boban
6c81dd1d48
fix: eliminate FOUC, Echo, modal duplicate, icons, test DB isolation
...
- FIX 1: Remove duplicate modal container (keep @livewire directive, drop <x-modal-container>)
- FIX 2: Add Laravel Echo + Pusher to bootstrap.js with Reverb config
- FIX 3: Cookie-based theme — exclude nimuli_theme from encryption, write cookie in Alpine store, read server-side in layout
- FIX 4: Generate missing PNG favicons (16/32/180/192/512px) via GD
- FIX 5: Create scripts/verify-modals.sh (27 checks, all green)
- BUG: Docker OS env DB_CONNECTION=mysql was overriding phpunit.xml sqlite config, causing RefreshDatabase to migrate:fresh production MySQL — fixed by forcing DB vars in tests/bootstrap.php alongside existing APP_ENV fix
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-16 13:23:44 +02:00
boban
c0f9ee4427
fix: trust proxies + tailwind v4 + debugbar off
...
- bootstrap/app.php: trustProxies(at: '*') — nginx/NPM forward HTTPS,
app must trust X-Forwarded-Proto to generate correct https:// URLs
- package.json: tailwindcss v3 → v4, removed @tailwindcss/forms (v3-only)
- .env: DEBUGBAR_ENABLED=false, VITE_DEV_SERVER_URL corrected
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-16 09:08:03 +02:00
boban
ea9274be49
fix(quality): PHPStan level 6 compliance, Pint formatting
...
- Add phpstan.neon with level 6 config and larastan extension
- Fix all 92 PHPStan errors: Eloquent relation generics, iterable
value types, HasFactory generic annotations, missing return types
- Fix logic bugs: always-true Safari/Chrome comparison, nullsafe on
non-nullable Carbon, unused $renderer suppressed with ignore rule
- Implement MustVerifyEmail on User model (was commented out in Breeze
scaffold) to satisfy VerifyEmailController type contract
- Remove broken QrCode::newFactory() referencing non-existent factory
- Add @var docblocks for app('current_workspace') mixed resolution
- Apply Pint formatting: 53 style issues fixed across 168 files
- Test suite unchanged: 9 pre-existing assertSeeLivewire failures,
55 tests passing
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-16 08:28:10 +02:00
boban
3f6b281c62
feat(security): add HSTS, X-Frame-Options, Referrer-Policy, Permissions-Policy headers
2026-05-16 07:51:33 +02:00
boban
1375519cdb
feat(api): REST API v1 — links CRUD with Sanctum auth
...
Adds /api/v1/workspaces/{ulid}/links endpoints (index, store, destroy)
protected by Sanctum token auth; adds HasApiTokens to User model and
AuthorizesRequests to base Controller; wires routes/api.php into bootstrap.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-16 07:38:45 +02:00
boban
8f1398380f
fix(billing): pm_type/pm_last_four migration, narrow CSRF exclusion, EU paper size
...
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-16 01:46:54 +02:00
boban
06dbb1dffb
feat(billing): Cashier Billable on Workspace, Stripe webhook route
...
- Add Laravel\Cashier\Billable trait to Workspace model
- Register Workspace as Cashier customer model in AppServiceProvider
- Publish cashier config with EUR currency and de_DE locale defaults
- Add CSRF exclusion for stripe/* in bootstrap/app.php
- Add StripeWebhookTest verifying endpoint exists and rejects bad signatures
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-16 01:35:11 +02:00
boban
9d5d5af24d
feat(auth): argon2id hashing, locale middleware, login rate limiting
...
Switch default password hashing from bcrypt to argon2id, add
LocaleFromUser middleware appended to web stack, and add HTTP-level
throttle:5,1 on POST /login to satisfy the 429 rate-limit test.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-16 00:32:26 +02:00
boban
25dddf5293
feat: initial Nimuli scaffold with Laravel 12, Livewire 3, Octane, Reverb, Docker
...
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-15 23:51:57 +02:00
boban