security: round 1 — quick wins (rate limiting, headers, mass assignment, logging)

- Add throttle middleware to login (5/min), portal/token-auth (10/min),
  volunteer-register (5/min), and invitation routes (10/min)
- Set Sanctum token expiration to 7 days
- Remove billing_status from UpdateOrganisationRequest (super_admin only)
- Revoke all Sanctum tokens on password reset
- Strengthen password rules: min 8 chars, mixed case, numbers
- Create SecurityHeaders middleware (X-Content-Type-Options, X-Frame-Options,
  HSTS, Referrer-Policy, Permissions-Policy)
- Fix open redirect on all 3 login pages (validate ?to= starts with /)
- Set APP_DEBUG=false in .env.example
- Log failed login attempts with email, IP, user-agent
- Log authorization failures (403) with user, IP, path, method
- Harden mass assignment: remove user_id from Person, audit fields from
  ShiftAssignment, system fields from UserInvitation $fillable
- Replace real DB records with factory make() in mail preview routes

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

api/app/Services/InvitationService.php

@@ -37,15 +37,14 @@ final class InvitationService
             ]);
         }
 
-        $invitation = UserInvitation::create([
-            'email' => $email,
-            'invited_by_user_id' => $invitedBy->id,
-            'organisation_id' => $org->id,
-            'role' => $role,
-            'token' => strtolower((string) Str::ulid()),
-            'status' => 'pending',
-            'expires_at' => now()->addDays(7),
-        ]);
+        $invitation = new UserInvitation(['email' => $email]);
+        $invitation->invited_by_user_id = $invitedBy->id;
+        $invitation->organisation_id = $org->id;
+        $invitation->role = $role;
+        $invitation->token = strtolower((string) Str::ulid());
+        $invitation->status = 'pending';
+        $invitation->expires_at = now()->addDays(7);
+        $invitation->save();
 
         Mail::to($email)->queue(new InvitationMail($invitation));
 

api/app/Services/PersonIdentityService.php

@@ -181,9 +181,9 @@ final class PersonIdentityService
                 'resolved_at' => now(),
             ]);
 
-            $person->update([
-                'user_id' => $match->matched_user_id,
-            ]);
+            // Set user_id explicitly (not mass-assignable)
+            $person->user_id = $match->matched_user_id;
+            $person->save();
         });
 
         activity('identity')

api/app/Services/ShiftAssignmentService.php

@@ -36,11 +36,13 @@ final class ShiftAssignmentService
                 'person_id' => $person->id,
                 'time_slot_id' => $shift->time_slot_id,
                 'status' => $status,
-                'auto_approved' => $autoApprove,
-                'assigned_at' => now(),
-                'approved_at' => $autoApprove ? now() : null,
             ]);
 
+            $assignment->auto_approved = $autoApprove;
+            $assignment->assigned_at = now();
+            $assignment->approved_at = $autoApprove ? now() : null;
+            $assignment->save();
+
             $this->updateShiftStatusIfFull($shift);
 
             activity('shift_assignment')
@@ -85,17 +87,16 @@ final class ShiftAssignmentService
             if ($existing) {
                 $previousStatus = $existing->status->value;
 
-                $existing->update([
-                    'status' => ShiftAssignmentStatus::APPROVED,
-                    'assigned_by' => $assignedBy->id,
-                    'assigned_at' => now(),
-                    'approved_by' => $assignedBy->id,
-                    'approved_at' => now(),
-                    'rejection_reason' => null,
-                    'cancelled_by' => null,
-                    'cancellation_source' => null,
-                    'cancelled_at' => null,
-                ]);
+                $existing->status = ShiftAssignmentStatus::APPROVED;
+                $existing->assigned_by = $assignedBy->id;
+                $existing->assigned_at = now();
+                $existing->approved_by = $assignedBy->id;
+                $existing->approved_at = now();
+                $existing->rejection_reason = null;
+                $existing->cancelled_by = null;
+                $existing->cancellation_source = null;
+                $existing->cancelled_at = null;
+                $existing->save();
 
                 activity('shift_assignment')
                     ->causedBy($assignedBy)
@@ -133,13 +134,15 @@ final class ShiftAssignmentService
                 'person_id' => $person->id,
                 'time_slot_id' => $shift->time_slot_id,
                 'status' => ShiftAssignmentStatus::APPROVED,
-                'auto_approved' => false,
-                'assigned_by' => $assignedBy->id,
-                'assigned_at' => now(),
-                'approved_by' => $assignedBy->id,
-                'approved_at' => now(),
             ]);
 
+            $assignment->auto_approved = false;
+            $assignment->assigned_by = $assignedBy->id;
+            $assignment->assigned_at = now();
+            $assignment->approved_by = $assignedBy->id;
+            $assignment->approved_at = now();
+            $assignment->save();
+
             $this->updateShiftStatusIfFull($shift);
 
             activity('shift_assignment')
@@ -177,11 +180,10 @@ final class ShiftAssignmentService
 
             $oldStatus = $assignment->status;
 
-            $assignment->update([
-                'status' => ShiftAssignmentStatus::APPROVED,
-                'approved_by' => $approvedBy->id,
-                'approved_at' => now(),
-            ]);
+            $assignment->status = ShiftAssignmentStatus::APPROVED;
+            $assignment->approved_by = $approvedBy->id;
+            $assignment->approved_at = now();
+            $assignment->save();
 
             $this->updateShiftStatusIfFull($shift);
 
@@ -207,10 +209,9 @@ final class ShiftAssignmentService
 
         $oldStatus = $assignment->status;
 
-        $assignment->update([
-            'status' => ShiftAssignmentStatus::REJECTED,
-            'rejection_reason' => $reason,
-        ]);
+        $assignment->status = ShiftAssignmentStatus::REJECTED;
+        $assignment->rejection_reason = $reason;
+        $assignment->save();
 
         activity('shift_assignment')
             ->causedBy($rejectedBy)
@@ -239,12 +240,11 @@ final class ShiftAssignmentService
             $wasApproved = $assignment->status === ShiftAssignmentStatus::APPROVED;
             $oldStatus = $assignment->status;
 
-            $assignment->update([
-                'status' => ShiftAssignmentStatus::CANCELLED,
-                'cancelled_by' => $cancelledBy->id,
-                'cancellation_source' => $source,
-                'cancelled_at' => now(),
-            ]);
+            $assignment->status = ShiftAssignmentStatus::CANCELLED;
+            $assignment->cancelled_by = $cancelledBy->id;
+            $assignment->cancellation_source = $source;
+            $assignment->cancelled_at = now();
+            $assignment->save();
 
             if ($wasApproved) {
                 $this->updateShiftStatusAfterCancellation($assignment->shift);
@@ -292,11 +292,10 @@ final class ShiftAssignmentService
                     ];
                 }
 
-                $assignment->update([
-                    'status' => ShiftAssignmentStatus::APPROVED,
-                    'approved_by' => $approvedBy->id,
-                    'approved_at' => now(),
-                ]);
+                $assignment->status = ShiftAssignmentStatus::APPROVED;
+                $assignment->approved_by = $approvedBy->id;
+                $assignment->approved_at = now();
+                $assignment->save();
 
                 $this->updateShiftStatusIfFull($shift);
 

api/app/Services/VolunteerRegistrationService.php

@@ -57,7 +57,6 @@ final class VolunteerRegistrationService
                     'email' => $email,
                 ],
                 [
-                    'user_id' => $user->id,
                     'crowd_type_id' => $volunteerCrowdType->id,
                     'first_name' => $validated['first_name'] ?? $user->first_name,
                     'last_name' => $validated['last_name'] ?? $user->last_name,
@@ -75,6 +74,10 @@ final class VolunteerRegistrationService
                 ]
             );
 
+            // Set user_id explicitly (not mass-assignable)
+            $person->user_id = $user->id;
+            $person->save();
+
             $this->syncAvailabilities($person, $festivalEvent, $validated['availabilities'] ?? []);
 
             if (!empty($validated['field_values'])) {