Kevin Adametz
c7bd940f28
Konsolidierter Entwicklungsplan aus den zwei Analyse-Dokumenten plus
Umsetzung der Phase-0-Massnahmen (Korrektheit/Security, je mit Tests):
0.1 BasicAuth: timing-sicherer Vergleich (hash_equals, beide Felder ohne
Short-Circuit); Enabled-Check zur Laufzeit via config('auth.basic.*')
statt env() im Bootstrap-Closure (greift jetzt unter config:cache);
Config-Block + .env.example. Fund: auth.basic.* war nie als Config
definiert, Gate war faktisch unkonfigurierbar.
0.2 Legacy-Invoice-"latest"-Abfrage zentralisiert (LegacyInvoice::
scopeLatestFirst + User::latestLegacyInvoice); beide Consumer N+1-frei
umgestellt; unterschiedliches null-Verhalten bewusst erhalten.
0.3 Payment-Option-Eligibility vereinheitlicht (period-aware, strikt):
UserPaymentOption::scopeActiveNow/grandfatheredNow + User::
hasActivePaymentOption; hasActiveBooking/hasUnlimitedPressReleaseQuota
und ApiAccessEligibilityService darauf umgestellt; $hasGrandfathered-
Mislabel behoben.
0.4 Theme->Portal-Vokabular: totes, projektfremdes ThemeMiddleware
geloescht; Mapping in Portal::fromTheme() zentralisiert; fremden
b2in-Default im ThemeServiceProvider auf Portal-Default korrigiert.
0.5 InvoiceNumberGenerator: Erst-Insert race-sicher via insertOrIgnore
(Unique-Index auf circle existiert bereits). CreditWalletService war
bereits abgesichert (Unique-Index + createOrFirst).
Tests: 4 neue Dateien, 5 bestehende auf gueltiges grandfathered_until
angepasst. Volle Suite gruen (793 passed, 1 skipped).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
135 lines
4.6 KiB
PHP
135 lines
4.6 KiB
PHP
<?php
|
|
|
|
use App\Models\User;
|
|
|
|
return [
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| Authentication Defaults
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| This option defines the default authentication "guard" and password
|
|
| reset "broker" for your application. You may change these values
|
|
| as required, but they're a perfect start for most applications.
|
|
|
|
|
*/
|
|
|
|
'defaults' => [
|
|
'guard' => env('AUTH_GUARD', 'web'),
|
|
'passwords' => env('AUTH_PASSWORD_BROKER', 'users'),
|
|
],
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| Authentication Guards
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| Next, you may define every authentication guard for your application.
|
|
| Of course, a great default configuration has been defined for you
|
|
| which utilizes session storage plus the Eloquent user provider.
|
|
|
|
|
| All authentication guards have a user provider, which defines how the
|
|
| users are actually retrieved out of your database or other storage
|
|
| system used by the application. Typically, Eloquent is utilized.
|
|
|
|
|
| Supported: "session"
|
|
|
|
|
*/
|
|
|
|
'guards' => [
|
|
'web' => [
|
|
'driver' => 'session',
|
|
'provider' => 'users',
|
|
],
|
|
],
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| User Providers
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| All authentication guards have a user provider, which defines how the
|
|
| users are actually retrieved out of your database or other storage
|
|
| system used by the application. Typically, Eloquent is utilized.
|
|
|
|
|
| If you have multiple user tables or models you may configure multiple
|
|
| providers to represent the model / table. These providers may then
|
|
| be assigned to any extra authentication guards you have defined.
|
|
|
|
|
| Supported: "database", "eloquent"
|
|
|
|
|
*/
|
|
|
|
'providers' => [
|
|
'users' => [
|
|
'driver' => 'eloquent',
|
|
'model' => env('AUTH_MODEL', User::class),
|
|
],
|
|
|
|
// 'users' => [
|
|
// 'driver' => 'database',
|
|
// 'table' => 'users',
|
|
// ],
|
|
],
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| Resetting Passwords
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| These configuration options specify the behavior of Laravel's password
|
|
| reset functionality, including the table utilized for token storage
|
|
| and the user provider that is invoked to actually retrieve users.
|
|
|
|
|
| The expiry time is the number of minutes that each reset token will be
|
|
| considered valid. This security feature keeps tokens short-lived so
|
|
| they have less time to be guessed. You may change this as needed.
|
|
|
|
|
| The throttle setting is the number of seconds a user must wait before
|
|
| generating more password reset tokens. This prevents the user from
|
|
| quickly generating a very large amount of password reset tokens.
|
|
|
|
|
*/
|
|
|
|
'passwords' => [
|
|
'users' => [
|
|
'provider' => 'users',
|
|
'table' => env('AUTH_PASSWORD_RESET_TOKEN_TABLE', 'password_reset_tokens'),
|
|
'expire' => 60,
|
|
'throttle' => 60,
|
|
],
|
|
],
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| Password Confirmation Timeout
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| Here you may define the amount of seconds before a password confirmation
|
|
| window expires and users are asked to re-enter their password via the
|
|
| confirmation screen. By default, the timeout lasts for three hours.
|
|
|
|
|
*/
|
|
|
|
'password_timeout' => env('AUTH_PASSWORD_TIMEOUT', 10800),
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| HTTP Basic Auth Gate (Staging-Schutz)
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| Optionaler vorgelagerter Basic-Auth-Schutz für die gesamte Web-App
|
|
| (z. B. Staging). Wird nur erzwungen, wenn aktiviert UND Zugangsdaten
|
|
| gesetzt sind. Diese Werte über config() statt env() zu lesen stellt
|
|
| sicher, dass der Schutz auch unter `config:cache` aktiv bleibt.
|
|
|
|
|
*/
|
|
|
|
'basic' => [
|
|
'enabled' => env('BASIC_AUTH_ENABLED', true),
|
|
'user' => env('BASIC_AUTH_USER'),
|
|
'password' => env('BASIC_AUTH_PASSWORD'),
|
|
],
|
|
|
|
];
|