nexxo 5c2e481985 fix(security): console and account checks now survive a Livewire action ... Livewire re-applies only the middleware on its persistent list when an action posts to /livewire/update. Its defaults cover auth; ours were not on the list — only RestrictAdminHost had been added. So EnsureAdmin and EnsureCustomerActive guarded the PAGE and not the actions, and the page is not where the actions run: a signed-in non-operator who could reach the admin host could drive console components, and a suspended customer could keep driving the portal. Found by Codex while reviewing the domain-separation design, and confirmed against Livewire's own default list in vendor. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>		2026-07-26 20:04:34 +02:00
..
Actions	fix(billing): hold only what cannot be matched, and let migrations roll back	2026-07-26 13:57:11 +02:00
Console	feat(billing): Stripe owns the billing cycle, we own capability	2026-07-26 13:36:28 +02:00
Http	docs: hiding the site also hides the login page, and that has a consequence	2026-07-26 19:27:51 +02:00
Livewire	feat(billing): a proof register, and modules frozen at their booked price	2026-07-26 13:07:34 +02:00
Mail	fix(admin): confirm maintenance delivery via MessageSent (retryable until sent); guard resend/cancel on derived state; fix flaky non-unique host wg_ip	2026-07-25 16:14:01 +02:00
Models	feat(billing): Stripe owns the billing cycle, we own capability	2026-07-26 13:36:28 +02:00
Notifications	fix(engine-b): default-deny firewall, disk-based capacity, synchronous credential mail	2026-07-25 12:39:15 +02:00
Policies	fix(vpn): losing the operator roles closes the owner doors by itself	2026-07-25 22:50:13 +02:00
Providers	fix(security): console and account checks now survive a Livewire action	2026-07-26 20:04:34 +02:00
Provisioning	fix(billing): a paid order opens a contract, and provisioning obeys it	2026-07-26 11:10:00 +02:00
Services	feat(deploy): releases you can pin to, and a version that tells the truth	2026-07-26 15:21:38 +02:00
Support	feat(traffic): meter the monthly allowance, show it, throttle instead of blocking	2026-07-25 23:33:47 +02:00