Kevin Adametz
e77d9e7d09
Bisher blieb ein einmal erstellter Token gültig, auch wenn Abo bzw. Buchung längst beendet waren. EnsureApiAccessIsBooked prüft jetzt bei jeder Anfrage (v1 und /service/…-Altpfade), ob das Konto API-Zugang hat (ApiAccessEligibilityService::hasApiAccess), sonst 403. Die Tokens bleiben erhalten und funktionieren nach erneuter Buchung wieder. Kunden können beim Erstellen optional ein Ablaufdatum setzen (bis 5 Jahre); die Token-Liste zeigt „Gültig bis“ und einen Hinweis, wenn der Zugang pausiert ist. sanctum:prune-expired räumt abgelaufene Tokens nach 30 Tagen täglich ab. API-Doku (public/api/v1.yml) ergänzt. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
38 lines
2.4 KiB
PHP
38 lines
2.4 KiB
PHP
<?php
|
|
|
|
use App\Http\Controllers\Api\V1\CategoryController;
|
|
use App\Http\Controllers\Api\V1\CompanyController;
|
|
use App\Http\Controllers\Api\V1\LegalAcceptanceController;
|
|
use App\Http\Controllers\Api\V1\NewsletterSubscriptionController;
|
|
use App\Http\Controllers\Api\V1\PressReleaseController;
|
|
use App\Http\Controllers\Api\V1\PressReleaseImageController;
|
|
use App\Http\Middleware\EnsureApiAccessIsBooked;
|
|
use App\Http\Middleware\EnsureApiTokenRateLimit;
|
|
use App\Http\Middleware\EnsureApiUserIsActive;
|
|
use Illuminate\Support\Facades\Route;
|
|
|
|
Route::prefix('v1')
|
|
->middleware(['auth:sanctum', EnsureApiUserIsActive::class, EnsureApiAccessIsBooked::class, EnsureApiTokenRateLimit::class])
|
|
// Controller erwarten int-IDs — nicht-numerische Werte (z. B. vergessene
|
|
// Platzhalter wie „PM_ID") sollen 404 statt TypeError/500 ergeben.
|
|
->where(['pressRelease' => '[0-9]+', 'pressReleaseImage' => '[0-9]+', 'company' => '[0-9]+'])
|
|
->group(function (): void {
|
|
Route::apiResource('press-releases', PressReleaseController::class)
|
|
->parameters(['press-releases' => 'pressRelease']);
|
|
Route::post('press-releases/{pressRelease}/submit', [PressReleaseController::class, 'submit'])
|
|
->name('press-releases.submit');
|
|
Route::get('press-releases/{pressRelease}/images', [PressReleaseImageController::class, 'index'])
|
|
->name('press-releases.images.index');
|
|
Route::post('press-releases/{pressRelease}/images', [PressReleaseImageController::class, 'store'])
|
|
->name('press-releases.images.store');
|
|
Route::delete('press-release-images/{pressReleaseImage}', [PressReleaseImageController::class, 'destroy'])
|
|
->name('press-release-images.destroy');
|
|
Route::apiResource('companies', CompanyController::class)->only(['index', 'show']);
|
|
Route::get('categories', [CategoryController::class, 'index'])->name('categories.index');
|
|
Route::post('newsletter/subscribe', [NewsletterSubscriptionController::class, 'store'])
|
|
->name('newsletter.subscribe');
|
|
// Zustimmungsgate (Bildkennzeichnung Block G, O2): Annahme je
|
|
// Kontoinhaber und Dokumentversion; submit antwortet sonst 428.
|
|
Route::get('legal/acceptances', [LegalAcceptanceController::class, 'index'])->name('legal.acceptances.index');
|
|
Route::post('legal/acceptances', [LegalAcceptanceController::class, 'store'])->name('legal.acceptances.store');
|
|
});
|