nexxo 5d64da1cb3 docs: hiding the site also hides the login page, and that has a consequence ... The gate exempts admin/* so the console keeps working, but /admin sends a guest to /login and /login is not the console — so with the site hidden and no VPN yet, an operator cannot sign in to flip the switch back. Found while bringing up the live server. The mechanism for it already exists and is the right one: TRUSTED_RANGES. What does NOT work is exempting the login flow by hostname, which was the obvious patch — a Host header is chosen by the caller, so one forged header would have lifted the gate for every route, portal included. Codex caught that; the comment now says why the narrow-looking option is the wrong one. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>		2026-07-26 19:27:51 +02:00
..
EnsureAdmin.php	fix(admin): remove is_admin self-heal — RBAC is the only console boundary (no revocation bypass)	2026-07-25 18:35:14 +02:00
EnsureCustomerActive.php	feat(admin): staff RBAC (spatie) + admin settings page	2026-07-25 15:47:42 +02:00
PublicSiteGate.php	docs: hiding the site also hides the login page, and that has a consequence	2026-07-26 19:27:51 +02:00
RestrictAdminHost.php	fix(security): match ADMIN_HOSTS case-insensitively; share test helpers	2026-07-25 20:56:26 +02:00