nexxo 5c2e481985 fix(security): console and account checks now survive a Livewire action ... Livewire re-applies only the middleware on its persistent list when an action posts to /livewire/update. Its defaults cover auth; ours were not on the list — only RestrictAdminHost had been added. So EnsureAdmin and EnsureCustomerActive guarded the PAGE and not the actions, and the page is not where the actions run: a signed-in non-operator who could reach the admin host could drive console components, and a suspended customer could keep driving the portal. Found by Codex while reviewing the domain-separation design, and confirmed against Livewire's own default list in vendor. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>		2026-07-26 20:04:34 +02:00
..
AdminConsoleTest.php	feat(admin): dark Tactical-Terminal operator console	2026-07-25 08:35:03 +02:00
AdminHostRestrictionTest.php	fix(security): match ADMIN_HOSTS case-insensitively; share test helpers	2026-07-25 20:56:26 +02:00
AdminSettingsTest.php	fix(admin): shown-once temp password for invited staff; suppress announcements for cancelled windows at send time	2026-07-25 16:23:21 +02:00
CustomerRevenueTest.php	feat(billing): the plan catalogue becomes three tables, and config stops selling	2026-07-26 12:05:56 +02:00
DatacenterTest.php	fix(admin): no admin lockout (is_admin fallback); centered modal width; datacenter edit modal + country dropdown	2026-07-25 18:09:17 +02:00
HostManagementTest.php	fix(security): match ADMIN_HOSTS case-insensitively; share test helpers	2026-07-25 20:56:26 +02:00
InstanceAdminAccessTest.php	fix(admin): the admin password is shown once, and means it	2026-07-26 05:34:57 +02:00
MaintenanceTest.php	fix(maintenance): make the window form usable	2026-07-25 23:05:33 +02:00
PlanAdminTest.php	feat(admin): a console for creating, pricing and scheduling plans	2026-07-26 12:41:51 +02:00
ProvisioningActionsTest.php	fix(ui): modal above sidebar (z-index); datacenter edit buttons stay right; toast slides from bottom; provisioning retry action	2026-07-25 15:29:37 +02:00
RbacTest.php	fix(security): console and account checks now survive a Livewire action	2026-07-26 20:04:34 +02:00
VpnTest.php	fix(vpn): a late revocation must not disconnect whoever holds the key now	2026-07-26 01:24:55 +02:00