bert.hausmans
1028498705
- Add throttle middleware to login (5/min), portal/token-auth (10/min), volunteer-register (5/min), and invitation routes (10/min) - Set Sanctum token expiration to 7 days - Remove billing_status from UpdateOrganisationRequest (super_admin only) - Revoke all Sanctum tokens on password reset - Strengthen password rules: min 8 chars, mixed case, numbers - Create SecurityHeaders middleware (X-Content-Type-Options, X-Frame-Options, HSTS, Referrer-Policy, Permissions-Policy) - Fix open redirect on all 3 login pages (validate ?to= starts with /) - Set APP_DEBUG=false in .env.example - Log failed login attempts with email, IP, user-agent - Log authorization failures (403) with user, IP, path, method - Harden mass assignment: remove user_id from Person, audit fields from ShiftAssignment, system fields from UserInvitation $fillable - Replace real DB records with factory make() in mail preview routes Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
68 lines
1.6 KiB
Plaintext
68 lines
1.6 KiB
Plaintext
APP_NAME="Crewli"
|
|
APP_ENV=local
|
|
APP_KEY=
|
|
# Set to true only in local development
|
|
APP_DEBUG=false
|
|
# Local API origin (no path suffix). Production: https://api.crewli.app
|
|
APP_URL=http://localhost:8000
|
|
|
|
APP_LOCALE=en
|
|
APP_FALLBACK_LOCALE=en
|
|
APP_FAKER_LOCALE=en_US
|
|
|
|
APP_MAINTENANCE_DRIVER=file
|
|
|
|
BCRYPT_ROUNDS=12
|
|
|
|
LOG_CHANNEL=stack
|
|
LOG_STACK=single
|
|
LOG_DEPRECATIONS_CHANNEL=null
|
|
LOG_LEVEL=debug
|
|
|
|
DB_CONNECTION=mysql
|
|
DB_HOST=127.0.0.1
|
|
DB_PORT=3306
|
|
DB_DATABASE=crewli
|
|
DB_USERNAME=crewli
|
|
DB_PASSWORD=secret
|
|
|
|
SESSION_DRIVER=database
|
|
SESSION_LIFETIME=120
|
|
SESSION_ENCRYPT=false
|
|
SESSION_PATH=/
|
|
SESSION_DOMAIN=null
|
|
|
|
BROADCAST_CONNECTION=log
|
|
FILESYSTEM_DISK=local
|
|
QUEUE_CONNECTION=database
|
|
|
|
CACHE_STORE=redis
|
|
|
|
REDIS_CLIENT=phpredis
|
|
REDIS_HOST=127.0.0.1
|
|
REDIS_PASSWORD=null
|
|
REDIS_PORT=6379
|
|
|
|
MAIL_MAILER=smtp
|
|
MAIL_HOST=127.0.0.1
|
|
MAIL_PORT=1025
|
|
MAIL_USERNAME=null
|
|
MAIL_PASSWORD=null
|
|
MAIL_ENCRYPTION=null
|
|
# App / transactional mail: use crewli.app. (crewli.nl = future marketing site only, not this stack.)
|
|
MAIL_FROM_ADDRESS="noreply@crewli.app"
|
|
MAIL_FROM_NAME="${APP_NAME}"
|
|
|
|
# CORS + Sanctum — SPA origins (no trailing slash; must match the browser URL)
|
|
FRONTEND_ADMIN_URL=http://localhost:5173
|
|
FRONTEND_APP_URL=http://localhost:5174
|
|
FRONTEND_PORTAL_URL=http://localhost:5175
|
|
SANCTUM_STATEFUL_DOMAINS=localhost:5173,localhost:5174,localhost:5175
|
|
|
|
# --- Production (crewli.app) — uncomment and adjust hostnames if you use this layout:
|
|
# APP_URL=https://api.crewli.app
|
|
# FRONTEND_ADMIN_URL=https://admin.crewli.app
|
|
# FRONTEND_APP_URL=https://app.crewli.app
|
|
# FRONTEND_PORTAL_URL=https://portal.crewli.app
|
|
# SANCTUM_STATEFUL_DOMAINS=admin.crewli.app,app.crewli.app,portal.crewli.app
|