Repository navigation
Conversation
Add api_credentials.profile. A key with a profile only reaches the paths listed for it in config/api.php, and the rider profile covers customer, service quote and order config routes. Keys with no profile are unchanged, and an unknown profile allows nothing. Log customer tokens used as Bearer outside customer routes, and refuse them when API_CUSTOMER_TOKENS_ENFORCE=true. This is off by default so any integration relying on it shows up in the logs first.
Composer refuses to install illuminate/mail on Laravel 10 because of CVE-2026-48019, which has no patch before Laravel 12. Ignore this one advisory in PHP CI so the tests can run. Production dependencies don't change. Remove this when the Laravel 12 upgrade lands.
symfony/http-kernel 6.4, the only version Composer will install for Laravel 10 now, conflicts with var-dumper below 6.3. This is a dev-only dependency, and production already runs 6.4.
Run the middleware end to end for a key outside its profile and a customer token on a company route, so both refusals are proven and the coverage gate is met.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #329 +/- ##
===========================================
Coverage 100.00% 100.00%
- Complexity 9600 9609 +9
===========================================
Files 519 519
Lines 29841 29858 +17
===========================================
+ Hits 29841 29858 +17
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
Add the ledger route that gives a rider the invoice for their own order.
This was referenced Nov 5, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Published apps ship an API key that can reach the whole company. This adds an opt-in way to limit a key, so a rider app can carry one that only reaches rider routes.
api_credentials.profilecolumn. A key with a profile only reaches the paths listed for it inapi.key_profiles, and gets a 403 elsewhere. The first profile isrider:v1/customers,v1/service-quotesandv1/order-configs. An unknown profile allows nothing, so a typo can't leave a key unrestricted.API_KEY_PROFILES_ENFORCE=falseonly logs what a profile would refuse.API_CUSTOMER_TOKENS_ENFORCE=true.v1/customersandv1/socket/tokenstay allowed.Production impact
Customer token used outside customer routes.first.The matching rider routes are a separate change in fleetbase/fleetops, and neither PR needs the other to merge first. There's no console control yet, so a profile is set directly on the credential.
Testing
tests/Unit/Http/MiddlewareContractsTest.phppasses, 43 tests including 2 new ones. The full suite wasn't run locally.Against a local API, a rider key got 403 on
places/search, contacts, orders, drivers, webhook endpoints and socket tokens, and a full key still reached contacts, orders andplaces/search. Enforcing the customer token limit is covered by unit tests only.