admin
306f8fb4e8
- GET /partner-stores/nearby — public, residents browse active stores
ranked by distance via ST_Distance_Sphere; PublicPartnerStoreResource
excludes commission rate / owner / permit (only what a buyer needs).
- GET /partner-stores/{uuid} — public details, 404 if not active.
- GET /me/collections — paginated resident QR scan history with
optional from/to date filters.
- GET /me/upcoming-pickups — finds scheduled/in-progress trips whose
route includes the resident's assigned drop-off point. Returns
household_assigned: false when no household yet.
- GET /me/notifications — paginated database notifications inbox
with unread_only filter + unread_count in meta.
- POST /me/notifications/{id}/read, POST .../mark-all-read,
GET .../unread-count.
- config/cors.php — allow CUSTOMER_APP_URL and any EXTRA_CORS_ORIGINS
to call the API with credentials. Same-origin admin web is
unaffected.
202 feature tests passing.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
32 lines
803 B
PHP
32 lines
803 B
PHP
<?php
|
|
|
|
return [
|
|
/*
|
|
| Cross-Origin Resource Sharing for the Verde API.
|
|
|
|
|
| Same-origin requests (admin web on waste.test) don't need CORS at all.
|
|
| Customer-facing Next.js site lives at CUSTOMER_APP_URL — likely a
|
|
| different domain (app.verde.ph). It needs CORS + credentials so
|
|
| the Next.js auth-proxy route handlers can attach the cookie.
|
|
*/
|
|
|
|
'paths' => ['api/*', 'sanctum/csrf-cookie', 'broadcasting/auth'],
|
|
|
|
'allowed_methods' => ['*'],
|
|
|
|
'allowed_origins' => array_filter(array_merge(
|
|
[env('CUSTOMER_APP_URL')],
|
|
explode(',', (string) env('EXTRA_CORS_ORIGINS', '')),
|
|
)),
|
|
|
|
'allowed_origins_patterns' => [],
|
|
|
|
'allowed_headers' => ['*'],
|
|
|
|
'exposed_headers' => [],
|
|
|
|
'max_age' => 0,
|
|
|
|
'supports_credentials' => true,
|
|
];
|