Output:
Chunk ID: 56ab5c
Wall time: 0.0000 seconds
Process exited with code 0
Original token count: 7292
Output:
- 2026-05-04: `php artisan test --compact` passed after the admin collection API changes: 215 tests, 1175 assertions.
- 2026-05-04: `mcp__laravel_boost__.search_docs` consulted Laravel 12 validation, date validation, prohibited/unique update-field validation, JSON API testing, and Pest 4 docs before the admin discount API changes.
- 2026-05-04: `php artisan make:controller Api/Admin/V1/DiscountController --no-interaction`, `php artisan make:resource Admin/V1/DiscountResource --no-interaction`, and `php artisan make:test Api/AdminDiscountApiTest --pest --no-interaction` created the discount API controller/resource and tests.
- 2026-05-04: `vendor/bin/pint --dirty --format agent` passed after the admin discount API changes.
- 2026-05-04: `php artisan test --compact tests/Feature/Api/AdminDiscountApiTest.php` passed after the admin discount API changes: 3 tests, 25 assertions.
- 2026-05-04: `php artisan test --compact tests/Feature/Api` passed after the admin discount API changes: 31 tests, 243 assertions.
- 2026-05-04: `php artisan route:list --path=api/admin/v1/stores --except-vendor` confirmed 16 admin API routes, including discount list/create/update/delete.
- 2026-05-04: `php artisan test --compact` passed after the admin discount API changes: 218 tests, 1200 assertions.
- 2026-05-04: `mcp__laravel_boost__.search_docs` consulted Laravel 12 scoped unique validation, route model binding, API resources/pagination, JSON API validation testing, and Pest 4 docs before the admin page API changes.
- 2026-05-04: `php artisan make:controller Api/Admin/V1/PageController --no-interaction`, `php artisan make:resource Admin/V1/PageResource --no-interaction`, and `php artisan make:test Api/AdminPageApiTest --pest --no-interaction` created the content page API controller/resource and tests.
- 2026-05-04: `vendor/bin/pint --dirty --format agent` passed after the admin page API changes.
- 2026-05-04: `php artisan test --compact tests/Feature/Api/AdminPageApiTest.php` passed after the admin page API changes: 3 tests, 26 assertions.
- 2026-05-04: `php artisan test --compact tests/Feature/Api` passed after the admin page API changes: 34 tests, 269 assertions.
- 2026-05-04: `php artisan route:list --path=api/admin/v1/stores --except-vendor` confirmed 20 admin API routes, including page list/create/update/delete.
- 2026-05-04: `php artisan test --compact` passed after the admin page API changes: 221 tests, 1226 assertions.
- 2026-05-04: `mcp__laravel_boost__.search_docs` consulted Laravel 12 JSON responses, 202 Accepted response testing, controller DI, database query counting, and route middleware docs before the admin search index API changes.
- 2026-05-04: `php artisan make:controller Api/Admin/V1/SearchIndexController --no-interaction` and `php artisan make:test Api/AdminSearchIndexApiTest --pest --no-interaction` created the search index API controller and tests.
- 2026-05-04: `vendor/bin/pint --dirty --format agent` passed after the admin search index API changes.
- 2026-05-04: `php artisan test --compact tests/Feature/Api/AdminSearchIndexApiTest.php` passed after the admin search index API changes: 2 tests, 16 assertions.
- 2026-05-04: `php artisan test --compact tests/Feature/Api` passed after the admin search index API changes: 36 tests, 285 assertions.
- 2026-05-04: `php artisan route:list --path=api/admin/v1/stores --except-vendor` confirmed 22 admin API routes, including search status and reindex.
- 2026-05-04: `php artisan test --compact` passed after the admin search index API changes: 223 tests, 1242 assertions.
- 2026-05-04: `mcp__laravel_boost__.search_docs` consulted Laravel 12 date validation, JSON API testing, query aggregates, and validated input docs before the admin analytics summary API changes.
- 2026-05-04: `php artisan make:controller Api/Admin/V1/AnalyticsSummaryController --no-interaction` and `php artisan make:test Api/AdminAnalyticsSummaryApiTest --pest --no-interaction` created the analytics summary API controller and tests.
- 2026-05-04: `vendor/bin/pint --dirty --format agent` passed after the admin analytics summary API changes.
- 2026-05-04: `php artisan test --compact tests/Feature/Api/AdminAnalyticsSummaryApiTest.php` passed after the admin analytics summary API changes: 3 tests, 26 assertions.
- 2026-05-04: `php artisan test --compact tests/Feature/Api` passed after the admin analytics summary API changes: 39 tests, 311 assertions.
- 2026-05-04: `php artisan route:list --path=api/admin/v1/stores --except-vendor` confirmed 23 admin API routes, including analytics summary.
- 2026-05-04: `php artisan test --compact` passed after the admin analytics summary API changes: 226 tests, 1268 assertions.
- 2026-05-04: `mcp__laravel_boost__.search_docs` consulted Laravel 12 array/boolean validation, update-or-create patterns, JSON API assertions, and Pest 4 docs before the admin tax settings API changes.
- 2026-05-04: `php artisan make:controller Api/Admin/V1/TaxSettingsController --no-interaction`, `php artisan make:resource Admin/V1/TaxSettingsResource --no-interaction`, and `php artisan make:test Api/AdminTaxSettingsApiTest --pest --no-interaction` created the tax settings API controller/resource and tests.
- 2026-05-04: `vendor/bin/pint --dirty --format agent` passed after the admin tax settings API changes.
- 2026-05-04: `php artisan test --compact tests/Feature/Api/AdminTaxSettingsApiTest.php` passed after the admin tax settings API changes: 3 tests, 26 assertions.
- 2026-05-04: `php artisan test --compact tests/Feature/Api` passed after the admin tax settings API changes: 42 tests, 337 assertions.
- 2026-05-04: `php artisan route:list --path=api/admin/v1/stores --except-vendor` confirmed 25 admin API routes, including tax settings read/update.
- 2026-05-04: `php artisan test --compact` passed after the admin tax settings API changes: 229 tests, 1294 assertions.
- 2026-05-04: `mcp__laravel_boost__.search_docs` consulted Laravel 12 nested array validation, scoped nested resources, database transactions, JSON API assertions, and Pest 4 docs before the admin shipping settings API changes.
- 2026-05-04: `php artisan make:controller Api/Admin/V1/ShippingZoneController --no-interaction`, `php artisan make:controller Api/Admin/V1/ShippingRateController --no-interaction`, `php artisan make:resource Admin/V1/ShippingZoneResource --no-interaction`, `php artisan make:resource Admin/V1/ShippingRateResource --no-interaction`, and `php artisan make:test Api/AdminShippingSettingsApiTest --pest --no-interaction` created the shipping settings API controllers/resources and tests.
- 2026-05-04: `vendor/bin/pint --dirty --format agent` passed after the admin shipping settings API changes.
- 2026-05-04: `php artisan test --compact tests/Feature/Api/AdminShippingSettingsApiTest.php` passed after the admin shipping settings API changes: 3 tests, 27 assertions.
- 2026-05-04: `php artisan test --compact tests/Feature/Api` passed after the admin shipping settings API changes: 45 tests, 364 assertions.
- 2026-05-04: `php artisan route:list --path=api/admin/v1/stores --except-vendor` confirmed 29 admin API routes, including shipping zone list/create/update and rate create.
- 2026-05-04: `php artisan test --compact` passed after the admin shipping settings API changes: 232 tests, 1321 assertions.
- 2026-05-04: `mcp__laravel_boost__.search_docs` consulted Laravel 12 file upload validation, scoped route model binding, JSON API testing, and Pest 4 docs before the admin theme API changes.
- 2026-05-04: `php artisan make:class Services/ThemeArchiveInstaller --no-interaction`, `php artisan make:controller Api/Admin/V1/ThemeController --no-interaction`, `php artisan make:controller Api/Admin/V1/ThemeSettingsController --no-interaction`, `php artisan make:resource Admin/V1/ThemeResource --no-interaction`, and `php artisan make:test Api/AdminThemeApiTest --pest --no-interaction` created the theme archive installer, API controllers/resource, and tests.
- 2026-05-04: `vendor/bin/pint --dirty --format agent` passed after the admin theme API changes.
- 2026-05-04: `php artisan test --compact tests/Feature/Api/AdminThemeApiTest.php` passed after the admin theme API changes: 4 tests, 29 assertions.
- 2026-05-04: `php artisan test --compact tests/Feature/Api` passed after the admin theme API changes: 49 tests, 393 assertions.
- 2026-05-04: `php artisan route:list --path=api/admin/v1/stores/{store}/themes --except-vendor` confirmed 3 theme API routes: upload/install, publish, and settings update.
- 2026-05-04: `php artisan test --compact` passed after the admin theme API changes: 236 tests, 1350 assertions.
- 2026-05-04: `mcp__laravel_boost__.search_docs` consulted Laravel 12 nested JSON array validation, update-or-create settings patterns, JSON API validation assertions, and Pest 4 docs before the admin store settings API changes.
- 2026-05-04: `php artisan make:controller Api/Admin/V1/StoreSettingsController --no-interaction`, `php artisan make:resource Admin/V1/StoreSettingsResource --no-interaction`, and `php artisan make:test Api/AdminStoreSettingsApiTest --pest --no-interaction` created the general store settings API controller/resource and tests.
- 2026-05-04: `vendor/bin/pint --dirty --format agent` passed after the admin store settings API changes.
- 2026-05-04: `php artisan test --compact tests/Feature/Api/AdminStoreSettingsApiTest.php` passed after the admin store settings API changes: 3 tests, 35 assertions.
- 2026-05-04: `php artisan test --compact tests/Feature/Api/AdminStoreSettingsApiTest.php tests/Feature/Api/AdminThemeApiTest.php` passed after the admin store settings API changes: 7 tests, 64 assertions.
- 2026-05-04: `php artisan test --compact tests/Feature/Api` passed after the admin store settings API changes: 52 tests, 428 assertions.
- 2026-05-04: `php artisan route:list --path=api/admin/v1/stores/{store}/settings --except-vendor` confirmed 2 general settings API routes: read and update.
- 2026-05-04: `php artisan test --compact` passed after the admin store settings API changes: 239 tests, 1385 assertions.
- 2026-05-04: `mcp__laravel_boost__.search_docs` consulted Laravel 12 streamed/download responses, local storage behavior, model/migration/factory generation, and Pest 4 docs before the admin order export API changes.
- 2026-05-04: `php artisan make:enum ExportStatus --no-interaction`, `php artisan make:model DataExport --migration --factory --no-interaction`, `php artisan make:class Services/OrderExportService --no-interaction`, `php artisan make:controller Api/Admin/V1/OrderExportController --no-interaction`, `php artisan make:resource Admin/V1/DataExportResource --no-interaction`, and `php artisan make:test Api/AdminOrderExportApiTest --pest --no-interaction` created the export status enum, durable export model/table, export service, API controller/resource, and tests.
- 2026-05-04: `vendor/bin/pint --dirty --format agent` passed after the admin order export API changes.
- 2026-05-04: `php artisan test --compact tests/Feature/Api/AdminOrderExportApiTest.php` passed after the admin order export API changes: 3 tests, 23 assertions.
- 2026-05-04: `php artisan test --compact tests/Feature/Api/AdminOrderExportApiTest.php tests/Feature/Api/AdminOrderApiTest.php` passed after the admin order export API changes: 9 tests, 48 assertions.
- 2026-05-04: `php artisan test --compact tests/Feature/Api` passed after the admin order export API changes: 55 tests, 451 assertions.
- 2026-05-04: `php artisan route:list --path=api/admin/v1/stores/{store}/exports --except-vendor` confirmed 2 order export API routes: create and status.
- 2026-05-04: `php artisan migrate:fresh --seed --no-interaction` passed after the admin order export API changes and confirmed the `data_exports` migration runs with the seed suite.
- 2026-05-04: `php artisan test --compact` passed after the admin order export API changes: 242 tests, 1408 assertions.
- 2026-05-04: `mcp__laravel_boost__.search_docs` consulted Laravel 12 database inspection and Pest 4 database assertion docs before adding SQLite CHECK constraint coverage.
- 2026-05-04: `php artisan make:test Foundation/DatabaseConstraintTest --pest --no-interaction` created representative database constraint coverage.
- 2026-05-04: `vendor/bin/pint --dirty --format agent` passed after adding database constraint coverage.
- 2026-05-04: `php artisan test --compact tests/Feature/Foundation/DatabaseConstraintTest.php` passed: 1 test, 6 assertions.
- 2026-05-04: `php artisan test --compact tests/Feature/Foundation` passed after adding database constraint coverage: 14 tests, 108 assertions.
- 2026-05-04: `php artisan test --compact` passed after adding database constraint coverage: 243 tests, 1414 assertions.
- 2026-05-04: `vendor/bin/pint --dirty --format agent` passed after expanding automated browser smoke coverage.
- 2026-05-04: `php artisan test --compact tests/Browser/SmokeTest.php` passed after expanding browser coverage to storefront account auth/reset pages and the full admin navigation surface: 4 tests, 62 assertions.
- 2026-05-04: `php artisan test --compact` passed after expanding browser smoke coverage: 244 tests, 1450 assertions.
- 2026-05-04: `mcp__laravel_boost__.search_docs` consulted Fortify password reset view/custom route docs before adding admin password reset aliases.
- 2026-05-04: `vendor/bin/pint --dirty --format agent` passed after adding admin password reset aliases.
- 2026-05-04: `php artisan test --compact tests/Feature/Auth/PasswordResetTest.php tests/Feature/Auth/CustomerPasswordResetTest.php` passed after adding admin password reset aliases: 10 tests, 45 assertions.
- 2026-05-04: `php artisan route:list --path=admin/forgot-password` and `php artisan route:list --path=admin/reset-password` confirmed the admin forgot-password and reset-password GET/POST routes.
- 2026-05-04: `php artisan test --compact tests/Feature/Auth` passed after adding admin password reset aliases: 24 tests, 78 assertions.
- 2026-05-04: `php artisan test --compact` passed after adding admin password reset aliases: 245 tests, 1456 assertions.

## Decisions

- Follow the roadmap order strictly. Phase 1 is required before catalog, checkout, admin, storefront, and QA flows can be meaningfully implemented.
- Preserve the starter Fortify conventions where they do not conflict with the shop specs.
- Use integer minor units for all money columns and JSON text columns cast through Eloquent as specified.
- Keep `password_hash` as the database column for admin users and customers while exposing `password`/`getAuthPassword()` at the model layer for Fortify/Laravel auth compatibility.
- Seed both `shop.test` and `acme-fashion.test` as storefront domains for the first store so the goal URL and E2E spec URL can both resolve.
- Herd needs a site link for non-project-folder aliases; `acme-fashion.test` is linked to the same local project path as `shop.test` so the seeded domain can be verified in browser E2E flows.
- Customer Livewire auth components persist `storeId` from the initial storefront request because Livewire update requests do not run through the original storefront route middleware.
- The seed specification contains an arithmetic conflict: Acme Fashion's per-product variant table sums to 117 variants, while the prose says 107. The implementation follows the concrete per-product table, resulting in 117 Fashion variants and 10 Electronics variants, 127 total.
- Child catalog models without a `store_id` column are tenant-scoped through their parent product relationship. Inventory keeps its denormalized `store_id` and enforces that it matches the variant product store at save time.
- Storefront content pages now resolve from the `pages` table and only published pages are rendered.
- The catalog admin form intentionally blocks active products without a priced variant and duplicate in-store SKUs during UI edits, mirroring service-layer invariants where the current CRUD surface touches product variants directly.
- The product admin form generates variant rows from the option cartesian product, preserves matching variant edits by option combination, and syncs product option values plus variant pivots on save; stale variants are deleted or archived if order-line history exists.
- Navigation items use a nullable `parent_id` for one-level storefront dropdowns; `NavigationService::buildTree()` groups items recursively by parent while the admin editor enforces top-level parents for child items.
- Cart, checkout, and pricing runtime records are not seeded; only deterministic tax, shipping, and discount configuration is seeded. Runtime carts/checkouts are created by services and tests.
- The cart drawer reads the current session/customer cart without creating an empty cart on every storefront render; carts are created on first add-to-cart or checkout/cart service mutation.
- The checkout UI reserves inventory by selecting a payment method, then submits payment through `CheckoutService::completeCheckout()` so failed card payments can release reservations and return customers to payment selection.
- Order confirmation access is allowed for the authenticated owning customer or for the session that just placed the order via `last_order_id`.
- Customer account order list/detail routes use the `customer` guard and reload orders through explicit store/customer constraints.
- The cart REST API exposes `cart_version` as the public optimistic concurrency field while the service layer keeps its `expectedVersion` argument; `expected_version` remains accepted as a compatibility alias in API requests.
- Cart page discount codes are validated with `DiscountService`, saved in session, and applied to the checkout when the customer proceeds.
- Admin discount forms persist minimum purchase, product eligibility, collection eligibility, and `one_per_customer` in the existing `discounts.rules_json` keys consumed by `DiscountService`; code discounts now check customer order-line allocation history before allowing another use.
- `PricingEngine` applies an explicit checkout discount code first, then active automatic discounts returned by `DiscountService`.
- Order creation replays the same code-then-automatic discount sequence in memory so `order_lines.discount_allocations_json` keeps separate `{discount_id, code, amount}` entries for every line-item discount while preserving aggregate cart line totals.
- `orders.checkout_id` is intentionally added beyond the original schema table to enforce idempotent checkout completion without duplicate orders.
- Failed card payments release reserved inventory and move the checkout back to `shipping_selected` so customers can retry payment selection.
- Bank transfer order completion creates a pending order and payment while keeping inventory reserved until the later admin payment-confirmation flow.
- Inventory commit/release/restock locks by primary key without the current-store global scope because scheduled jobs can operate across stores in one run.
- Admin order Livewire components persist locked `storeId`/`orderId` state and reload orders without global scopes but with explicit store constraints before each service-backed action.
- Admin order actions deliberately delegate to `OrderService`, `RefundService`, and `FulfillmentService` so UI validation cannot bypass payment, refund, fulfillment, or inventory guards.
- Storefront order lookup uses a deterministic HMAC access token derived from store/order identity so confirmation links can be token-gated without adding a new runtime column.
- Admin REST API routes use the `admin.api` middleware with session-authenticated store users or hashed `oauth_tokens` bearer tokens; the current implemented surfaces are read-only products/customers/orders, collection CRUD, discount CRUD, content page CRUD, search status/reindex, analytics summary, shipping zone/rate settings, tax settings read/update, and order fulfillment/refund mutations.
- Admin dashboard sales and top-product metrics are derived from paid or partially refunded orders; the dedicated analytics page now reads analytics event and daily aggregate tables.
- Customer addresses are scoped through the locked customer id because `customer_addresses` intentionally belongs to customers and has no direct `store_id` column.
- Admin/store Livewire route middleware is registered with Livewire persistent middleware so component POST requests keep `current_store` binding and store-role checks after the initial full-page route load.
- Admin routes use a custom `EnsureUserEmailIsVerified` middleware so verified-user gating works for full-page Livewire routes without relying on the stock redirect middleware path that fails during Livewire component redirects in this app.
- Admin settings are split across `/admin/settings`, `/admin/settings/shipping`, `/admin/settings/taxes`, `/admin/settings/checkout`, and `/admin/settings/notifications`; domains are managed on the general settings page because the current route surface does not need a separate domains route.
- The tax settings API accepts the spec-facing `default_tax_rate`/`tax_rates` payload shape and normalizes it to the existing internal `default_rate_bps`/`rates` config consumed by the calculator and admin UI.
- The shipping settings API accepts spec-facing `price_amount`/`tiers` rate config keys and normalizes them to the existing `amount`/`ranges` config consumed by `ShippingCalculator`.
- The theme upload API imports ZIP archives with `theme.json` or `manifest.json`, requires the same core template paths seeded for default themes, stores each imported file on the local disk under the new theme id, and seeds theme settings from the manifest or the store defaults.
- The theme publish API validates required files before switching the store to exactly one published theme and flushing cached theme settings.
- The store settings API exposes the general settings UI surface as `/api/admin/v1/stores/{store}/settings`: store name/currency/locale/timezone fields update the `stores` row, while `settings_json` patches are recursively merged into `store_settings` so checkout and notification defaults are preserved unless explicitly changed.
- The order export API adds a small `data_exports` table to support the spec's export status endpoint; this local app generates CSV synchronously into the local disk, marks the export `completed` inside the create request, and returns a data URL from the status response instead of a cloud presigned URL.
- Checkout and notification settings persist in `store_settings.settings_json`; `bank_transfer_cancel_days` remains a root-level key because the existing cancellation job already consumes it from that location.
- Admin navigation persists nested ordered menu items with Livewire `wire:sort`, up/down sibling controls, and a parent selector; children are saved under their selected top-level parent with per-parent positions.
- The theme editor uses the `ThemeSettingsService` default settings shape as the editable schema and writes back to `theme_settings.settings_json`.
- Theme files are seeded and edited through local disk storage at `theme_files.storage_key`; saving a file updates the stored contents plus `sha256` and `byte_size` metadata.
- Theme duplication copies each file's local disk contents to a new storage key for the copied theme instead of sharing the original file storage path.
- Search uses a local SQLite FTS5 virtual table (`products_fts`) with `SearchService` as the only query/sync boundary; product observer events keep the index synchronized for create/update/delete.
- Admin search reindex API runs the existing local `SearchService::reindex()` synchronously and returns `202 Accepted` with `completed` status because this self-contained app has no separate durable search job state table.
- Search settings apply at query time: per-store stop words are removed, synonym groups expand into sanitized SQLite FTS5 `OR` terms, and terms are joined with explicit `AND`; the admin page can rebuild the per-store index synchronously for this self-contained app.
- Search API rate limiting is registered as `search` (30/minute per IP), analytics ingestion uses the `analytics` limiter (60/minute per IP), and a `webhooks` limiter is registered for future inbound app endpoints.
- Analytics ingestion stores raw events with client-event deduplication and keeps aggregation separate in `analytics_daily`; admin analytics reads pre-aggregated daily metrics for KPIs and raw events for referrers.
- Seeded analytics metrics are deterministic demo data and are not tied to seeded orders because order/payment seed data remains intentionally absent.
- The admin analytics CSV export is generated as a data URL for the self-contained local app rather than creating persistent export files/jobs.
- OAuth/Passport app authorization remains deferred per the roadmap; `/oauth/*` and `/api/apps/v1/*` now return explicit `501 Not Implemented` responses, while the developer token UI uses the existing app installation and `oauth_tokens` schema as a self-contained local token store.
- Admin order API routes use the `admin.api` middleware, which accepts either the existing session-authenticated admin user or a hashed `oauth_tokens` bearer token scoped to the route store; token requests require `read-orders` for GET routes and `write-orders` for refund/fulfillment mutations and update `last_used_at` on successful use.
- Outbound webhook delivery jobs are forced onto the database queue and `webhooks` queue name so domain events enqueue delivery work instead of making external HTTP requests inline when the default queue connection is `sync`.
- Webhook signatures follow the security spec message shape of `{timestamp}.{json_body}` with HMAC-SHA256, while the delivery payload is wrapped with `id`, `api_version`, `event_type`, `store_id`, `occurred_at`, and `data`.
- Webhook circuit breaker state is derived from the latest five delivery rows for a subscription because the schema does not include a dedicated consecutive-failure counter column.
- Customer password resets use a custom store-scoped service instead of Laravel's stock password broker token repository because the `customer_password_reset_tokens` table includes `store_id` in the primary key and the stock repository does not write tenant columns.
- Customer password reset pages are routed under `/account/forgot-password` and `/account/reset-password/{token}` so the existing Fortify starter/admin root routes (`/forgot-password`, `/reset-password/{token}`) remain intact.
- Admin password reset aliases are routed under `/admin/forgot-password` and `/admin/reset-password/{token}` using Fortify's existing password reset controllers; the shared Fortify views post to admin routes when rendered from admin reset pages.
- Product media uploads use Livewire temporary file uploads on the existing product form, create `ProductMedia` rows in `processing` status, and dispatch the existing `ProcessMediaUpload` job instead of adding a second media-processing path.
- Resource policies now type concrete model parameters for Product, Collection, Customer, Discount, Order, Fulfillment, Refund, Page, and Theme actions; `ChecksStoreRole::storeIdForModel()` stays generic because it is the shared store-id extraction helper.
- Laravel's SQLite `enum()` migrations generate database `CHECK` clauses in this app; `DatabaseConstraintTest` locks representative constraints across tenancy, roles, catalog, orders, tax settings, and exports.
- Automated browser coverage remains smoke-oriented, but it now spans storefront catalog/content/search/cart, storefront account auth/reset pages, the full authenticated admin navigation surface, and mobile storefront rendering.

## Open Issues

- Customer password reset is implemented under `/account/forgot-password` and `/account/reset-password/{token}`; the exact spec customer root paths remain occupied by the existing Fortify starter reset routes.
- Full automated browser interaction/permutation suites from Spec 08 are still incomplete beyond the expanded Pest browser smoke coverage.

## Completion Summary

Not complete. Phase 1 foundation, Phase 2 catalog data/UI surfaces, product media processing/admin upload controls, Phase 3 storefront theme/content/navigation data, the Phase 4 cart/checkout/pricing backend foundation, cart/checkout storefront UI through order completion, cart-page estimates, cart/checkout REST APIs, Phase 5 order/payment backend foundation, Phase 5 refund/fulfillment services, customer order views, admin dashboard/order/customer/discount/content/settings/theme-file/navigation/search/analytics/apps/developers management, storefront search and analytics APIs, product/customer/collection/discount/content page/store settings/search/analytics/shipping/tax/theme/order/export API surfaces, deferred OAuth/app route stubs, expanded automated browser smoke coverage, outbound webhook delivery foundations, and representative database CHECK constraint coverage are implemented, with known customer password reset route compatibility, deferred OAuth/app ecosystem routes, and full browser-suite gaps tracked above.


The tree is clean, and the progress file now has two actionable gaps: exact customer reset paths and broader automated browser coverage. I’m going to inspect the route/auth shape next before choosing the lowest-risk way to close the customer reset compatibility gap.


rg -n "forgot-password|reset-password|password\.request|password\.reset|account\.password|admin\.password|Fortify|PasswordReset|ResetPassword|ForgotPassword" routes app resources tests -g '!vendor'


sed -n '80,130p' specs/09-IMPLEMENTATION-ROADMAP.md && sed -n '220,280p' specs/06-AUTH-AND-SECURITY.md && sed -n '1,180p' specs/08-PLAYWRIGHT-E2E-PLAN.md


/bin/zsh
-lc
sed -n '1,260p' routes/web.php

<?php

use App\Http\Controllers\Api\OAuthController;
use App\Http\Middleware\EnsureUserEmailIsVerified;
use App\Livewire\Admin\Analytics\Index as AdminAnalyticsIndex;
use App\Livewire\Admin\Apps\Index as AdminAppsIndex;
use App\Livewire\Admin\Apps\Show as AdminAppShow;
use App\Livewire\Admin\Auth\Login as AdminLogin;
use App\Livewire\Admin\Collections\Form as AdminCollectionForm;
use App\Livewire\Admin\Collections\Index as AdminCollectionsIndex;
use App\Livewire\Admin\Customers\Index as AdminCustomersIndex;
use App\Livewire\Admin\Customers\Show as AdminCustomerShow;
use App\Livewire\Admin\Dashboard as AdminDashboard;
use App\Livewire\Admin\Developers\Index as AdminDevelopersIndex;
use App\Livewire\Admin\Discounts\Form as AdminDiscountForm;
use App\Livewire\Admin\Discounts\Index as AdminDiscountsIndex;
use App\Livewire\Admin\Inventory\Index as AdminInventoryIndex;
use App\Livewire\Admin\Navigation\Index as AdminNavigationIndex;
use App\Livewire\Admin\Orders\Index as AdminOrdersIndex;
use App\Livewire\Admin\Orders\Show as AdminOrderShow;
use App\Livewire\Admin\Pages\Form as AdminPageForm;
use App\Livewire\Admin\Pages\Index as AdminPagesIndex;
use App\Livewire\Admin\Products\Form as AdminProductForm;
use App\Livewire\Admin\Products\Index as AdminProductsIndex;
use App\Livewire\Admin\Search\Settings as AdminSearchSettings;
use App\Livewire\Admin\Settings\Checkout as AdminSettingsCheckout;
use App\Livewire\Admin\Settings\Index as AdminSettingsIndex;
use App\Livewire\Admin\Settings\Notifications as AdminSettingsNotifications;
use App\Livewire\Admin\Settings\Shipping as AdminSettingsShipping;
use App\Livewire\Admin\Settings\Taxes as AdminSettingsTaxes;
use App\Livewire\Admin\Themes\Editor as AdminThemeEditor;
use App\Livewire\Admin\Themes\Index as AdminThemesIndex;
use App\Livewire\Storefront\Account\Auth\ForgotPassword as CustomerForgotPassword;
use App\Livewire\Storefront\Account\Auth\Login as CustomerLogin;
use App\Livewire\Storefront\Account\Auth\Register as CustomerRegister;
use App\Livewire\Storefront\Account\Auth\ResetPassword as CustomerResetPassword;
use App\Livewire\Storefront\Account\Orders\Index as CustomerOrdersIndex;
use App\Livewire\Storefront\Account\Orders\Show as CustomerOrderShow;
use App\Livewire\Storefront\Cart\Show as StorefrontCartShow;
use App\Livewire\Storefront\Checkout\Confirmation as StorefrontCheckoutConfirmation;
use App\Livewire\Storefront\Checkout\Show as StorefrontCheckoutShow;
use App\Livewire\Storefront\Collections\Index as StorefrontCollectionsIndex;
use App\Livewire\Storefront\Collections\Show as StorefrontCollectionShow;
use App\Livewire\Storefront\Home as StorefrontHome;
use App\Livewire\Storefront\Pages\Show as StorefrontPageShow;
use App\Livewire\Storefront\Products\Show as StorefrontProductShow;
use App\Livewire\Storefront\Search\Index as StorefrontSearchIndex;
use Illuminate\Support\Facades\Auth;
use Illuminate\Support\Facades\Route;
use Laravel\Fortify\Http\Controllers\NewPasswordController as FortifyNewPasswordController;
use Laravel\Fortify\Http\Controllers\PasswordResetLinkController as FortifyPasswordResetLinkController;

Route::middleware(['storefront'])->group(function (): void {
    Route::livewire('/', StorefrontHome::class)->name('home');
    Route::livewire('collections', StorefrontCollectionsIndex::class)->name('collections.index');
    Route::livewire('collections/{handle}', StorefrontCollectionShow::class)->name('collections.show');
    Route::livewire('products/{handle}', StorefrontProductShow::class)->name('products.show');
    Route::livewire('cart', StorefrontCartShow::class)->name('cart.show');
    Route::livewire('checkout', StorefrontCheckoutShow::class)->name('checkout.show');
    Route::livewire('checkout/confirmation/{order}', StorefrontCheckoutConfirmation::class)->name('checkout.confirmation');
    Route::livewire('search', StorefrontSearchIndex::class)->name('search.index');
    Route::livewire('pages/{handle}', StorefrontPageShow::class)->name('pages.show');
});

Route::livewire('admin/login', AdminLogin::class)
    ->middleware('guest')
    ->name('admin.login');

Route::get('admin/forgot-password', [FortifyPasswordResetLinkController::class, 'create'])
    ->middleware('guest')
    ->name('admin.password.request');

Route::post('admin/forgot-password', [FortifyPasswordResetLinkController::class, 'store'])
    ->middleware('guest')
    ->name('admin.password.email');

Route::get('admin/reset-password/{token}', [FortifyNewPasswordController::class, 'create'])
    ->middleware('guest')
    ->name('admin.password.reset');

Route::post('admin/reset-password', [FortifyNewPasswordController::class, 'store'])
    ->middleware('guest')
    ->name('admin.password.update');

Route::post('admin/logout', function () {
    Auth::guard('web')->logout();

    request()->session()->invalidate();
    request()->session()->regenerateToken();

    return redirect()->route('admin.login');
})->middleware('auth')->name('admin.logout');

Route::get('oauth/authorize', [OAuthController::class, 'authorize'])
    ->middleware('auth')
    ->name('oauth.authorize');

Route::post('oauth/token', [OAuthController::class, 'token'])
    ->name('oauth.token');

Route::middleware(['auth', EnsureUserEmailIsVerified::class, 'admin'])->prefix('admin')->name('admin.')->group(function (): void {
    Route::livewire('/', AdminDashboard::class)->name('dashboard');
    Route::livewire('analytics', AdminAnalyticsIndex::class)->name('analytics.index');
    Route::livewire('apps', AdminAppsIndex::class)->name('apps.index');
    Route::livewire('apps/{installation}', AdminAppShow::class)->name('apps.show');
    Route::livewire('developers', AdminDevelopersIndex::class)->name('developers.index');
    Route::livewire('products', AdminProductsIndex::class)->name('products.index');
    Route::livewire('products/create', AdminProductForm::class)->name('products.create');
    Route::livewire('products/{product}/edit', AdminProductForm::class)->name('products.edit');
    Route::livewire('inventory', AdminInventoryIndex::class)->name('inventory.index');
    Route::livewire('orders', AdminOrdersIndex::class)->name('orders.index');
    Route::livewire('orders/{order}', AdminOrderShow::class)->name('orders.show');
    Route::livewire('customers', AdminCustomersIndex::class)->name('customers.index');
    Route::livewire('customers/{customer}', AdminCustomerShow::class)->name('customers.show');
    Route::livewire('discounts', AdminDiscountsIndex::class)->name('discounts.index');
    Route::livewire('discounts/create', AdminDiscountForm::class)->name('discounts.create');
    Route::livewire('discounts/{discount}/edit', AdminDiscountForm::class)->name('discounts.edit');
    Route::livewire('pages', AdminPagesIndex::class)->name('pages.index');
    Route::livewire('pages/create', AdminPageForm::class)->name('pages.create');
    Route::livewire('pages/{page}/edit', AdminPageForm::class)->name('pages.edit');
    Route::livewire('navigation', AdminNavigationIndex::class)->name('navigation.index');
    Route::livewire('themes', AdminThemesIndex::class)->name('themes.index');
    Route::livewire('themes/{theme}/editor', AdminThemeEditor::class)->name('themes.editor');
    Route::livewire('settings', AdminSettingsIndex::class)->name('settings.index');
    Route::livewire('settings/shipping', AdminSettingsShipping::class)->name('settings.shipping');
    Route::livewire('settings/taxes', AdminSettingsTaxes::class)->name('settings.taxes');
    Route::livewire('settings/checkout', AdminSettingsCheckout::class)->name('settings.checkout');
    Route::livewire('settings/notifications', AdminSettingsNotifications::class)->name('settings.notifications');
    Route::livewire('search/settings', AdminSearchSettings::class)->name('search.settings');
    Route::livewire('collections', AdminCollectionsIndex::class)->name('collections.index');
    Route::livewire('collections/create', AdminCollectionForm::class)->name('collections.create');
    Route::livewire('collections/{collection}/edit', AdminCollectionForm::class)->name('collections.edit');
});

Route::middleware(['storefront'])->group(function (): void {
    Route::livewire('account/login', CustomerLogin::class)
        ->middleware('guest:customer')
        ->name('account.login');

    Route::livewire('account/register', CustomerRegister::class)
        ->middleware('guest:customer')
        ->name('account.register');

    Route::livewire('account/forgot-password', CustomerForgotPassword::class)
        ->middleware('guest:customer')
        ->name('account.password.request');

    Route::livewire('account/reset-password/{token}', CustomerResetPassword::class)
        ->middleware('guest:customer')
        ->name('account.password.reset');

    Route::livewire('account', CustomerOrdersIndex::class)
        ->middleware('auth:customer')
        ->name('account.dashboard');

    Route::livewire('account/orders/{order}', CustomerOrderShow::class)
        ->middleware('auth:customer')
        ->name('account.orders.show');
});

Route::redirect('dashboard', 'admin')
    ->middleware(['auth', 'verified'])
    ->name('dashboard');

require __DIR__.'/settings.php';


Output:
Chunk ID: d3c37b
Wall time: 0.0000 seconds
Process exited with code 0
Original token count: 2294
Output:
<?php

use App\Http\Controllers\Api\OAuthController;
use App\Http\Middleware\EnsureUserEmailIsVerified;
use App\Livewire\Admin\Analytics\Index as AdminAnalyticsIndex;
use App\Livewire\Admin\Apps\Index as AdminAppsIndex;
use App\Livewire\Admin\Apps\Show as AdminAppShow;
use App\Livewire\Admin\Auth\Login as AdminLogin;
use App\Livewire\Admin\Collections\Form as AdminCollectionForm;
use App\Livewire\Admin\Collections\Index as AdminCollectionsIndex;
use App\Livewire\Admin\Customers\Index as AdminCustomersIndex;
use App\Livewire\Admin\Customers\Show as AdminCustomerShow;
use App\Livewire\Admin\Dashboard as AdminDashboard;
use App\Livewire\Admin\Developers\Index as AdminDevelopersIndex;
use App\Livewire\Admin\Discounts\Form as AdminDiscountForm;
use App\Livewire\Admin\Discounts\Index as AdminDiscountsIndex;
use App\Livewire\Admin\Inventory\Index as AdminInventoryIndex;
use App\Livewire\Admin\Navigation\Index as AdminNavigationIndex;
use App\Livewire\Admin\Orders\Index as AdminOrdersIndex;
use App\Livewire\Admin\Orders\Show as AdminOrderShow;
use App\Livewire\Admin\Pages\Form as AdminPageForm;
use App\Livewire\Admin\Pages\Index as AdminPagesIndex;
use App\Livewire\Admin\Products\Form as AdminProductForm;
use App\Livewire\Admin\Products\Index as AdminProductsIndex;
use App\Livewire\Admin\Search\Settings as AdminSearchSettings;
use App\Livewire\Admin\Settings\Checkout as AdminSettingsCheckout;
use App\Livewire\Admin\Settings\Index as AdminSettingsIndex;
use App\Livewire\Admin\Settings\Notifications as AdminSettingsNotifications;
use App\Livewire\Admin\Settings\Shipping as AdminSettingsShipping;
use App\Livewire\Admin\Settings\Taxes as AdminSettingsTaxes;
use App\Livewire\Admin\Themes\Editor as AdminThemeEditor;
use App\Livewire\Admin\Themes\Index as AdminThemesIndex;
use App\Livewire\Storefront\Account\Auth\ForgotPassword as CustomerForgotPassword;
use App\Livewire\Storefront\Account\Auth\Login as CustomerLogin;
use App\Livewire\Storefront\Account\Auth\Register as CustomerRegister;
use App\Livewire\Storefront\Account\Auth\ResetPassword as CustomerResetPassword;
use App\Livewire\Storefront\Account\Orders\Index as CustomerOrdersIndex;
use App\Livewire\Storefront\Account\Orders\Show as CustomerOrderShow;
use App\Livewire\Storefront\Cart\Show as StorefrontCartShow;
use App\Livewire\Storefront\Checkout\Confirmation as StorefrontCheckoutConfirmation;
use App\Livewire\Storefront\Checkout\Show as StorefrontCheckoutShow;
use App\Livewire\Storefront\Collections\Index as StorefrontCollectionsIndex;
use App\Livewire\Storefront\Collections\Show as StorefrontCollectionShow;
use App\Livewire\Storefront\Home as StorefrontHome;
use App\Livewire\Storefront\Pages\Show as StorefrontPageShow;
use App\Livewire\Storefront\Products\Show as StorefrontProductShow;
use App\Livewire\Storefront\Search\Index as StorefrontSearchIndex;
use Illuminate\Support\Facades\Auth;
use Illuminate\Support\Facades\Route;
use Laravel\Fortify\Http\Controllers\NewPasswordController as FortifyNewPasswordController;
use Laravel\Fortify\Http\Controllers\PasswordResetLinkController as FortifyPasswordResetLinkController;

Route::middleware(['storefront'])->group(function (): void {
    Route::livewire('/', StorefrontHome::class)->name('home');
    Route::livewire('collections', StorefrontCollectionsIndex::class)->name('collections.index');
    Route::livewire('collections/{handle}', StorefrontCollectionShow::class)->name('collections.show');
    Route::livewire('products/{handle}', StorefrontProductShow::class)->name('products.show');
    Route::livewire('cart', StorefrontCartShow::class)->name('cart.show');
    Route::livewire('checkout', StorefrontCheckoutShow::class)->name('checkout.show');
    Route::livewire('checkout/confirmation/{order}', StorefrontCheckoutConfirmation::class)->name('checkout.confirmation');
    Route::livewire('search', StorefrontSearchIndex::class)->name('search.index');
    Route::livewire('pages/{handle}', StorefrontPageShow::class)->name('pages.show');
});

Route::livewire('admin/login', AdminLogin::class)
    ->middleware('guest')
    ->name('admin.login');

Route::get('admin/forgot-password', [FortifyPasswordResetLinkController::class, 'create'])
    ->middleware('guest')
    ->name('admin.password.request');

Route::post('admin/forgot-password', [FortifyPasswordResetLinkController::class, 'store'])
    ->middleware('guest')
    ->name('admin.password.email');

Route::get('admin/reset-password/{token}', [FortifyNewPasswordController::class, 'create'])
    ->middleware('guest')
    ->name('admin.password.reset');

Route::post('admin/reset-password', [FortifyNewPasswordController::class, 'store'])
    ->middleware('guest')
    ->name('admin.password.update');

Route::post('admin/logout', function () {
    Auth::guard('web')->logout();

    request()->session()->invalidate();
    request()->session()->regenerateToken();

    return redirect()->route('admin.login');
})->middleware('auth')->name('admin.logout');

Route::get('oauth/authorize', [OAuthController::class, 'authorize'])
    ->middleware('auth')
    ->name('oauth.authorize');

Route::post('oauth/token', [OAuthController::class, 'token'])
    ->name('oauth.token');

Route::middleware(['auth', EnsureUserEmailIsVerified::class, 'admin'])->prefix('admin')->name('admin.')->group(function (): void {
    Route::livewire('/', AdminDashboard::class)->name('dashboard');
    Route::livewire('analytics', AdminAnalyticsIndex::class)->name('analytics.index');
    Route::livewire('apps', AdminAppsIndex::class)->name('apps.index');
    Route::livewire('apps/{installation}', AdminAppShow::class)->name('apps.show');
    Route::livewire('developers', AdminDevelopersIndex::class)->name('developers.index');
    Route::livewire('products', AdminProductsIndex::class)->name('products.index');
    Route::livewire('products/create', AdminProductForm::class)->name('products.create');
    Route::livewire('products/{product}/edit', AdminProductForm::class)->name('products.edit');
    Route::livewire('inventory', AdminInventoryIndex::class)->name('inventory.index');
    Route::livewire('orders', AdminOrdersIndex::class)->name('orders.index');
    Route::livewire('orders/{order}', AdminOrderShow::class)->name('orders.show');
    Route::livewire('customers', AdminCustomersIndex::class)->name('customers.index');
    Route::livewire('customers/{customer}', AdminCustomerShow::class)->name('customers.show');
    Route::livewire('discounts', AdminDiscountsIndex::class)->name('discounts.index');
    Route::livewire('discounts/create', AdminDiscountForm::class)->name('discounts.create');
    Route::livewire('discounts/{discount}/edit', AdminDiscountForm::class)->name('discounts.edit');
    Route::livewire('pages', AdminPagesIndex::class)->name('pages.index');
    Route::livewire('pages/create', AdminPageForm::class)->name('pages.create');
    Route::livewire('pages/{page}/edit', AdminPageForm::class)->name('pages.edit');
    Route::livewire('navigation', AdminNavigationIndex::class)->name('navigation.index');
    Route::livewire('themes', AdminThemesIndex::class)->name('themes.index');
    Route::livewire('themes/{theme}/editor', AdminThemeEditor::class)->name('themes.editor');
    Route::livewire('settings', AdminSettingsIndex::class)->name('settings.index');
    Route::livewire('settings/shipping', AdminSettingsShipping::class)->name('settings.shipping');
    Route::livewire('settings/taxes', AdminSettingsTaxes::class)->name('settings.taxes');
    Route::livewire('settings/checkout', AdminSettingsCheckout::class)->name('settings.checkout');
    Route::livewire('settings/notifications', AdminSettingsNotifications::class)->name('settings.notifications');
    Route::livewire('search/settings', AdminSearchSettings::class)->name('search.settings');
    Route::livewire('collections', AdminCollectionsIndex::class)->name('collections.index');
    Route::livewire('collections/create', AdminCollectionForm::class)->name('collections.create');
    Route::livewire('collections/{collection}/edit', AdminCollectionForm::class)->name('collections.edit');
});

Route::middleware(['storefront'])->group(function (): void {
    Route::livewire('account/login', CustomerLogin::class)
        ->middleware('guest:customer')
        ->name('account.login');

    Route::livewire('account/register', CustomerRegister::class)
        ->middleware('guest:customer')
        ->name('account.register');

    Route::livewire('account/forgot-password', CustomerForgotPassword::class)
        ->middleware('guest:customer')
        ->name('account.password.request');

    Route::livewire('account/reset-password/{token}', CustomerResetPassword::class)
        ->middleware('guest:customer')
        ->name('account.password.reset');

    Route::livewire('account', CustomerOrdersIndex::class)
        ->middleware('auth:customer')
        ->name('account.dashboard');

    Route::livewire('account/orders/{order}', CustomerOrderShow::class)
        ->middleware('auth:customer')
        ->name('account.orders.show');
});

Route::redirect('dashboard', 'admin')
    ->middleware(['auth', 'verified'])
    ->name('dashboard');

require __DIR__.'/settings.php';


sed -n '80,130p' specs/09-IMPLEMENTATION-ROADMAP.md && sed -n '220,280p' specs/06-AUTH-AND-SECURITY.md && sed -n '1,180p' specs/08-PLAYWRIGHT-E2E-PLAN.md

| Config File | Setting | Value | Purpose |
|-------------|---------|-------|---------|
| `.env` | `DB_CONNECTION` | `sqlite` | Use SQLite as database |
| `.env` | `DB_DATABASE` | `database/database.sqlite` | SQLite database file path |
| `.env` | `CACHE_STORE` | `file` | File-based caching |
| `.env` | `SESSION_DRIVER` | `file` | File-based sessions |
| `.env` | `QUEUE_CONNECTION` | `sync` | Synchronous queue for dev |
| `.env` | `MAIL_MAILER` | `log` | Log-based mail for dev |
| `.env` | `FILESYSTEM_DISK` | `local` | Local filesystem storage |
| `config/database.php` | SQLite connection | WAL mode, foreign keys enabled, busy_timeout=5000, synchronous=normal | Optimized SQLite configuration |
| `config/session.php` | `driver` | `file` | Session driver |
| `config/session.php` | `lifetime` | `120` | Session lifetime in minutes |
| `config/cache.php` | `default` | `file` | Cache driver |
| `config/queue.php` | `default` | `sync` | Queue driver |
| `config/auth.php` | Guards | Add `customer` guard with `customers` provider | Customer storefront authentication |
| `config/auth.php` | Providers | Add `customers` provider pointing to Customer model | Customer user provider |
| `config/auth.php` | Passwords | Add `customers` password broker | Customer password reset |
| `config/filesystems.php` | `public` disk | Ensure configured for local storage | Media file storage |
| `config/logging.php` | Channels | Add structured JSON channel | Structured logging |

#### Step 1.2: Core Migrations (Batch 1-2)

Create in this dependency order:

1. `create_organizations_table` - no dependencies
2. `create_stores_table` - FK: `organization_id`
3. `create_store_domains_table` - FK: `store_id`
4. Modify default `users` migration - add `status`, `last_login_at`, `two_factor_*` columns; rename `password` to `password_hash` internally
5. `create_store_users_table` - composite PK: `store_id` + `user_id`, with `role` column
6. `create_store_settings_table` - PK: `store_id`

All monetary amounts stored as INTEGER in minor units (cents). All enums stored as TEXT with CHECK constraints. All timestamps as TEXT (ISO-8601) via Laravel.

#### Step 1.3: Core Models

**Files to create:**

| Type | Name | Purpose |
|------|------|---------|
| Model (with migration, factory, seeder) | `Organization` | Top-level tenant entity |
| Model (with migration, factory, seeder) | `Store` | Individual store within an organization |
| Model (with migration, factory, seeder) | `StoreDomain` | Domain mapping for a store |
| Model (pivot) | `StoreUser` | Pivot model with `role` attribute, custom Pivot class |
| Model (with migration, factory, seeder) | `StoreSettings` | Per-store configuration |

**Relationship definitions:**

| Model | Key Relationships |
|-------|-------------------|
| `Organization` | `hasMany(Store::class)` |
| `Store` | `belongsTo(Organization::class)`, `hasMany(StoreDomain::class)`, `belongsToMany(User::class)` through `store_users`, `hasOne(StoreSettings::class)` |
```mermaid
stateDiagram-v2
    [*] --> Created: Admin creates token in Developers section
    Created --> Active: Plain-text shown once, hash stored
    Active --> InUse: Token sent as Bearer header
    InUse --> Active: Request processed
    Active --> Revoked: Admin revokes token
    Active --> Expired: Expiration date reached
    Revoked --> [*]: Token row deleted
    Expired --> [*]: Token row deleted (cleanup job)
```

**Requirements:**

- Tokens are created in the admin panel, under the Developers section.
- Each token has: a human-readable name, an optional expiration date, and a list of abilities (scopes).
- On creation, the plain-text token (prefixed with `shop_`) is displayed exactly once. Only the SHA-256 hash is persisted.
- Tokens are sent as `Authorization: Bearer shop_xxxxxxxx`.
- Sanctum middleware validates the hash and resolves the associated user.
- Ability checks are performed per-endpoint (e.g., the products list endpoint requires `read-products`).
- Revoking a token deletes its row from the `personal_access_tokens` table.

#### Token Abilities (Scopes)

| Ability | Description |
|---------|-------------|
| `read-products` | List and view products |
| `write-products` | Create, update, delete products |
| `read-orders` | List and view orders |
| `write-orders` | Update orders, create fulfillments |
| `read-customers` | List and view customers |
| `write-customers` | Update customers |
| `read-collections` | List and view collections |
| `write-collections` | Create, update, delete collections |
| `read-discounts` | List and view discounts |
| `write-discounts` | Create, update, delete discounts |
| `read-analytics` | View analytics data |
| `read-settings` | View store settings (general, shipping, taxes, checkout, notifications) |
| `write-settings` | Update store settings (replaces the legacy `manage-store`, `manage-shipping`, `manage-taxes` scopes) |
| `read-themes` | View themes and theme files |
| `write-themes` | Create, update, delete, publish them…6632 chars truncated… $seed = true;` on the test class (or call `$this->seed(DatabaseSeeder::class)` in `beforeEach`) to ensure the database is populated after RefreshDatabase clears it. Laravel's `RefreshDatabase` trait does NOT automatically run seeders unless explicitly configured.

| Entity | Key Details | Used By Suites |
|--------|-------------|----------------|
| **Admin user** | Email: `admin@acme.test`, password: `password`, role: `owner` on Store 1 | 2, 3, 4, 5, 6, 12, 13, 15, 16, 17, 18 |
| **Customer user** | Email: `customer@acme.test`, password: `password`, name: "John Doe", belongs to Store 1 | 10, 12 |
| **Store 1** | Name: "Acme Fashion", handle: `acme-fashion`, domain: `acme-fashion.test`, currency: EUR | 1, 6, 7, 12, 14 |
| **Product #1** | Title: "Classic Cotton T-Shirt", handle: `classic-cotton-t-shirt`, price: 24.99 EUR, status: active, options: Size (S/M/L/XL), Color (Black/White/Navy), inventory: in stock | 1, 3, 7, 8, 9, 11, 13, 14 |
| **Product #2** | Title: "Premium Slim Fit Jeans", handle: `premium-slim-fit-jeans`, status: active, has compare-at pricing (sale), options: Size, Color | 7, 8 |
| **Product #15** | Status: `draft` - must NOT appear on storefront | 3, 7 |
| **Product #17** | Status: active, inventory: 0 on hand, policy: `deny` - displays "Sold out", add-to-cart disabled | 7, 11 |
| **Product #18** | Status: active, inventory: 0 on hand, policy: `continue` - displays "Available on backorder", add-to-cart enabled | 7, 11 |
| **Products (20 total)** | Seeded across collections, with variants, options, images, inventory | 1, 3, 7, 8, 9, 11, 13 |
| **Collections** | "T-Shirts" (handle: `t-shirts`), "New Arrivals" (handle: `new-arrivals`), plus others | 1, 7, 13, 15 |
| **Orders** | #1001 (status: paid, fulfillment: unfulfilled, customer: customer@acme.test), #1002, #1004 also belonging to the same customer | 4, 10, 16, 18 |
| **Discounts** | WELCOME10 (10% off, min 20 EUR purchase, active), FLAT5 (5 EUR fixed, active), FREESHIP (free shipping, active), EXPIRED20 (expired end date), MAXED (usage_count >= usage_limit) | 5, 8, 9 |
| **Shipping zones** | "Domestic" zone (countries: DE) with rate "Standard Shipping" at 4.99 EUR flat; "International" zone with its own rates | 6, 9 |
| **Tax settings** | Store 1: manual mode, prices_include_tax varies by test | 6 |
| **Pages** | "About" (handle: `about`, status: published) | 1, 7, 17 |
| **Navigation** | Main menu with links to collections, about page | 7 |

---

## Test Execution Matrix

Tests should be executed in the order shown below. Later suites depend on the infrastructure and pages verified by earlier suites.

```mermaid
graph TD
    S1[Suite 1: Smoke Tests] --> S2[Suite 2: Admin Auth]
    S1 --> S7[Suite 7: Storefront Browsing]
    S2 --> S3[Suite 3: Admin Products]
    S2 --> S4[Suite 4: Admin Orders]
    S2 --> S5[Suite 5: Admin Discounts]
    S2 --> S6[Suite 6: Admin Settings]
    S2 --> S15[Suite 15: Admin Collections]
    S2 --> S16[Suite 16: Admin Customers]
    S2 --> S17[Suite 17: Admin Pages]
    S2 --> S18[Suite 18: Admin Analytics]
    S7 --> S8[Suite 8: Cart Flow]
    S8 --> S9[Suite 9: Checkout Flow]
    S7 --> S10[Suite 10: Customer Account]
    S7 --> S11[Suite 11: Inventory Enforcement]
    S7 --> S12[Suite 12: Tenant Isolation]
    S7 --> S13[Suite 13: Responsive / Mobile]
    S7 --> S14[Suite 14: Accessibility]
```

| Execution Phase | Suites | Rationale |
|-----------------|--------|-----------|
| Phase 1 | Suite 1 (Smoke) | Verifies all routes load before deeper testing |
| Phase 2 | Suites 2, 7 | Core auth and storefront browsing - gate to all further tests |
| Phase 3 | Suites 3, 4, 5, 6, 10, 11, 15, 16, 17, 18 | Admin CRUD and storefront feature suites (can run in parallel) |
| Phase 4 | Suite 8 (Cart) | Depends on storefront browsing working |
| Phase 5 | Suite 9 (Checkout) | Depends on cart flow working. Tests payment method selection (credit card, PayPal, bank transfer), magic card declines, and bank transfer instructions. |
| Phase 6 | Suites 12, 13, 14 | Cross-cutting concerns: isolation, responsive, accessibility |

---

## Test Directory Structure

```
tests/Browser/
    SmokeTest.php
    Admin/
        AuthenticationTest.php
        ProductManagementTest.php
        OrderManagementTest.php
        DiscountManagementTest.php
        SettingsTest.php
        CollectionManagementTest.php
        CustomerManagementTest.php
        PageManagementTest.php
        AnalyticsTest.php
    Storefront/
        BrowsingTest.php
        CartTest.php
        CheckoutTest.php
        CustomerAccountTest.php
        InventoryTest.php
        TenantIsolationTest.php
        ResponsiveTest.php
        AccessibilityTest.php
```

---

## Suite 1: Smoke Tests

**File:** `tests/Browser/SmokeTest.php`

**Purpose:** Hit every major public and admin page, assert they load without JavaScript errors. This is the fastest way to catch broken routes, missing views, or uncaught JS exceptions.

---

### Test 1.1: Loads the storefront home page


rg -n "forgot-password|reset-password|password\.request|password\.reset|account\.password|admin\.password|Fortify|PasswordReset|ResetPassword|ForgotPassword" routes app resources tests -g '!vendor'

rg -n "forgot-password|reset-password|password\\.request|password\\.reset|account\\.password|admin\\.password|Fortify|PasswordReset|ResetPassword|ForgotPassword" routes app resources tests -g '!vendor'

Question: forgot-password|reset-password|password\.request|password\.reset|account\.password|admin\.password|Fortify|PasswordReset|ResetPassword|ForgotPassword

tests/Browser/SmokeTest.php:107:        '/account/forgot-password',
tests/Browser/SmokeTest.php:108:        '/account/reset-password/test-token?email=customer@example.test',
routes/web.php:33:use App\Livewire\Storefront\Account\Auth\ForgotPassword as CustomerForgotPassword;
routes/web.php:36:use App\Livewire\Storefront\Account\Auth\ResetPassword as CustomerResetPassword;
routes/web.php:50:use Laravel\Fortify\Http\Controllers\NewPasswordController as FortifyNewPasswordController;
routes/web.php:51:use Laravel\Fortify\Http\Controllers\PasswordResetLinkController as FortifyPasswordResetLinkController;
routes/web.php:69:Route::get('admin/forgot-password', [FortifyPasswordResetLinkController::class, 'create'])
routes/web.php:71:    ->name('admin.password.request');
routes/web.php:73:Route::post('admin/forgot-password', [FortifyPasswordResetLinkController::class, 'store'])
routes/web.php:75:    ->name('admin.password.email');
routes/web.php:77:Route::get('admin/reset-password/{token}', [FortifyNewPasswordController::class, 'create'])
routes/web.php:79:    ->name('admin.password.reset');
routes/web.php:81:Route::post('admin/reset-password', [FortifyNewPasswordController::class, 'store'])
routes/web.php:83:    ->name('admin.password.update');
routes/web.php:144:    Route::livewire('account/forgot-password', CustomerForgotPassword::class)
routes/web.php:146:        ->name('account.password.request');
routes/web.php:148:    Route::livewire('account/reset-password/{token}', CustomerResetPassword::class)
routes/web.php:150:        ->name('account.password.reset');
routes/settings.php:8:use Laravel\Fortify\Features;
app/Services/CustomerPasswordResetService.php:7:use App\Notifications\CustomerResetPassword;
app/Services/CustomerPasswordResetService.php:14:class CustomerPasswordResetService
app/Services/CustomerPasswordResetService.php:46:        $customer->notify(new CustomerResetPassword($token, $store));
app/Services/CustomerPasswordResetService.php:76:        event(new \Illuminate\Auth\Events\PasswordReset($customer));
app/Notifications/CustomerResetPassword.php:10:class CustomerResetPassword extends Notification
app/Notifications/CustomerResetPassword.php:34:        $resetUrl = route('account.password.reset', [
tests/Feature/Auth/PasswordResetTest.php:4:use Illuminate\Auth\Notifications\ResetPassword;
tests/Feature/Auth/PasswordResetTest.php:10:    $response = $this->get(route('password.request'));
tests/Feature/Auth/PasswordResetTest.php:20:    $this->post(route('password.request'), ['email' => $user->email]);
tests/Feature/Auth/PasswordResetTest.php:22:    Notification::assertSentTo($user, ResetPassword::class);
tests/Feature/Auth/PasswordResetTest.php:30:    $this->post(route('password.request'), ['email' => $user->email]);
tests/Feature/Auth/PasswordResetTest.php:32:    Notification::assertSentTo($user, ResetPassword::class, function ($notification) {
tests/Feature/Auth/PasswordResetTest.php:33:        $response = $this->get(route('password.reset', $notification->token));
tests/Feature/Auth/PasswordResetTest.php:45:    $this->get(route('admin.password.request'))
tests/Feature/Auth/PasswordResetTest.php:47:        ->assertSee(route('admin.password.email', absolute: false), false);
tests/Feature/Auth/PasswordResetTest.php:49:    $this->post(route('admin.password.email'), ['email' => $user->email]);
tests/Feature/Auth/PasswordResetTest.php:51:    Notification::assertSentTo($user, ResetPassword::class, function ($notification) use ($user) {
tests/Feature/Auth/PasswordResetTest.php:52:        $this->get(route('admin.password.reset', $notification->token).'?email='.$user->email)
tests/Feature/Auth/PasswordResetTest.php:54:            ->assertSee(route('admin.password.update', absolute: false), false);
tests/Feature/Auth/PasswordResetTest.php:56:        $this->post(route('admin.password.update'), [
tests/Feature/Auth/PasswordResetTest.php:72:    $this->post(route('password.request'), ['email' => $user->email]);
tests/Feature/Auth/PasswordResetTest.php:74:    Notification::assertSentTo($user, ResetPassword::class, function ($notification) use ($user) {
tests/Feature/Auth/CustomerPasswordResetTest.php:3:use App\Livewire\Storefront\Account\Auth\ForgotPassword as CustomerForgotPassword;
tests/Feature/Auth/CustomerPasswordResetTest.php:4:use App\Livewire\Storefront\Account\Auth\ResetPassword as CustomerResetPassword;
tests/Feature/Auth/CustomerPasswordResetTest.php:8:use App\Notifications\CustomerResetPassword as CustomerResetPasswordNotification;
tests/Feature/Auth/CustomerPasswordResetTest.php:9:use App\Services\CustomerPasswordResetService;
tests/Feature/Auth/CustomerPasswordResetTest.php:32:    $this->get('http://customer-reset.test/account/forgot-password')
tests/Feature/Auth/CustomerPasswordResetTest.php:37:    $this->get('http://customer-reset.test/account/reset-password/test-token?email=customer@example.test')
tests/Feature/Auth/CustomerPasswordResetTest.php:61:    Livewire::test(CustomerForgotPassword::class)
tests…1941 chars truncated…use Laravel\Fortify\Features;
app/Models/User.php:13:use Laravel\Fortify\TwoFactorAuthenticatable;
resources/views/livewire/auth/login.blade.php:35:                @if (Route::has('password.request'))
resources/views/livewire/auth/login.blade.php:36:                    <flux:link class="absolute top-0 text-sm end-0" :href="route('password.request')" wire:navigate>
app/Livewire/Storefront/Account/Auth/ForgotPassword.php:6:use App\Services\CustomerPasswordResetService;
app/Livewire/Storefront/Account/Auth/ForgotPassword.php:10:class ForgotPassword extends Component
app/Livewire/Storefront/Account/Auth/ForgotPassword.php:26:    public function send(CustomerPasswordResetService $passwords): void
app/Livewire/Storefront/Account/Auth/ForgotPassword.php:42:        return view('livewire.storefront.account.auth.forgot-password')
app/Livewire/Storefront/Account/Auth/ResetPassword.php:6:use App\Services\CustomerPasswordResetService;
app/Livewire/Storefront/Account/Auth/ResetPassword.php:10:class ResetPassword extends Component
app/Livewire/Storefront/Account/Auth/ResetPassword.php:35:    public function resetPassword(CustomerPasswordResetService $passwords): void
app/Livewire/Storefront/Account/Auth/ResetPassword.php:62:        return view('livewire.storefront.account.auth.reset-password')
app/Providers/FortifyServiceProvider.php:5:use App\Actions\Fortify\CreateNewUser;
app/Providers/FortifyServiceProvider.php:6:use App\Actions\Fortify\ResetUserPassword;
app/Providers/FortifyServiceProvider.php:11:use Laravel\Fortify\Fortify;
app/Providers/FortifyServiceProvider.php:13:class FortifyServiceProvider extends ServiceProvider
app/Providers/FortifyServiceProvider.php:34:     * Configure Fortify actions.
app/Providers/FortifyServiceProvider.php:38:        Fortify::resetUserPasswordsUsing(ResetUserPassword::class);
app/Providers/FortifyServiceProvider.php:39:        Fortify::createUsersUsing(CreateNewUser::class);
app/Providers/FortifyServiceProvider.php:43:     * Configure Fortify views.
app/Providers/FortifyServiceProvider.php:47:        Fortify::loginView(fn () => view('livewire.auth.login'));
app/Providers/FortifyServiceProvider.php:48:        Fortify::verifyEmailView(fn () => view('livewire.auth.verify-email'));
app/Providers/FortifyServiceProvider.php:49:        Fortify::twoFactorChallengeView(fn () => view('livewire.auth.two-factor-challenge'));
app/Providers/FortifyServiceProvider.php:50:        Fortify::confirmPasswordView(fn () => view('livewire.auth.confirm-password'));
app/Providers/FortifyServiceProvider.php:51:        Fortify::registerView(fn () => view('livewire.auth.register'));
app/Providers/FortifyServiceProvider.php:52:        Fortify::resetPasswordView(fn () => view('livewire.auth.reset-password'));
app/Providers/FortifyServiceProvider.php:53:        Fortify::requestPasswordResetLinkView(fn () => view('livewire.auth.forgot-password'));
resources/views/livewire/auth/forgot-password.blade.php:8:        <form method="POST" action="{{ request()->routeIs('admin.password.request') ? route('admin.password.email') : route('password.email') }}" class="flex flex-col gap-6">
resources/views/livewire/auth/forgot-password.blade.php:28:            <flux:link :href="request()->routeIs('admin.password.request') ? route('admin.login') : route('login')" wire:navigate>{{ __('log in') }}</flux:link>
app/Livewire/Settings/TwoFactor/RecoveryCodes.php:6:use Laravel\Fortify\Actions\GenerateNewRecoveryCodes;
app/Livewire/Settings/TwoFactor.php:6:use Laravel\Fortify\Actions\ConfirmTwoFactorAuthentication;
app/Livewire/Settings/TwoFactor.php:7:use Laravel\Fortify\Actions\DisableTwoFactorAuthentication;
app/Livewire/Settings/TwoFactor.php:8:use Laravel\Fortify\Actions\EnableTwoFactorAuthentication;
app/Livewire/Settings/TwoFactor.php:9:use Laravel\Fortify\Features;
app/Livewire/Settings/TwoFactor.php:10:use Laravel\Fortify\Fortify;
app/Livewire/Settings/TwoFactor.php:44:        if (Fortify::confirmsTwoFactorAuthentication() && is_null(auth()->user()->two_factor_confirmed_at)) {
resources/views/livewire/storefront/account/auth/reset-password.blade.php:33:        <flux:button variant="primary" type="submit" class="w-full" data-test="customer-reset-password-button">
resources/views/livewire/storefront/account/auth/login.blade.php:26:            <flux:link :href="route('account.password.request')" wire:navigate>{{ __('Forgot your password?') }}</flux:link>
resources/views/livewire/auth/reset-password.blade.php:8:        <form method="POST" action="{{ request()->routeIs('admin.password.reset') ? route('admin.password.update') : route('password.update') }}" class="flex flex-col gap-6">
resources/views/livewire/auth/reset-password.blade.php:46:                <flux:button type="submit" variant="primary" class="w-full" data-test="reset-password-button">
resources/views/livewire/storefront/account/auth/forgot-password.blade.php:21:        <flux:button variant="primary" type="submit" class="w-full" data-test="customer-forgot-password-button">


Output:
Chunk ID: 43b0f6
Wall time: 0.0000 seconds
Process exited with code 0
Original token count: 2986
Output:
tests/Browser/SmokeTest.php:107:        '/account/forgot-password',
tests/Browser/SmokeTest.php:108:        '/account/reset-password/test-token?email=customer@example.test',
routes/web.php:33:use App\Livewire\Storefront\Account\Auth\ForgotPassword as CustomerForgotPassword;
routes/web.php:36:use App\Livewire\Storefront\Account\Auth\ResetPassword as CustomerResetPassword;
routes/web.php:50:use Laravel\Fortify\Http\Controllers\NewPasswordController as FortifyNewPasswordController;
routes/web.php:51:use Laravel\Fortify\Http\Controllers\PasswordResetLinkController as FortifyPasswordResetLinkController;
routes/web.php:69:Route::get('admin/forgot-password', [FortifyPasswordResetLinkController::class, 'create'])
routes/web.php:71:    ->name('admin.password.request');
routes/web.php:73:Route::post('admin/forgot-password', [FortifyPasswordResetLinkController::class, 'store'])
routes/web.php:75:    ->name('admin.password.email');
routes/web.php:77:Route::get('admin/reset-password/{token}', [FortifyNewPasswordController::class, 'create'])
routes/web.php:79:    ->name('admin.password.reset');
routes/web.php:81:Route::post('admin/reset-password', [FortifyNewPasswordController::class, 'store'])
routes/web.php:83:    ->name('admin.password.update');
routes/web.php:144:    Route::livewire('account/forgot-password', CustomerForgotPassword::class)
routes/web.php:146:        ->name('account.password.request');
routes/web.php:148:    Route::livewire('account/reset-password/{token}', CustomerResetPassword::class)
routes/web.php:150:        ->name('account.password.reset');
routes/settings.php:8:use Laravel\Fortify\Features;
app/Services/CustomerPasswordResetService.php:7:use App\Notifications\CustomerResetPassword;
app/Services/CustomerPasswordResetService.php:14:class CustomerPasswordResetService
app/Services/CustomerPasswordResetService.php:46:        $customer->notify(new CustomerResetPassword($token, $store));
app/Services/CustomerPasswordResetService.php:76:        event(new \Illuminate\Auth\Events\PasswordReset($customer));
app/Notifications/CustomerResetPassword.php:10:class CustomerResetPassword extends Notification
app/Notifications/CustomerResetPassword.php:34:        $resetUrl = route('account.password.reset', [
tests/Feature/Auth/PasswordResetTest.php:4:use Illuminate\Auth\Notifications\ResetPassword;
tests/Feature/Auth/PasswordResetTest.php:10:    $response = $this->get(route('password.request'));
tests/Feature/Auth/PasswordResetTest.php:20:    $this->post(route('password.request'), ['email' => $user->email]);
tests/Feature/Auth/PasswordResetTest.php:22:    Notification::assertSentTo($user, ResetPassword::class);
tests/Feature/Auth/PasswordResetTest.php:30:    $this->post(route('password.request'), ['email' => $user->email]);
tests/Feature/Auth/PasswordResetTest.php:32:    Notification::assertSentTo($user, ResetPassword::class, function ($notification) {
tests/Feature/Auth/PasswordResetTest.php:33:        $response = $this->get(route('password.reset', $notification->token));
tests/Feature/Auth/PasswordResetTest.php:45:    $this->get(route('admin.password.request'))
tests/Feature/Auth/PasswordResetTest.php:47:        ->assertSee(route('admin.password.email', absolute: false), false);
tests/Feature/Auth/PasswordResetTest.php:49:    $this->post(route('admin.password.email'), ['email' => $user->email]);
tests/Feature/Auth/PasswordResetTest.php:51:    Notification::assertSentTo($user, ResetPassword::class, function ($notification) use ($user) {
tests/Feature/Auth/PasswordResetTest.php:52:        $this->get(route('admin.password.reset', $notification->token).'?email='.$user->email)
tests/Feature/Auth/PasswordResetTest.php:54:            ->assertSee(route('admin.password.update', absolute: false), false);
tests/Feature/Auth/PasswordResetTest.php:56:        $this->post(route('admin.password.update'), [
tests/Feature/Auth/PasswordResetTest.php:72:    $this->post(route('password.request'), ['email' => $user->email]);
tests/Feature/Auth/PasswordResetTest.php:74:    Notification::assertSentTo($user, ResetPassword::class, function ($notification) use ($user) {
tests/Feature/Auth/CustomerPasswordResetTest.php:3:use App\Livewire\Storefront\Account\Auth\ForgotPassword as CustomerForgotPassword;
tests/Feature/Auth/CustomerPasswordResetTest.php:4:use App\Livewire\Storefront\Account\Auth\ResetPassword as CustomerResetPassword;
tests/Feature/Auth/CustomerPasswordResetTest.php:8:use App\Notifications\CustomerResetPassword as CustomerResetPasswordNotification;
tests/Feature/Auth/CustomerPasswordResetTest.php:9:use App\Services\CustomerPasswordResetService;
tests/Feature/Auth/CustomerPasswordResetTest.php:32:    $this->get('http://customer-reset.test/account/forgot-password')
tests/Feature/Auth/CustomerPasswordResetTest.php:37:    $this->get('http://customer-reset.test/account/reset-password/test-token?email=customer@example.test')
tests/Feature/Auth/CustomerPasswordResetTest.php:61:    Livewire::test(CustomerForgotPassword::class)
tests/Feature/Auth/CustomerPasswordResetTest.php:69:        CustomerResetPasswordNotification::class,
tests/Feature/Auth/CustomerPasswordResetTest.php:70:        fn (CustomerResetPasswordNotification $notification): bool => strlen($notification->token) === 64
tests/Feature/Auth/CustomerPasswordResetTest.php:74:    Notification::assertNotSentTo($otherCustomer, CustomerResetPasswordNotification::class);
tests/Feature/Auth/CustomerPasswordResetTest.php:94:    Livewire::test(CustomerForgotPassword::class)
tests/Feature/Auth/CustomerPasswordResetTest.php:117:    app(CustomerPasswordResetService::class)->sendResetLink($store, $customer->email);
tests/Feature/Auth/CustomerPasswordResetTest.php:123:        CustomerResetPasswordNotification::class,
tests/Feature/Auth/CustomerPasswordResetTest.php:124:        function (CustomerResetPasswordNotification $notification) use (&$token): bool {
tests/Feature/Auth/CustomerPasswordResetTest.php:131:    Livewire::test(CustomerResetPassword::class, ['token' => $token])
tests/Feature/Auth/CustomerPasswordResetTest.php:179:    Livewire::test(CustomerResetPassword::class, ['token' => 'valid-token'])
tests/Feature/Auth/CustomerPasswordResetTest.php:195:    Livewire::test(CustomerResetPassword::class, ['token' => 'valid-token'])
tests/Feature/Settings/TwoFactorAuthenticationTest.php:4:use Laravel\Fortify\Features;
tests/Feature/Auth/AuthenticationTest.php:4:use Laravel\Fortify\Features;
app/Actions/Fortify/CreateNewUser.php:3:namespace App\Actions\Fortify;
app/Actions/Fortify/CreateNewUser.php:9:use Laravel\Fortify\Contracts\CreatesNewUsers;
app/Actions/Fortify/ResetUserPassword.php:3:namespace App\Actions\Fortify;
app/Actions/Fortify/ResetUserPassword.php:8:use Laravel\Fortify\Contracts\ResetsUserPasswords;
resources/views/components/settings/layout.blade.php:6:            @if (Laravel\Fortify\Features::canManageTwoFactorAuthentication())
tests/Feature/Auth/TwoFactorChallengeTest.php:4:use Laravel\Fortify\Features;
app/Models/User.php:13:use Laravel\Fortify\TwoFactorAuthenticatable;
resources/views/livewire/auth/login.blade.php:35:                @if (Route::has('password.request'))
resources/views/livewire/auth/login.blade.php:36:                    <flux:link class="absolute top-0 text-sm end-0" :href="route('password.request')" wire:navigate>
app/Livewire/Storefront/Account/Auth/ForgotPassword.php:6:use App\Services\CustomerPasswordResetService;
app/Livewire/Storefront/Account/Auth/ForgotPassword.php:10:class ForgotPassword extends Component
app/Livewire/Storefront/Account/Auth/ForgotPassword.php:26:    public function send(CustomerPasswordResetService $passwords): void
app/Livewire/Storefront/Account/Auth/ForgotPassword.php:42:        return view('livewire.storefront.account.auth.forgot-password')
app/Livewire/Storefront/Account/Auth/ResetPassword.php:6:use App\Services\CustomerPasswordResetService;
app/Livewire/Storefront/Account/Auth/ResetPassword.php:10:class ResetPassword extends Component
app/Livewire/Storefront/Account/Auth/ResetPassword.php:35:    public function resetPassword(CustomerPasswordResetService $passwords): void
app/Livewire/Storefront/Account/Auth/ResetPassword.php:62:        return view('livewire.storefront.account.auth.reset-password')
app/Providers/FortifyServiceProvider.php:5:use App\Actions\Fortify\CreateNewUser;
app/Providers/FortifyServiceProvider.php:6:use App\Actions\Fortify\ResetUserPassword;
app/Providers/FortifyServiceProvider.php:11:use Laravel\Fortify\Fortify;
app/Providers/FortifyServiceProvider.php:13:class FortifyServiceProvider extends ServiceProvider
app/Providers/FortifyServiceProvider.php:34:     * Configure Fortify actions.
app/Providers/FortifyServiceProvider.php:38:        Fortify::resetUserPasswordsUsing(ResetUserPassword::class);
app/Providers/FortifyServiceProvider.php:39:        Fortify::createUsersUsing(CreateNewUser::class);
app/Providers/FortifyServiceProvider.php:43:     * Configure Fortify views.
app/Providers/FortifyServiceProvider.php:47:        Fortify::loginView(fn () => view('livewire.auth.login'));
app/Providers/FortifyServiceProvider.php:48:        Fortify::verifyEmailView(fn () => view('livewire.auth.verify-email'));
app/Providers/FortifyServiceProvider.php:49:        Fortify::twoFactorChallengeView(fn () => view('livewire.auth.two-factor-challenge'));
app/Providers/FortifyServiceProvider.php:50:        Fortify::confirmPasswordView(fn () => view('livewire.auth.confirm-password'));
app/Providers/FortifyServiceProvider.php:51:        Fortify::registerView(fn () => view('livewire.auth.register'));
app/Providers/FortifyServiceProvider.php:52:        Fortify::resetPasswordView(fn () => view('livewire.auth.reset-password'));
app/Providers/FortifyServiceProvider.php:53:        Fortify::requestPasswordResetLinkView(fn () => view('livewire.auth.forgot-password'));
resources/views/livewire/auth/forgot-password.blade.php:8:        <form method="POST" action="{{ request()->routeIs('admin.password.request') ? route('admin.password.email') : route('password.email') }}" class="flex flex-col gap-6">
resources/views/livewire/auth/forgot-password.blade.php:28:            <flux:link :href="request()->routeIs('admin.password.request') ? route('admin.login') : route('login')" wire:navigate>{{ __('log in') }}</flux:link>
app/Livewire/Settings/TwoFactor/RecoveryCodes.php:6:use Laravel\Fortify\Actions\GenerateNewRecoveryCodes;
app/Livewire/Settings/TwoFactor.php:6:use Laravel\Fortify\Actions\ConfirmTwoFactorAuthentication;
app/Livewire/Settings/TwoFactor.php:7:use Laravel\Fortify\Actions\DisableTwoFactorAuthentication;
app/Livewire/Settings/TwoFactor.php:8:use Laravel\Fortify\Actions\EnableTwoFactorAuthentication;
app/Livewire/Settings/TwoFactor.php:9:use Laravel\Fortify\Features;
app/Livewire/Settings/TwoFactor.php:10:use Laravel\Fortify\Fortify;
app/Livewire/Settings/TwoFactor.php:44:        if (Fortify::confirmsTwoFactorAuthentication() && is_null(auth()->user()->two_factor_confirmed_at)) {
resources/views/livewire/storefront/account/auth/reset-password.blade.php:33:        <flux:button variant="primary" type="submit" class="w-full" data-test="customer-reset-password-button">
resources/views/livewire/storefront/account/auth/login.blade.php:26:            <flux:link :href="route('account.password.request')" wire:navigate>{{ __('Forgot your password?') }}</flux:link>
resources/views/livewire/auth/reset-password.blade.php:8:        <form method="POST" action="{{ request()->routeIs('admin.password.reset') ? route('admin.password.update') : route('password.update') }}" class="flex flex-col gap-6">
resources/views/livewire/auth/reset-password.blade.php:46:                <flux:button type="submit" variant="primary" class="w-full" data-test="reset-password-button">
resources/views/livewire/storefront/account/auth/forgot-password.blade.php:21:        <flux:button variant="primary" type="submit" class="w-full" data-test="customer-forgot-password-button">


Output:
Chunk ID: 2aec85
Wall time: 0.0000 seconds
Process exited with code 0
Original token count: 4158
Output:
| Config File | Setting | Value | Purpose |
|-------------|---------|-------|---------|
| `.env` | `DB_CONNECTION` | `sqlite` | Use SQLite as database |
| `.env` | `DB_DATABASE` | `database/database.sqlite` | SQLite database file path |
| `.env` | `CACHE_STORE` | `file` | File-based caching |
| `.env` | `SESSION_DRIVER` | `file` | File-based sessions |
| `.env` | `QUEUE_CONNECTION` | `sync` | Synchronous queue for dev |
| `.env` | `MAIL_MAILER` | `log` | Log-based mail for dev |
| `.env` | `FILESYSTEM_DISK` | `local` | Local filesystem storage |
| `config/database.php` | SQLite connection | WAL mode, foreign keys enabled, busy_timeout=5000, synchronous=normal | Optimized SQLite configuration |
| `config/session.php` | `driver` | `file` | Session driver |
| `config/session.php` | `lifetime` | `120` | Session lifetime in minutes |
| `config/cache.php` | `default` | `file` | Cache driver |
| `config/queue.php` | `default` | `sync` | Queue driver |
| `config/auth.php` | Guards | Add `customer` guard with `customers` provider | Customer storefront authentication |
| `config/auth.php` | Providers | Add `customers` provider pointing to Customer model | Customer user provider |
| `config/auth.php` | Passwords | Add `customers` password broker | Customer password reset |
| `config/filesystems.php` | `public` disk | Ensure configured for local storage | Media file storage |
| `config/logging.php` | Channels | Add structured JSON channel | Structured logging |

#### Step 1.2: Core Migrations (Batch 1-2)

Create in this dependency order:

1. `create_organizations_table` - no dependencies
2. `create_stores_table` - FK: `organization_id`
3. `create_store_domains_table` - FK: `store_id`
4. Modify default `users` migration - add `status`, `last_login_at`, `two_factor_*` columns; rename `password` to `password_hash` internally
5. `create_store_users_table` - composite PK: `store_id` + `user_id`, with `role` column
6. `create_store_settings_table` - PK: `store_id`

All monetary amounts stored as INTEGER in minor units (cents). All enums stored as TEXT with CHECK constraints. All timestamps as TEXT (ISO-8601) via Laravel.

#### Step 1.3: Core Models

**Files to create:**

| Type | Name | Purpose |
|------|------|---------|
| Model (with migration, factory, seeder) | `Organization` | Top-level tenant entity |
| Model (with migration, factory, seeder) | `Store` | Individual store within an organization |
| Model (with migration, factory, seeder) | `StoreDomain` | Domain mapping for a store |
| Model (pivot) | `StoreUser` | Pivot model with `role` attribute, custom Pivot class |
| Model (with migration, factory, seeder) | `StoreSettings` | Per-store configuration |

**Relationship definitions:**

| Model | Key Relationships |
|-------|-------------------|
| `Organization` | `hasMany(Store::class)` |
| `Store` | `belongsTo(Organization::class)`, `hasMany(StoreDomain::class)`, `belongsToMany(User::class)` through `store_users`, `hasOne(StoreSettings::class)` |
```mermaid
stateDiagram-v2
    [*] --> Created: Admin creates token in Developers section
    Created --> Active: Plain-text shown once, hash stored
    Active --> InUse: Token sent as Bearer header
    InUse --> Active: Request processed
    Active --> Revoked: Admin revokes token
    Active --> Expired: Expiration date reached
    Revoked --> [*]: Token row deleted
    Expired --> [*]: Token row deleted (cleanup job)
```

**Requirements:**

- Tokens are created in the admin panel, under the Developers section.
- Each token has: a human-readable name, an optional expiration date, and a list of abilities (scopes).
- On creation, the plain-text token (prefixed with `shop_`) is displayed exactly once. Only the SHA-256 hash is persisted.
- Tokens are sent as `Authorization: Bearer shop_xxxxxxxx`.
- Sanctum middleware validates the hash and resolves the associated user.
- Ability checks are performed per-endpoint (e.g., the products list endpoint requires `read-products`).
- Revoking a token deletes its row from the `personal_access_tokens` table.

#### Token Abilities (Scopes)

| Ability | Description |
|---------|-------------|
| `read-products` | List and view products |
| `write-products` | Create, update, delete products |
| `read-orders` | List and view orders |
| `write-orders` | Update orders, create fulfillments |
| `read-customers` | List and view customers |
| `write-customers` | Update customers |
| `read-collections` | List and view collections |
| `write-collections` | Create, update, delete collections |
| `read-discounts` | List and view discounts |
| `write-discounts` | Create, update, delete discounts |
| `read-analytics` | View analytics data |
| `read-settings` | View store settings (general, shipping, taxes, checkout, notifications) |
| `write-settings` | Update store settings (replaces the legacy `manage-store`, `manage-shipping`, `manage-taxes` scopes) |
| `read-themes` | View themes and theme files |
| `write-themes` | Create, update, delete, publish themes |
| `read-content` | View pages and navigation menus |
| `write-content` | Create, update, delete pages and navigation items |
| `manage-platform` | Platform-level management (super-admin only) |

Each API endpoint must check the token's abilities before processing the request. If the token lacks the required ability, the endpoint returns `403 Forbidden`.

---

### 1.4 Guard Configuration

File to configure: `config/auth.php`

#### Guards Data Dictionary

| Guard Name | Driver | Provider | Purpose |
|------------|--------|----------|---------|
| `web` | session | `users` | Admin panel session auth (default guard) |
| `customer` | session | `customers` | Storefront customer session auth |
| `sanctum` | sanctum | `users` | Admin REST API token auth |

# 08 - Playwright E2E Test Plan

> Complete end-to-end browser test specification for the e-commerce platform using Pest v4 browser testing (Playwright-backed). All tests verify the entire application works through a real browser. This document defines requirements and specifications for the coding agent to implement.

---

## Test Suite Summary

| Suite | File | Tests | Purpose | Dependencies |
|-------|------|:-----:|---------|--------------|
| 1 - Smoke Tests | `tests/Browser/SmokeTest.php` | 10 | Hit every major page, assert HTTP 200 and no JS errors | Store 1, Products, Collections, Pages |
| 2 - Admin Authentication | `tests/Browser/Admin/AuthenticationTest.php` | 10 | Admin login, logout, invalid credentials, session access control | Admin user |
| 3 - Admin Product Management | `tests/Browser/Admin/ProductManagementTest.php` | 7 | Product CRUD: listing, creating, editing, archiving, filtering | Admin user, Products (incl. #15 draft) |
| 4 - Admin Order Management | `tests/Browser/Admin/OrderManagementTest.php` | 11 | Order listing, filtering, detail view, fulfillment, refund, confirm payment, fulfillment guard, mark shipped/delivered | Admin user, Orders (#1001, #1005), Customer |
| 5 - Admin Discount Management | `tests/Browser/Admin/DiscountManagementTest.php` | 6 | Discount code listing, creation, editing | Admin user, Discounts |
| 6 - Admin Settings | `tests/Browser/Admin/SettingsTest.php` | 7 | Store settings, shipping zones, tax config, domains | Admin user, Shipping zones, Store 1 |
| 7 - Storefront Browsing | `tests/Browser/Storefront/BrowsingTest.php` | 15 | Home page, collections, product detail, variants, search, pages | Products, Collections, Pages, Products #15/#17/#18 |
| 8 - Cart Flow | `tests/Browser/Storefront/CartTest.php` | 12 | Cart lifecycle: add, update qty, remove, discounts, totals | Products, Discounts (all codes) |
| 9 - Checkout Flow | `tests/Browser/Storefront/CheckoutTest.php` | 13 | Full checkout: contact, address, shipping, payment method selection, payment, confirmation, magic card decline, bank transfer flow | Products, Shipping zones, Discounts |
| 10 - Customer Account | `tests/Browser/Storefront/CustomerAccountTest.php` | 12 | Registration, login, order history, addresses, logout | Customer user, Orders (#1001/#1002/#1004) |
| 11 - Inventory Enforcement | `tests/Browser/Storefront/InventoryTest.php` | 4 | Inventory policy enforcement: deny vs. continue | Products #17 (deny), #18 (continue), #1 |
| 12 - Tenant Isolation | `tests/Browser/Storefront/TenantIsolationTest.php` | 5 | Multi-store data isolation verification | Store 1, Admin user, Customer user |
| 13 - Responsive / Mobile | `tests/Browser/Storefront/ResponsiveTest.php` | 8 | Mobile and tablet viewport rendering and interaction | Products, Admin user |
| 14 - Accessibility | `tests/Browser/Storefront/AccessibilityTest.php` | 11 | Heading hierarchy, ARIA labels, form labels, keyboard nav | Products, Store 1 |
| 15 - Admin Collections | `tests/Browser/Admin/CollectionManagementTest.php` | 3 | Collection CRUD in admin | Admin user, Collections |
| 16 - Admin Customers | `tests/Browser/Admin/CustomerManagementTest.php` | 3 | Customer listing and detail views | Admin user, Customer user, Orders |
| 17 - Admin Pages | `tests/Browser/Admin/PageManagementTest.php` | 3 | CMS page management | Admin user, Pages |
| 18 - Admin Analytics | `tests/Browser/Admin/AnalyticsTest.php` | 3 | Analytics dashboard rendering | Admin user, Orders |
| **Total** | **18 files** | **143** | | |

---

## Test Infrastructure Requirements

### Framework

- **Test runner:** Pest v4 with browser testing capabilities (Playwright under the hood)
- **Test traits:** Each browser test file must use `TestCase` and `RefreshDatabase`
- **Configuration:** Register the `Browser` test directory in `tests/Pest.php` with appropriate base classes
- **Base URL:** Configured via `APP_URL` in `.env.testing`, set to `http://acme-fashion.test`

### Pest v4 Browser Testing API Reference

The coding agent should use these Pest v4 browser methods:

| Method | Purpose |
|--------|---------|
| `visit(url)` | Open a real browser and navigate to the given URL |
| `visit([url1, url2, ...])` | Visit multiple pages (for batch smoke testing) |
| `fill(field, value)` | Type a value into a named form field |
| `click(text)` | Click a visible element matching the given text |
| `assertSee(text)` | Assert the page contains the given visible text |
| `assertNoJavascriptErrors()` | Assert no uncaught JS exceptions occurred |
| `assertNoConsoleLogs()` | Assert no console warnings or errors were logged |

Additionally, standard Laravel test features are available within browser tests: factories, `Event::fake()`, `Notification::fake()`, `$this->actingAs()`, and model queries.

### Environment Configuration

The `.env.testing` file must contain the following keys:

| Key | Value | Purpose |
|-----|-------|---------|
| `APP_ENV` | `testing` | Laravel environment |
| `APP_URL` | `http://acme-fashion.test` | Browser base URL (served by Herd) |
| `DB_CONNECTION` | `sqlite` | Database driver |
| `DB_DATABASE` | Absolute path to test SQLite file | Isolated test database |
| `PAYMENT_PROVIDER` | `mock` | Mock PSP - no external API keys needed |
| `MAIL_MAILER` | `array` | Trap emails in memory |
| `QUEUE_CONNECTION` | `sync` | Process jobs synchronously |

### Prerequisites Before Running

1. Database seeded with `php artisan migrate:fresh --seed`
2. Laravel Herd serving `acme-fashion.test`
3. Playwright browsers installed via `npx playwright install`
4. Frontend assets built via `npm run build`

---

## Seeded Data Dependency Table

All tests depend on the database seeder providing this baseline data. Each test gets a fresh database via `RefreshDatabase`, then the seeder repopulates it.

Each browser test file must set `protected bool $seed = true;` on the test class (or call `$this->seed(DatabaseSeeder::class)` in `beforeEach`) to ensure the database is populated after RefreshDatabase clears it. Laravel's `RefreshDatabase` trait does NOT automatically run seeders unless explicitly configured.

| Entity | Key Details | Used By Suites |
|--------|-------------|----------------|
| **Admin user** | Email: `admin@acme.test`, password: `password`, role: `owner` on Store 1 | 2, 3, 4, 5, 6, 12, 13, 15, 16, 17, 18 |
| **Customer user** | Email: `customer@acme.test`, password: `password`, name: "John Doe", belongs to Store 1 | 10, 12 |
| **Store 1** | Name: "Acme Fashion", handle: `acme-fashion`, domain: `acme-fashion.test`, currency: EUR | 1, 6, 7, 12, 14 |
| **Product #1** | Title: "Classic Cotton T-Shirt", handle: `classic-cotton-t-shirt`, price: 24.99 EUR, status: active, options: Size (S/M/L/XL), Color (Black/White/Navy), inventory: in stock | 1, 3, 7, 8, 9, 11, 13, 14 |
| **Product #2** | Title: "Premium Slim Fit Jeans", handle: `premium-slim-fit-jeans`, status: active, has compare-at pricing (sale), options: Size, Color | 7, 8 |
| **Product #15** | Status: `draft` - must NOT appear on storefront | 3, 7 |
| **Product #17** | Status: active, inventory: 0 on hand, policy: `deny` - displays "Sold out", add-to-cart disabled | 7, 11 |
| **Product #18** | Status: active, inventory: 0 on hand, policy: `continue` - displays "Available on backorder", add-to-cart enabled | 7, 11 |
| **Products (20 total)** | Seeded across collections, with variants, options, images, inventory | 1, 3, 7, 8, 9, 11, 13 |
| **Collections** | "T-Shirts" (handle: `t-shirts`), "New Arrivals" (handle: `new-arrivals`), plus others | 1, 7, 13, 15 |
| **Orders** | #1001 (status: paid, fulfillment: unfulfilled, customer: customer@acme.test), #1002, #1004 also belonging to the same customer | 4, 10, 16, 18 |
| **Discounts** | WELCOME10 (10% off, min 20 EUR purchase, active), FLAT5 (5 EUR fixed, active), FREESHIP (free shipping, active), EXPIRED20 (expired end date), MAXED (usage_count >= usage_limit) | 5, 8, 9 |
| **Shipping zones** | "Domestic" zone (countries: DE) with rate "Standard Shipping" at 4.99 EUR flat; "International" zone with its own rates | 6, 9 |
| **Tax settings** | Store 1: manual mode, prices_include_tax varies by test | 6 |
| **Pages** | "About" (handle: `about`, status: published) | 1, 7, 17 |
| **Navigation** | Main menu with links to collections, about page | 7 |

---

## Test Execution Matrix

Tests should be executed in the order shown below. Later suites depend on the infrastructure and pages verified by earlier suites.

```mermaid
graph TD
    S1[Suite 1: Smoke Tests] --> S2[Suite 2: Admin Auth]
    S1 --> S7[Suite 7: Storefront Browsing]
    S2 --> S3[Suite 3: Admin Products]
    S2 --> S4[Suite 4: Admin Orders]
    S2 --> S5[Suite 5: Admin Discounts]
    S2 --> S6[Suite 6: Admin Settings]
    S2 --> S15[Suite 15: Admin Collections]
    S2 --> S16[Suite 16: Admin Customers]
    S2 --> S17[Suite 17: Admin Pages]
    S2 --> S18[Suite 18: Admin Analytics]
    S7 --> S8[Suite 8: Cart Flow]
    S8 --> S9[Suite 9: Checkout Flow]
    S7 --> S10[Suite 10: Customer Account]
    S7 --> S11[Suite 11: Inventory Enforcement]
    S7 --> S12[Suite 12: Tenant Isolation]
    S7 --> S13[Suite 13: Responsive / Mobile]
    S7 --> S14[Suite 14: Accessibility]
```

| Execution Phase | Suites | Rationale |
|-----------------|--------|-----------|
| Phase 1 | Suite 1 (Smoke) | Verifies all routes load before deeper testing |
| Phase 2 | Suites 2, 7 | Core auth and storefront browsing - gate to all further tests |
| Phase 3 | Suites 3, 4, 5, 6, 10, 11, 15, 16, 17, 18 | Admin CRUD and storefront feature suites (can run in parallel) |
| Phase 4 | Suite 8 (Cart) | Depends on storefront browsing working |
| Phase 5 | Suite 9 (Checkout) | Depends on cart flow working. Tests payment method selection (credit card, PayPal, bank transfer), magic card declines, and bank transfer instructions. |
| Phase 6 | Suites 12, 13, 14 | Cross-cutting concerns: isolation, responsive, accessibility |

---

## Test Directory Structure

```
tests/Browser/
    SmokeTest.php
    Admin/
        AuthenticationTest.php
        ProductManagementTest.php
        OrderManagementTest.php
        DiscountManagementTest.php
        SettingsTest.php
        CollectionManagementTest.php
        CustomerManagementTest.php
        PageManagementTest.php
        AnalyticsTest.php
    Storefront/
        BrowsingTest.php
        CartTest.php
        CheckoutTest.php
        CustomerAccountTest.php
        InventoryTest.php
        TenantIsolationTest.php
        ResponsiveTest.php
        AccessibilityTest.php
```

---

## Suite 1: Smoke Tests

**File:** `tests/Browser/SmokeTest.php`

**Purpose:** Hit every major public and admin page, assert they load without JavaScript errors. This is the fastest way to catch broken routes, missing views, or uncaught JS exceptions.

---

### Test 1.1: Loads the storefront home page


php artisan route:list --path=forgot-password --except-vendor


php artisan route:list --path=reset-password --except-vendor


sed -n '1,260p' tests/Feature/Auth/PasswordResetTest.php && sed -n '1,260p' tests/Feature/Auth/CustomerPasswordResetTest.php


sed -n '1,160p' app/Providers/FortifyServiceProvider.php && sed -n '1,140p' config/fortify.php