Feat/security #40
Merged
Feat/security #40
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…actoring - Add Form Request validation classes (RegisterRequest, LoginRequest) following SOLID principles - Implement rate limiting on auth endpoints (3 reg/hour, 5 login/min) to prevent brute force - Add comprehensive security logging for authentication events (login, register, logout) - Enhance password validation (12+ chars, mixed case, numbers, symbols, haveibeenpwned check) - Implement restrictive CORS policy with configurable allowed origins (no wildcards) - Sanitize error messages to prevent user enumeration and information disclosure - Add logout endpoint with JWT token invalidation - Refactor AuthController reducing complexity BREAKING CHANGE: Password confirmation field renamed from `c_password` to `password_confirmation` (Laravel standard). Clients must update registration requests accordingly.
- Upgrade PHP from 8.4.15 to 8.4.16 - Upgrade Redis from 7.4.5 to 7.4.7 - Upgrade NGINX from 1.29.3 to 1.29.4 - Update version badges in documentation
- Migrate validation rules to array format (pipe strings → arrays) - Add #[Override] attributes to Form Request methods (PHP 8.3+) - Change Eloquent scopes to protected visibility (Laravel 11+) - Convert closures to arrow functions for brevity - Use Env::get() instead of $_ENV superglobal - Add explicit type casting for env() string values All changes applied via Rector automated refactoring tool following Laravel 12 and PHP 8.3 standards.
- Fix arrow function spacing (PSR-12 compliance) - Remove obsolete PHPStan error suppressions for JWTAuth facade - All CI checks passing (Pint, PHPStan, PHPUnit, Rector)
Security improvements: - Add SecurityHeaders middleware (HSTS, X-Frame-Options, X-Content-Type-Options, X-XSS-Protection, Referrer-Policy, Permissions-Policy) - Upgrade spatie/laravel-csp from 2.10.3 to 3.21.0 - Implement strict CSP with deny-by-default (default-src 'none') - Add 3 unit tests for SecurityHeaders middleware Architecture: - Single Responsibility: Spatie CSP handles CSP, SecurityHeaders handles other headers - KISS: Reuse proven package instead of custom implementation
Development dependencies: - Upgrade rector/rector from 2.2.8 to 2.3.0 Code improvements: - Modernize bootstrap cache files with Rector (array() → [], string → ::class) - Apply LongArrayToShortArrayRector to packages.php and services.php - Apply StringClassNameToClassConstantRector for type safety Files: - composer.json, composer.lock (rector upgrade) - CHANGELOG.md (document update) - bootstrap/cache/packages.php (modernized) - bootstrap/cache/services.php (modernized)
Development dependencies: - Upgrade laravel/pint from 1.24.0 to 1.27.0 Verification: - Code style check passed (99 files) - No formatting issues detected
- Indirect dependency patch update through composer.lock - webonyx/graphql-php: 15.29.3 → 15.29.4
- Static analysis tool for Laravel applications - larastan/larastan: 3.5.0 → 3.8.1
- Redis client and GraphQL framework updates - predis/predis: 3.0.1 → 3.3.0 - nuwave/lighthouse: 6.63.2 → 6.64.0
…nstraints Update composer validation flag from --no-check-publish to --no-check-all to suppress warnings about exact version constraints, which are intentionally used as a security best practice for production applications.
Add 59 new tests covering authentication, JWT, form requests, and resources: - AuthApiTest (12): register, login, logout flows with validation - JWTMiddlewareTest (8): token validation and error handling - LoginRequestTest (9) & RegisterRequestTest (17): form validation rules - TranslationCollectionTest (6): resource pagination (cursor/standard) - Enhanced TranslationController & WordController exception coverage Coverage increased from 63.2% to 91.9% (+28.7pp, exceeding 74% target)
- Added `php artisan jwt:secret --force` command to GitHub Actions workflow - Fixes authentication test failures caused by missing JWT_SECRET in CI - Tests now properly initialize JWT configuration before running PHPUnit suite
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Added
RegisterRequest,LoginRequest)POST /api/v1/user/logout)CORS_ALLOWED_ORIGINS)AuthApiTest: Authentication flows (register, login, logout)JWTMiddlewareTest: JWT token validation and error handlingLoginRequestTest&RegisterRequestTest: Form validation rules and messagesTranslationCollectionTest: Resource collection paginationTranslationController,WordControllerexception handlingChanged
AuthControllerto use Form Request classesc_passwordtopassword_confirmation(Laravel standard)predis/predis: 3.0.1 → 3.3.0nuwave/lighthouse: 6.63.2 → 6.64.0webonyx/graphql-php: 15.29.3 → 15.29.4 (indirect dependency patch update)rector/rector: 2.2.8 → 2.3.0laravel/pint: 1.24.0 → 1.27.0larastan/larastan: 3.5.0 → 3.8.1publictoprotected(Laravel 11+ standard)#[Override]attributes to Form Request methods for type safety--no-check-all)Security
Removed
tests/Feature/ExampleTest.php(replaced with production-ready test suite)