->fill($request->validated());
+        $dirty = $customer->getDirty();
+        $customer->save();
+
+        if ($dirty !== []) {
+            $this->activityLogger->log(
+                event: 'preferences_update',
+                logName: 'Customer',
+                description: "Customer {$customer->email} cập nhật tuỳ chọn tài khoản",
+                subject: $customer,
+                oldValues: array_intersect_key($oldValues, $dirty),
+                newValues: $dirty,
+            );
+        }
+
+        return response()->json([
+            'error' => false,
+            'message' => 'Đã lưu cài đặt tài khoản.',
+            'data' => ['client' => new ClientResource($customer->fresh())],
+        ]);
+    }
+}
@@ -4,6 +4,10 @@ namespace App\Http\Controllers\Api\Setting;

 use App\Http\Controllers\Controller;
 use App\Models\Setting;
+use App\Support\ClientMenu;
+use App\Support\ClientQuickLinks;
+use App\Support\PublicSetting;
+use App\Support\Turnstile;

 /**
 * @OA\Tag(
@@ -19,7 +23,7 @@ class SettingController extends Controller
     *     operationId="getSetting",
     *     tags={"Settings"},
     *     summary="Get application settings",
-     *     description="Returns the application settings",
+     *     description="Returns the public application settings (title, company, logo, favi_icon, brand_color)",
     *     @OA\Response(
     *         response=200,
     *         description="Successful operation",
@@ -31,11 +35,10 @@ class SettingController extends Controller
     *     )
     * )
     */
-    public function getSetting()
+    public function getSetting(): \Illuminate\Http\JsonResponse
    {
-        $setting = Setting::where('key', 'setting')->first();
        return response()->json([
-            'data' => $setting->value,
+            'data' => PublicSetting::values(),
            'message' => 'Get setting successfully',
            'error' => false
        ]);
@@ -53,4 +56,28 @@ class SettingController extends Controller
            ],
        ]);
    }
-}
+
+    public function getTurnstileSetting(): \Illuminate\Http\JsonResponse
+    {
+        return response()->json([
+            'error' => false,
+            'data'  => ['site_key' => Turnstile::siteKey()],
+        ]);
+    }
+
+    public function getMenu(): \Illuminate\Http\JsonResponse
+    {
+        return response()->json([
+            'error' => false,
+            'data'  => ClientMenu::items(),
+        ]);
+    }
+
+    public function getQuickLinks(): \Illuminate\Http\JsonResponse
+    {
+        return response()->json([
+            'error' => false,
+            'data'  => ClientQuickLinks::items(),
+        ]);
+    }
+}