0 Releases 109 Tags

• tested-20260726-1819-5c2e481 5c2e481985

  Compare

  fix(security): console and account checks now survive a Livewire action

  -235 commits to feat/bootstrap since this tag

  Livewire re-applies only the middleware on its persistent list when an action
  posts to /livewire/update. Its defaults cover auth; ours were not on the list —
  only RestrictAdminHost had been added. So EnsureAdmin and EnsureCustomerActive
  guarded the PAGE and not the actions, and the page is not where the actions run:
  a signed-in non-operator who could reach the admin host could drive console
  components, and a suspended customer could keep driving the portal.

  Found by Codex while reviewing the domain-separation design, and confirmed
  against Livewire's own default list in vendor.

  Co-Authored-By: Claude Opus 5 noreply@anthropic.com

  Downloads

  • Source Code (ZIP)
  • Source Code (TAR.GZ)