From 409e8204f6a5a70f6046eb216573965284142718 Mon Sep 17 00:00:00 2001 From: Konstantinos Arvanitakis Date: Tue, 15 Sep 2026 16:02:20 +0300 Subject: [PATCH] Updating Changelog --- CHANGELOG.md | 32 ++++++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 021ff5b..cb28ec6 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,6 +4,38 @@ All notable changes to this project will be documented in this file. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). +## [Unreleased] + +### Added +- Customer-portal backend groundwork — no routes/controllers/views yet (a storefront-facing UI is + 3dealer's job once a frontend designer picks it up), but the boboko-owned services it needs to + call now exist: + - `Modules\Core\Auth\Services\UserOtpService::validate()` now actually logs the shopper in + (`Auth::login()`, `web` guard) — previously it only returned the `User` model with no session + established and no route/controller anywhere ever called it (the checkout page's "Login" tab + was a disabled placeholder). `Auth::login()` alone is enough to merge/associate any active + guest cart too — it fires `Illuminate\Auth\Events\Login`, which Lunar's own + `Lunar\Listeners\CartSessionAuthListener` (registered unconditionally in core, no opt-in + needed) already reacts to, honoring `config('lunar.cart.auth_policy')` (`'merge'` by default). + An earlier draft of this also called `Cart::associate()` directly from this service — removed + as redundant and actually wrong: it ran a second, separate association with a hardcoded + `'merge'` policy that ignored whatever a consumer had actually set `auth_policy` to. Also fixed + an unbounded brute-force window: a 6-digit code (1M combinations, was guessable for its full + 10-minute expiry with no attempt cap) now invalidates itself after 5 wrong guesses + (`users.otp_attempts`, new column), forcing a fresh code request rather than leaving a live one + guessable indefinitely. + - `Modules\Core\Auth\Events\CustomerLoggedIn` — dispatched on every successful OTP login (new + user or returning), for a storefront to hook into (e.g. post-login redirect, analytics). + - `Modules\Core\Customer\Services\CustomerAccountService` — the storefront-facing "My Account" + API (mirrors `CartService`/`CheckoutService`'s shape): `orders()` (paginated, placed orders + only), `order()`, `addresses()`, `createAddress()`/`updateAddress()`/`deleteAddress()`, + `updateProfile()`. Every method is scoped to the given user's own + `latestCustomer()` — there is no method that accepts a bare order/address id without also + requiring the owning user, so a controller built on top of this can't leak one customer's data + to another by trusting a client-supplied id alone (verified live: a second customer attempting + to read/edit the first's address or order gets `AddressNotFoundException`/ + `OrderNotFoundException`, not the record). + ## [0.17.0] - 2026-09-14 ### Added