saufi/eCert-MBIP
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: security hardening (Fasa 10)

Browse Source 
- EnsureIsAdmin middleware: gates all admin routes on is_admin flag
- Apply admin middleware to entire admin route group
- Fix questionnaire resource route parameter name mismatch ({set})
- Audit log on questionnaire confirmation

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Saufi
2026-05-16 23:54:11 +08:00
parent 165f22fe6f
commit a41ff59009
4 changed files with 27 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
routes/web.php
View File

@@ -24,7 +24,7 @@ Route::get('/', fn() => redirect()->route('admin.dashboard'));
// ──────────────────────────────────────────────
// Admin Routes
// ──────────────────────────────────────────────
Route::middleware('auth')->prefix('admin')->name('admin.')->group(function () {
Route::middleware(['auth', 'admin'])->prefix('admin')->name('admin.')->group(function () {
Route::get('/dashboard', [DashboardController::class, 'index'])->name('dashboard');
@@ -84,7 +84,7 @@ Route::middleware('auth')->prefix('admin')->name('admin.')->group(function () {
});
// Questionnaire Sets
Route::resource('questionnaires', QuestionnaireSetController::class)->except(['show']);
Route::resource('questionnaires', QuestionnaireSetController::class)->except(['show'])->parameters(['questionnaires' => 'set']);
Route::post('/questionnaires/{set}/publish', [QuestionnaireSetController::class, 'publish'])->name('questionnaires.publish');
Route::post('/questionnaires/{set}/archive', [QuestionnaireSetController::class, 'archive'])->name('questionnaires.archive');
Route::get('/questionnaires/{set}', [QuestionnaireSetController::class, 'show'])->name('questionnaires.show');