Code Coverage
 
Lines
Functions and Methods
Classes and Traits
Total
100.00%
23 / 23
100.00%
2 / 2
 CRAP
100.00%
1 / 1
RouteServiceProvider
100.00%
23 / 23
100.00%
2 / 2
 3
100.00%
1 / 1
 boot
100.00%
11 / 11
100.00%
1 / 1
 1
 configureRateLimiting
100.00%
12 / 12
100.00%
1 / 1
 2
1<?php
2
3namespace App\Providers;
4
5use Illuminate\Cache\RateLimiting\Limit;
6use Illuminate\Foundation\Support\Providers\RouteServiceProvider as ServiceProvider;
7use Illuminate\Http\Request;
8use Illuminate\Support\Facades\RateLimiter;
9use Illuminate\Support\Facades\Route;
10
11class RouteServiceProvider extends ServiceProvider
12{
13    /**
14     * The path to the "home" route for your application.
15     *
16     * Typically, users are redirected here after authentication.
17     *
18     * @var string
19     */
20    public const HOME = '/home';
21
22    public const DASHBOARD = '/admin/dashboard';
23
24    /**
25     * Define your route model bindings, pattern filters, and other route configuration.
26     *
27     * @return void
28     */
29    public function boot()
30    {
31        $this->configureRateLimiting();
32
33        $this->routes(function () {
34            Route::middleware('api')
35                ->prefix('api')
36                ->group(base_path('routes/api.php'));
37            Route::middleware('web')
38                ->prefix('admin')
39                ->group(base_path('routes/admin.php'));
40            Route::middleware('web')
41                ->group(base_path('routes/web.php'));
42        });
43    }
44
45    /**
46     * Configure the rate limiters for the application.
47     *
48     * @return void
49     */
50    protected function configureRateLimiting()
51    {
52        RateLimiter::for('api', function (Request $request) {
53            return Limit::perMinute(60)->by($request->user()?->id ?: $request->ip());
54        });
55
56        // Phase 11 hardening — public endpoints with no rate limit of their own.
57        // Admin/customer login already throttle via Laravel's built-in
58        // ThrottlesLogins (used by AuthenticatesUsers), these cover what
59        // that doesn't: customer register/password-reset, checkout, and the
60        // two lookup endpoints (search-suggest, order tracking) that could
61        // otherwise be hammered for enumeration or scraping.
62        RateLimiter::for('customer-auth', function (Request $request) {
63            return Limit::perMinute(6)->by($request->ip());
64        });
65
66        RateLimiter::for('checkout', function (Request $request) {
67            return Limit::perMinute(10)->by($request->ip());
68        });
69
70        RateLimiter::for('lookup', function (Request $request) {
71            return Limit::perMinute(20)->by($request->ip());
72        });
73    }
74}