nexxo f5f4d2a8cd fix(security): close the Livewire bypass of the admin host restriction ... Admin actions post to /livewire/update, which a path-scoped guard skips — an operator session could drive admin components through a PUBLIC hostname despite ADMIN_HOSTS. The restriction is now registered as Livewire-persistent middleware and listed on the admin route group, so Livewire re-applies it from the component snapshot. Proven by replaying a snapshot taken from the real rendered page: identical payload -> 404 on a public host, 200 on the allowed host (positive control, so the test cannot pass for the wrong reason). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>		2026-07-25 20:50:22 +02:00
..
AdminConsoleTest.php	feat(admin): dark Tactical-Terminal operator console	2026-07-25 08:35:03 +02:00
AdminHostRestrictionTest.php	fix(security): close the Livewire bypass of the admin host restriction	2026-07-25 20:50:22 +02:00
AdminSettingsTest.php	fix(admin): shown-once temp password for invited staff; suppress announcements for cancelled windows at send time	2026-07-25 16:23:21 +02:00
DatacenterTest.php	fix(admin): no admin lockout (is_admin fallback); centered modal width; datacenter edit modal + country dropdown	2026-07-25 18:09:17 +02:00
HostManagementTest.php	feat(admin): host reserve edit + maintenance drain; customer suspend/reactivate	2026-07-25 14:30:21 +02:00
MaintenanceTest.php	fix(portal): scope the per-instance maintenance badge to that instance's host	2026-07-25 19:12:33 +02:00
ProvisioningActionsTest.php	fix(ui): modal above sidebar (z-index); datacenter edit buttons stay right; toast slides from bottom; provisioning retry action	2026-07-25 15:29:37 +02:00
RbacTest.php	fix(admin): remove is_admin self-heal — RBAC is the only console boundary (no revocation bypass)	2026-07-25 18:35:14 +02:00