nexxo 5c2e481985 fix(security): console and account checks now survive a Livewire action ... Livewire re-applies only the middleware on its persistent list when an action posts to /livewire/update. Its defaults cover auth; ours were not on the list — only RestrictAdminHost had been added. So EnsureAdmin and EnsureCustomerActive guarded the PAGE and not the actions, and the page is not where the actions run: a signed-in non-operator who could reach the admin host could drive console components, and a suspended customer could keep driving the portal. Found by Codex while reviewing the domain-separation design, and confirmed against Livewire's own default list in vendor. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>		2026-07-26 20:04:34 +02:00
..
Feature	fix(security): console and account checks now survive a Livewire action	2026-07-26 20:04:34 +02:00
Support/Steps	feat(engine-b): CustomerStep base + shared resource trait + config	2026-07-25 11:39:56 +02:00
Unit	feat(engine): orchestrator core (state machine + tick + lock)	2026-07-25 09:54:52 +02:00
Pest.php	fix(security): match ADMIN_HOSTS case-insensitively; share test helpers	2026-07-25 20:56:26 +02:00
TestCase.php	test: do not reach for Redis from the provisioning queue	2026-07-26 02:20:46 +02:00