nexxo 5c2e481985 fix(security): console and account checks now survive a Livewire action ... Livewire re-applies only the middleware on its persistent list when an action posts to /livewire/update. Its defaults cover auth; ours were not on the list — only RestrictAdminHost had been added. So EnsureAdmin and EnsureCustomerActive guarded the PAGE and not the actions, and the page is not where the actions run: a signed-in non-operator who could reach the admin host could drive console components, and a suspended customer could keep driving the portal. Found by Codex while reviewing the domain-separation design, and confirmed against Livewire's own default list in vendor. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>		2026-07-26 20:04:34 +02:00
..
Admin	fix(security): console and account checks now survive a Livewire action	2026-07-26 20:04:34 +02:00
Auth	fix(auth): throttle Fortify endpoints (registration had no limiter — signup-spam guard)	2026-07-25 18:38:44 +02:00
Billing	fix(billing): hold only what cannot be matched, and let migrations roll back	2026-07-26 13:57:11 +02:00
Provisioning	feat(billing): Stripe owns the billing cycle, we own capability	2026-07-26 13:36:28 +02:00
BillingTest.php	feat(portal): billing page — current plan, upgrades, extra storage, add-ons	2026-07-25 13:36:52 +02:00
CartTest.php	fix(billing): normalise both sides of the VAT comparison; cast the timestamp	2026-07-26 09:36:07 +02:00
ComponentTest.php	feat(portal): Fortify auth + Login/2FA/Dashboard + component kit	2026-07-25 01:20:25 +02:00
DashboardTest.php	feat(portal): Fortify auth + Login/2FA/Dashboard + component kit	2026-07-25 01:20:25 +02:00
ExampleTest.php	chore: bootstrap CluPilot control-plane (Laravel 13, Docker stack)	2026-07-25 00:21:30 +02:00
ImpersonationTest.php	fix(admin): harden impersonation + datacenter code per Codex review	2026-07-25 13:50:16 +02:00
OperatorInPortalTest.php	fix(portal): no silent no-ops without a customer; maintenance visible per instance; maintenance form redesign	2026-07-25 19:10:44 +02:00
PortalTabsTest.php	feat(billing): the plan catalogue becomes three tables, and config stops selling	2026-07-26 12:05:56 +02:00
PublicSiteGateTest.php	fix(traffic): release the throttle at month end; close the Livewire bypass	2026-07-25 23:36:38 +02:00
ReleaseVersionTest.php	feat(deploy): releases you can pin to, and a version that tells the truth	2026-07-26 15:21:38 +02:00
SeatsTest.php	feat(portal): seats management — invite/role/revoke against plan limit	2026-07-25 14:40:18 +02:00
SettingsTest.php	fix(portal): enforce customer lifecycle per Codex review	2026-07-25 14:45:03 +02:00
TrafficTest.php	feat(billing): the plan catalogue becomes three tables, and config stops selling	2026-07-26 12:05:56 +02:00
WelcomeTest.php	feat(landing): public marketing homepage at / (+ legal placeholders)	2026-07-25 08:59:39 +02:00