Output:
Chunk ID: a88423
Wall time: 0.0000 seconds
Process exited with code 0
Original token count: 447
Output:
<?php

use Illuminate\Database\Migrations\Migration;
use Illuminate\Database\Schema\Blueprint;
use Illuminate\Support\Facades\Schema;

return new class extends Migration
{
    /**
     * Run the migrations.
     */
    public function up(): void
    {
        Schema::create('oauth_tokens', function (Blueprint $table) {
            $table->id();
            $table->foreignId('installation_id')->constrained('app_installations')->cascadeOnDelete();
            $table->string('name')->nullable();
            $table->string('access_token_hash')->unique('idx_oauth_tokens_access_hash');
            $table->string('refresh_token_hash')->nullable();
            $table->json('abilities_json')->default('[]');
            $table->timestamp('expires_at');
            $table->timestamp('last_used_at')->nullable();
            $table->timestamp('created_at')->nullable();

            $table->index('installation_id', 'idx_oauth_tokens_installation_id');
            $table->index('expires_at', 'idx_oauth_tokens_expires_at');
        });
    }

    /**
     * Reverse the migrations.
     */
    public function down(): void
    {
        Schema::dropIfExists('oauth_tokens');
    }
};
<?php

namespace App\Enums;

enum AppInstallationStatus: string
{
    case Active = 'active';
    case Suspended = 'suspended';
    case Uninstalled = 'uninstalled';

    public function label(): string
    {
        return match ($this) {
            self::Active => 'Active',
            self::Suspended => 'Suspended',
            self::Uninstalled => 'Uninstalled',
        };
    }

    public function badgeColor(): string
    {
        return match ($this) {
            self::Active => 'green',
            self::Suspended => 'amber',
            self::Uninstalled => 'zinc',
        };
    }
}


rg --files app/Http/Middleware app/Http/Controllers/Api/Admin/V1 app/Http/Requests/Api/Admin/V1


sed -n '1,220p' app/Http/Requests/Api/Admin/V1/CreateOrderFulfillmentRequest.php && sed -n '1,220p' app/Http/Requests/Api/Admin/V1/CreateOrderRefundRequest.php


sed -n '1,220p' app/Http/Requests/Api/Admin/V1/CreateOrderFulfillmentRequest.php && sed -n '1,220p' app/Http/Requests/Api/Admin/V1/CreateOrderRefundRequest.php

CreateOrderRefundRequest.php

<?php

namespace App\Http\Requests\Api\Admin\V1;

use Illuminate\Foundation\Http\FormRequest;

class CreateOrderFulfillmentRequest extends FormRequest
{
    public function authorize(): bool
    {
        return true;
    }

    /**
     * @return array<string, \Illuminate\Contracts\Validation\ValidationRule|array<mixed>|string>
     */
    public function rules(): array
    {
        return [
            'line_items' => ['required', 'array', 'min:1'],
            'line_items.*.order_line_id' => ['required', 'integer'],
            'line_items.*.quantity' => ['required', 'integer', 'min:1'],
            'tracking_company' => ['nullable', 'string', 'max:255'],
            'tracking_number' => ['nullable', 'string', 'max:255'],
            'tracking_url' => ['nullable', 'url', 'max:2048'],
        ];
    }

    /**
     * @return array<int, int>
     */
    public function lineQuantities(): array
    {
        return collect($this->validated('line_items'))
            ->mapWithKeys(fn (array $line): array => [(int) $line['order_line_id'] => (int) $line['quantity']])
            ->all();
    }
}
<?php

namespace App\Http\Requests\Api\Admin\V1;

use Illuminate\Foundation\Http\FormRequest;

class CreateOrderRefundRequest extends FormRequest
{
    public function authorize(): bool
    {
        return true;
    }

    /**
     * @return array<string, \Illuminate\Contracts\Validation\ValidationRule|array<mixed>|string>
     */
    public function rules(): array
    {
        return [
            'amount' => ['nullable', 'integer', 'min:1'],
            'reason' => ['nullable', 'string', 'max:500'],
            'restock' => ['sometimes', 'boolean'],
            'line_items' => ['nullable', 'array'],
            'line_items.*.order_line_id' => ['required_with:line_items', 'integer'],
            'line_items.*.quantity' => ['required_with:line_items', 'integer', 'min:1'],
        ];
    }

    /**
     * @return array<int, int>
     */
    public function lineQuantities(): array
    {
        return collect($this->validated('line_items', []))
            ->mapWithKeys(fn (array $line): array => [(int) $line['order_line_id'] => (int) $line['quantity']])
            ->all();
    }
}


Output:
Chunk ID: 71ed88
Wall time: 0.0000 seconds
Process exited with code 0
Original token count: 108
Output:
app/Http/Controllers/Api/Admin/V1/OrderRefundController.php
app/Http/Requests/Api/Admin/V1/CreateOrderFulfillmentRequest.php
app/Http/Middleware/ResolveStore.php
app/Http/Controllers/Api/Admin/V1/OrderFulfillmentController.php
app/Http/Controllers/Api/Admin/V1/OrderController.php
app/Http/Middleware/EnsureUserEmailIsVerified.php
app/Http/Middleware/CheckStoreRole.php
app/Http/Requests/Api/Admin/V1/CreateOrderRefundRequest.php


Output:
Chunk ID: 697712
Wall time: 0.0000 seconds
Process exited with code 0
Original token count: 553
Output:
<?php

namespace App\Http\Requests\Api\Admin\V1;

use Illuminate\Foundation\Http\FormRequest;

class CreateOrderFulfillmentRequest extends FormRequest
{
    public function authorize(): bool
    {
        return true;
    }

    /**
     * @return array<string, \Illuminate\Contracts\Validation\ValidationRule|array<mixed>|string>
     */
    public function rules(): array
    {
        return [
            'line_items' => ['required', 'array', 'min:1'],
            'line_items.*.order_line_id' => ['required', 'integer'],
            'line_items.*.quantity' => ['required', 'integer', 'min:1'],
            'tracking_company' => ['nullable', 'string', 'max:255'],
            'tracking_number' => ['nullable', 'string', 'max:255'],
            'tracking_url' => ['nullable', 'url', 'max:2048'],
        ];
    }

    /**
     * @return array<int, int>
     */
    public function lineQuantities(): array
    {
        return collect($this->validated('line_items'))
            ->mapWithKeys(fn (array $line): array => [(int) $line['order_line_id'] => (int) $line['quantity']])
            ->all();
    }
}
<?php

namespace App\Http\Requests\Api\Admin\V1;

use Illuminate\Foundation\Http\FormRequest;

class CreateOrderRefundRequest extends FormRequest
{
    public function authorize(): bool
    {
        return true;
    }

    /**
     * @return array<string, \Illuminate\Contracts\Validation\ValidationRule|array<mixed>|string>
     */
    public function rules(): array
    {
        return [
            'amount' => ['nullable', 'integer', 'min:1'],
            'reason' => ['nullable', 'string', 'max:500'],
            'restock' => ['sometimes', 'boolean'],
            'line_items' => ['nullable', 'array'],
            'line_items.*.order_line_id' => ['required_with:line_items', 'integer'],
            'line_items.*.quantity' => ['required_with:line_items', 'integer', 'min:1'],
        ];
    }

    /**
     * @return array<int, int>
     */
    public function lineQuantities(): array
    {
        return collect($this->validated('line_items', []))
            ->mapWithKeys(fn (array $line): array => [(int) $line['order_line_id'] => (int) $line['quantity']])
            ->all();
    }
}


php artisan make:middleware AuthenticateAdminApi --no-interaction


Output:
Chunk ID: 366ae0
Wall time: 0.1435 seconds
Process exited with code 0
Original token count: 24
Output:

   INFO  Middleware [app/Http/Middleware/AuthenticateAdminApi.php] created successfully.


php artisan make:middleware AuthenticateAdminApi --no-interaction

INFO  Middleware [app/Http/Middleware/AuthenticateAdminApi.php] created successfully.


sed -n '1,160p' app/Http/Middleware/AuthenticateAdminApi.php


sed -n '1,160p' app/Http/Middleware/AuthenticateAdminApi.php

<?php

namespace App\Http\Middleware;

use Closure;
use Illuminate\Http\Request;
use Symfony\Component\HttpFoundation\Response;

class AuthenticateAdminApi
{
    /**
     * Handle an incoming request.
     *
     * @param  \Closure(\Illuminate\Http\Request): (\Symfony\Component\HttpFoundation\Response)  $next
     */
    public function handle(Request $request, Closure $next): Response
    {
        return $next($request);
    }
}


Output:
Chunk ID: 1c48c9
Wall time: 0.0000 seconds
Process exited with code 0
Original token count: 109
Output:
<?php

namespace App\Http\Middleware;

use Closure;
use Illuminate\Http\Request;
use Symfony\Component\HttpFoundation\Response;

class AuthenticateAdminApi
{
    /**
     * Handle an incoming request.
     *
     * @param  \Closure(\Illuminate\Http\Request): (\Symfony\Component\HttpFoundation\Response)  $next
     */
    public function handle(Request $request, Closure $next): Response
    {
        return $next($request);
    }
}


I’m adding a custom `admin.api` middleware rather than introducing a new package. It will accept the existing session auth path or a hashed developer bearer token scoped to the route store and required API ability.


Input:
*** Begin Patch
*** Update File: /Users/fabianwesner/Herd/shop/app/Http/Middleware/AuthenticateAdminApi.php
@@
 namespace App\Http\Middleware;

+use App\Enums\AppInstallationStatus;
+use App\Models\OauthToken;
+use App\Models\Store;
 use Closure;
 use Illuminate\Http\Request;
 use Symfony\Component\HttpFoundation\Response;
@@
-    public function handle(Request $request, Closure $next): Response
+    public function handle(Request $request, Closure $next, string ...$abilities): Response
     {
+        $store = $this->storeFromRoute($request);
+
+        app()->forgetInstance('admin_api_oauth_token');
+
+        if ($request->user() !== null) {
+            if ($request->user()->stores()->whereKey($store->getKey())->exists()) {
+                app()->instance('current_store', $store);
+
+                return $next($request);
+            }
+
+            return response()->json(['message' => 'Forbidden.'], 403);
+        }
+
+        $plainTextToken = $request->bearerToken();
+
+        if (! is_string($plainTextToken) || $plainTextToken === '') {
+            return response()->json(['message' => 'Unauthenticated.'], 401);
+        }
+
+        $token = OauthToken::query()
+            ->with('installation')
+            ->where('access_token_hash', hash('sha256', $plainTextToken))
+            ->first();
+
+        if (! $token instanceof OauthToken || $token->isExpired()) {
+            return response()->json(['message' => 'Unauthenticated.'], 401);
+        }
+
+        $installation = $token->installation;
+
+        if ($installation === null
+            || $installation->status !== AppInstallationStatus::Active
+            || (int) $installation->store_id !== $store->getKey()) {
+            return response()->json(['message' => 'Forbidden.'], 403);
+        }
+
+        if (! $this->hasAbilities($token, $abilities)) {
+            return response()->json(['message' => 'Forbidden.'], 403);
+        }
+
+        $token->forceFill(['last_used_at' => now()])->save();
+
+        $request->attributes->set('admin_api_oauth_token', $token);
+        app()->instance('admin_api_oauth_token', $token);
+        app()->instance('current_store', $store);
+
         return $next($request);
     }
+
+    private function storeFromRoute(Request $request): Store
+    {
+        $store = $request->route('store');
+
+        if ($store instanceof Store) {
+            return $store;
+        }
+
+        return Store::query()->findOrFail($store);
+    }
+
+    /**
+     * @param  list<string>  $abilities
+     */
+    private function hasAbilities(OauthToken $token, array $abilities): bool
+    {
+        if ($abilities === []) {
+            return true;
+        }
+
+        $tokenAbilities = $token->abilities_json ?? [];
+
+        if (in_array('*', $tokenAbilities, true)) {
+            return true;
+        }
+
+        foreach ($abilities as $ability) {
+            if (! in_array($ability, $tokenAbilities, true)) {
+                return false;
+            }
+        }
+
+        return true;
+    }
 }
*** End Patch


Success. Updated the following files:
M /Users/fabianwesner/Herd/shop/app/Http/Middleware/AuthenticateAdminApi.php

@@ -4,2 +4,5 @@

+use App\Enums\AppInstallationStatus;
+use App\Models\OauthToken;
+use App\Models\Store;
 use Closure;
@@ -15,6 +18,88 @@
      */
-    public function handle(Request $request, Closure $next): Response
+    public function handle(Request $request, Closure $next, string ...$abilities): Response
     {
+        $store = $this->storeFromRoute($request);
+
+        app()->forgetInstance('admin_api_oauth_token');
+
+        if ($request->user() !== null) {
+            if ($request->user()->stores()->whereKey($store->getKey())->exists()) {
+                app()->instance('current_store', $store);
+
+                return $next($request);
+            }
+
+            return response()->json(['message' => 'Forbidden.'], 403);
+        }
+
+        $plainTextToken = $request->bearerToken();
+
+        if (! is_string($plainTextToken) || $plainTextToken === '') {
+            return response()->json(['message' => 'Unauthenticated.'], 401);
+        }
+
+        $token = OauthToken::query()
+            ->with('installation')
+            ->where('access_token_hash', hash('sha256', $plainTextToken))
+            ->first();
+
+        if (! $token instanceof OauthToken || $token->isExpired()) {
+            return response()->json(['message' => 'Unauthenticated.'], 401);
+        }
+
+        $installation = $token->installation;
+
+        if ($installation === null
+            || $installation->status !== AppInstallationStatus::Active
+            || (int) $installation->store_id !== $store->getKey()) {
+            return response()->json(['message' => 'Forbidden.'], 403);
+        }
+
+        if (! $this->hasAbilities($token, $abilities)) {
+            return response()->json(['message' => 'Forbidden.'], 403);
+        }
+
+        $token->forceFill(['last_used_at' => now()])->save();
+
+        $request->attributes->set('admin_api_oauth_token', $token);
+        app()->instance('admin_api_oauth_token', $token);
+        app()->instance('current_store', $store);
+
         return $next($request);
     }
+
+    private function storeFromRoute(Request $request): Store
+    {
+        $store = $request->route('store');
+
+        if ($store instanceof Store) {
+            return $store;
+        }
+
+        return Store::query()->findOrFail($store);
+    }
+
+    /**
+     * @param  list<string>  $abilities
+     */
+    private function hasAbilities(OauthToken $token, array $abilities): bool
+    {
+        if ($abilities === []) {
+            return true;
+        }
+
+        $tokenAbilities = $token->abilities_json ?? [];
+
+        if (in_array('*', $tokenAbilities, true)) {
+            return true;
+        }
+
+        foreach ($abilities as $ability) {
+            if (! in_array($ability, $tokenAbilities, true)) {
+                return false;
+            }
+        }
+
+        return true;
+    }
 }


Output: {"output":"Success. Updated the following files:\nM /Users/fabianwesner/Herd/shop/app/Http/Middleware/AuthenticateAdminApi.php\n","metadata":{"exit_code":0,"duration_seconds":0.0}}


Input:
*** Begin Patch
*** Update File: /Users/fabianwesner/Herd/shop/bootstrap/app.php
@@
 use App\Http\Middleware\CheckStoreRole;
+use App\Http\Middleware\AuthenticateAdminApi;
 use App\Http\Middleware\ResolveStore;
@@
         $middleware->alias([
+            'admin.api' => AuthenticateAdminApi::class,
             'role.check' => CheckStoreRole::class,
             'store.resolve' => ResolveStore::class,
         ]);
*** End Patch


Success. Updated the following files:
M /Users/fabianwesner/Herd/shop/bootstrap/app.php

@@ -3,2 +3,3 @@
 use App\Http\Middleware\CheckStoreRole;
+use App\Http\Middleware\AuthenticateAdminApi;
 use App\Http\Middleware\ResolveStore;
@@ -17,2 +18,3 @@
         $middleware->alias([
+            'admin.api' => AuthenticateAdminApi::class,
             'role.check' => CheckStoreRole::class,


Output: {"output":"Success. Updated the following files:\nM /Users/fabianwesner/Herd/shop/bootstrap/app.php\n","metadata":{"exit_code":0,"duration_seconds":0.0}}


Input:
*** Begin Patch
*** Update File: /Users/fabianwesner/Herd/shop/routes/api.php
@@
-Route::middleware(['auth', 'throttle:60,1'])
+Route::middleware('throttle:60,1')
     ->prefix('admin/v1/stores/{store}')
     ->name('api.admin.v1.')
     ->group(function (): void {
-        Route::get('orders', [AdminOrderController::class, 'index'])->name('orders.index');
-        Route::get('orders/{order}', [AdminOrderController::class, 'show'])->name('orders.show');
-        Route::post('orders/{order}/fulfillments', [AdminOrderFulfillmentController::class, 'store'])->name('orders.fulfillments.store');
-        Route::post('orders/{order}/refunds', [AdminOrderRefundController::class, 'store'])->name('orders.refunds.store');
+        Route::middleware('admin.api:read-orders')->group(function (): void {
+            Route::get('orders', [AdminOrderController::class, 'index'])->name('orders.index');
+            Route::get('orders/{order}', [AdminOrderController::class, 'show'])->name('orders.show');
+        });
+
+        Route::middleware('admin.api:write-orders')->group(function (): void {
+            Route::post('orders/{order}/fulfillments', [AdminOrderFulfillmentController::class, 'store'])->name('orders.fulfillments.store');
+            Route::post('orders/{order}/refunds', [AdminOrderRefundController::class, 'store'])->name('orders.refunds.store');
+        });
     });
*** End Patch


Success. Updated the following files:
M /Users/fabianwesner/Herd/shop/routes/api.php

@@ -47,3 +47,3 @@

-Route::middleware(['auth', 'throttle:60,1'])
+Route::middleware('throttle:60,1')
     ->prefix('admin/v1/stores/{store}')
@@ -51,6 +51,11 @@
     ->group(function (): void {
-        Route::get('orders', [AdminOrderController::class, 'index'])->name('orders.index');
-        Route::get('orders/{order}', [AdminOrderController::class, 'show'])->name('orders.show');
-        Route::post('orders/{order}/fulfillments', [AdminOrderFulfillmentController::class, 'store'])->name('orders.fulfillments.store');
-        Route::post('orders/{order}/refunds', [AdminOrderRefundController::class, 'store'])->name('orders.refunds.store');
+        Route::middleware('admin.api:read-orders')->group(function (): void {
+            Route::get('orders', [AdminOrderController::class, 'index'])->name('orders.index');
+            Route::get('orders/{order}', [AdminOrderController::class, 'show'])->name('orders.show');
+        });
+
+        Route::middleware('admin.api:write-orders')->group(function (): void {
+            Route::post('orders/{order}/fulfillments', [AdminOrderFulfillmentController::class, 'store'])->name('orders.fulfillments.store');
+            Route::post('orders/{order}/refunds', [AdminOrderRefundController::class, 'store'])->name('orders.refunds.store');
+        });
     });


Output: {"output":"Success. Updated the following files:\nM /Users/fabianwesner/Herd/shop/routes/api.php\n","metadata":{"exit_code":0,"duration_seconds":0.0}}


Input:
*** Begin Patch
*** Update File: /Users/fabianwesner/Herd/shop/app/Http/Controllers/Api/Admin/V1/OrderController.php
@@
     private function authorizeStore(Request $request, Store $store): void
     {
-        abort_unless($request->user()?->stores()->whereKey($store->getKey())->exists(), 403);
+        if (! $request->attributes->has('admin_api_oauth_token')) {
+            abort_unless($request->user()?->stores()->whereKey($store->getKey())->exists(), 403);
+        }

         app()->instance('current_store', $store);
     }
*** Update File: /Users/fabianwesner/Herd/shop/app/Http/Controllers/Api/Admin/V1/OrderFulfillmentController.php
@@
     private function authorizeStore(Request $request, Store $store): void
     {
-        abort_unless($request->user()?->stores()->whereKey($store->getKey())->exists(), 403);
+        if (! $request->attributes->has('admin_api_oauth_token')) {
+            abort_unless($request->user()?->stores()->whereKey($store->getKey())->exists(), 403);
+        }

         app()->instance('current_store', $store);
     }
*** Update File: /Users/fabianwesner/Herd/shop/app/Http/Controllers/Api/Admin/V1/OrderRefundController.php
@@
     private function authorizeStore(Request $request, Store $store): void
     {
-        abort_unless($request->user()?->stores()->whereKey($store->getKey())->exists(), 403);
+        if (! $request->attributes->has('admin_api_oauth_token')) {
+            abort_unless($request->user()?->stores()->whereKey($store->getKey())->exists(), 403);
+        }

         app()->instance('current_store', $store);
     }
*** End Patch


Success. Updated the following files:
M /Users/fabianwesner/Herd/shop/app/Http/Controllers/Api/Admin/V1/OrderController.php
M /Users/fabianwesner/Herd/shop/app/Http/Controllers/Api/Admin/V1/OrderFulfillmentController.php
M /Users/fabianwesner/Herd/shop/app/Http/Controllers/Api/Admin/V1/OrderRefundController.php

@@ -61,3 +61,5 @@
     {
-        abort_unless($request->user()?->stores()->whereKey($store->getKey())->exists(), 403);
+        if (! $request->attributes->has('admin_api_oauth_token')) {
+            abort_unless($request->user()?->stores()->whereKey($store->getKey())->exists(), 403);
+        }

@@ -38,3 +38,5 @@
     {
-        abort_unless($request->user()?->stores()->whereKey($store->getKey())->exists(), 403);
+        if (! $request->attributes->has('admin_api_oauth_token')) {
+            abort_unless($request->user()?->stores()->whereKey($store->getKey())->exists(), 403);
+        }

@@ -44,3 +44,5 @@
     {
-        abort_unless($request->user()?->stores()->whereKey($store->getKey())->exists(), 403);
+        if (! $request->attributes->has('admin_api_oauth_token')) {
+            abort_unless($request->user()?->stores()->whereKey($store->getKey())->exists(), 403);
+        }


Output: {"output":"Success. Updated the following files:\nM /Users/fabianwesner/Herd/shop/app/Http/Controllers/Api/Admin/V1/OrderController.php\nM /Users/fabianwesner/Herd/shop/app/Http/Controllers/Api/Admin/V1/OrderFulfillmentController.php\nM /Users/fabianwesner/Herd/shop/app/Http/Controllers/Api/Admin/V1/OrderRefundController.php\n","metadata":{"exit_code":0,"duration_seconds":0.0}}


Input:
*** Begin Patch
*** Update File: /Users/fabianwesner/Herd/shop/tests/Feature/Api/AdminOrderApiTest.php
@@
 use App\Models\Product;
 use App\Models\ProductVariant;
 use App\Models\Store;
 use App\Models\User;
+use App\Services\WebhookService;
 use Database\Seeders\DatabaseSeeder;
 use Illuminate\Foundation\Testing\RefreshDatabase;
@@
 function adminOrderApiUser(): User
 {
     return User::query()->where('email', 'admin@acme.test')->firstOrFail();
 }

+/**
+ * @param  list<string>  $abilities
+ * @return array{token: \App\Models\OauthToken, plain_text: string}
+ */
+function adminOrderApiToken(Store $store, array $abilities): array
+{
+    return app(WebhookService::class)->createApiToken($store, 'Order integration', $abilities);
+}
+
 /**
  * @return array{0: Order, 1: OrderLine, 2: ProductVariant}
  */
@@
 test('admin order api rejects orders outside the requested store', function (): void {
     $store = adminOrderApiStore();
     $otherStore = Store::factory()->create();
@@
         ->getJson("/api/admin/v1/stores/{$store->getKey()}/orders/{$otherOrder->getKey()}")
         ->assertNotFound();
 });
+
+test('admin order api accepts scoped bearer tokens', function (): void {
+    $store = adminOrderApiStore();
+    adminOrderApiOrder($store, [
+        'order_number' => '#8101',
+        'email' => 'token@example.test',
+    ]);
+    $result = adminOrderApiToken($store, ['read-orders']);
+
+    $this->withToken($result['plain_text'])
+        ->getJson("/api/admin/v1/stores/{$store->getKey()}/orders?query=token")
+        ->assertOk()
+        ->assertJsonPath('data.0.order_number', '#8101');
+
+    expect($result['token']->refresh()->last_used_at)->not->toBeNull();
+});
+
+test('admin order api enforces token store scope and abilities', function (): void {
+    $store = adminOrderApiStore();
+    [$order] = adminOrderApiOrder($store);
+    $readOnly = adminOrderApiToken($store, ['read-orders']);
+    $writeToken = adminOrderApiToken($store, ['write-orders']);
+    $otherStore = Store::factory()->create();
+    $otherStoreToken = adminOrderApiToken($otherStore, ['read-orders']);
+
+    $this->withToken($readOnly['plain_text'])
+        ->postJson("/api/admin/v1/stores/{$store->getKey()}/orders/{$order->getKey()}/refunds", [
+            'amount' => 500,
+            'reason' => 'Read-only token',
+        ])
+        ->assertForbidden();
+
+    $this->withToken($otherStoreToken['plain_text'])
+        ->getJson("/api/admin/v1/stores/{$store->getKey()}/orders")
+        ->assertForbidden();
+
+    $this->withToken($writeToken['plain_text'])
+        ->postJson("/api/admin/v1/stores/{$store->getKey()}/orders/{$order->getKey()}/refunds", [
+            'amount' => 500,
+            'reason' => 'Write token',
+        ])
+        ->assertCreated()
+        ->assertJsonPath('data.amount', 500);
+});
+
+test('admin order api rejects expired bearer tokens', function (): void {
+    $store = adminOrderApiStore();
+    adminOrderApiOrder($store);
+    $result = adminOrderApiToken($store, ['read-orders']);
+    $result['token']->forceFill(['expires_at' => now()->subMinute()])->save();
+
+    $this->withToken($result['plain_text'])
+        ->getJson("/api/admin/v1/stores/{$store->getKey()}/orders")
+        ->assertUnauthorized();
+});
*** End Patch


Success. Updated the following files:
M /Users/fabianwesner/Herd/shop/tests/Feature/Api/AdminOrderApiTest.php

@@ -14,2 +14,3 @@
 use App\Models\User;
+use App\Services\WebhookService;
 use Database\Seeders\DatabaseSeeder;
@@ -35,2 +36,11 @@
 /**
+ * @param  list<string>  $abilities
+ * @return array{token: \App\Models\OauthToken, plain_text: string}
+ */
+function adminOrderApiToken(Store $store, array $abilities): array
+{
+    return app(WebhookService::class)->createApiToken($store, 'Order integration', $abilities);
+}
+
+/**
  * @return array{0: Order, 1: OrderLine, 2: ProductVariant}
@@ -156 +166,56 @@
 });
+
+test('admin order api accepts scoped bearer tokens', function (): void {
+    $store = adminOrderApiStore();
+    adminOrderApiOrder($store, [
+        'order_number' => '#8101',
+        'email' => 'token@example.test',
+    ]);
+    $result = adminOrderApiToken($store, ['read-orders']);
+
+    $this->withToken($result['plain_text'])
+        ->getJson("/api/admin/v1/stores/{$store->getKey()}/orders?query=token")
+        ->assertOk()
+        ->assertJsonPath('data.0.order_number', '#8101');
+
+    expect($result['token']->refresh()->last_used_at)->not->toBeNull();
+});
+
+test('admin order api enforces token store scope and abilities', function (): void {
+    $store = adminOrderApiStore();
+    [$order] = adminOrderApiOrder($store);
+    $readOnly = adminOrderApiToken($store, ['read-orders']);
+    $writeToken = adminOrderApiToken($store, ['write-orders']);
+    $otherStore = Store::factory()->create();
+    $otherStoreToken = adminOrderApiToken($otherStore, ['read-orders']);
+
+    $this->withToken($readOnly['plain_text'])
+        ->postJson("/api/admin/v1/stores/{$store->getKey()}/orders/{$order->getKey()}/refunds", [
+            'amount' => 500,
+            'reason' => 'Read-only token',
+        ])
+        ->assertForbidden();
+
+    $this->withToken($otherStoreToken['plain_text'])
+        ->getJson("/api/admin/v1/stores/{$store->getKey()}/orders")
+        ->assertForbidden();
+
+    $this->withToken($writeToken['plain_text'])
+        ->postJson("/api/admin/v1/stores/{$store->getKey()}/orders/{$order->getKey()}/refunds", [
+            'amount' => 500,
+            'reason' => 'Write token',
+        ])
+        ->assertCreated()
+        ->assertJsonPath('data.amount', 500);
+});
+
+test('admin order api rejects expired bearer tokens', function (): void {
+    $store = adminOrderApiStore();
+    adminOrderApiOrder($store);
+    $result = adminOrderApiToken($store, ['read-orders']);
+    $result['token']->forceFill(['expires_at' => now()->subMinute()])->save();
+
+    $this->withToken($result['plain_text'])
+        ->getJson("/api/admin/v1/stores/{$store->getKey()}/orders")
+        ->assertUnauthorized();
+});


Output: {"output":"Success. Updated the following files:\nM /Users/fabianwesner/Herd/shop/tests/Feature/Api/AdminOrderApiTest.php\n","metadata":{"exit_code":0,"duration_seconds":0.0}}


php artisan test --compact tests/Feature/Api/AdminOrderApiTest.php


Output:
Chunk ID: 1a8811
Wall time: 0.3752 seconds
Process exited with code 0
Original token count: 22
Output:
{"result":"fixed","files":[{"path":"bootstrap\/app.php","fixers":["ordered_imports"]}]}


/bin/zsh
-lc
vendor/bin/pint --dirty --format agent


Output:
Chunk ID: eb2063
Wall time: 2.5472 seconds
Process exited with code 0
Original token count: 17
Output:

  ......

  Tests:    6 passed (25 assertions)
  Duration: 2.27s


php artisan test --compact tests/Feature/Api/AdminOrderApiTest.php

  ......

  Tests:    6 passed (25 assertions)
  Duration: 2.27s


The new token-auth tests pass, and Pint only adjusted import ordering. I’m running the affected API/order surface now, then I’ll do the usual full-suite check.


php artisan test --compact tests/Feature/Api/AdminOrderApiTest.php tests/Feature/Admin/AppsDevelopersTest.php tests/Feature/Webhooks tests/Feature/Orders


Output:
Chunk ID: 219f7b
Wall time: 3.7937 seconds
Process exited with code 0
Original token count: 24
Output:

  ................................

  Tests:    32 passed (143 assertions)
  Duration: 3.72s


php artisan route:list --path=api/admin/v1 --except-vendor


Output:
Chunk ID: 7a4fce
Wall time: 0.0755 seconds
Process exited with code 0
Original token count: 102
Output:

  GET|HEAD   api/admin/v1/stores/{store}/orders api.admin.v1.orders.index › A…
  GET|HEAD   api/admin/v1/stores/{store}/orders/{order} api.admin.v1.orders.s…
  POST       api/admin/v1/stores/{store}/orders/{order}/fulfillments api.admi…
  POST       api/admin/v1/stores/{store}/orders/{order}/refunds api.admin.v1.…

                                                            Showing [4] routes


php artisan route:list --path=api/admin/v1 --except-vendor

  GET|HEAD   api/admin/v1/stores/{store}/orders api.admin.v1.orders.index › A…
  GET|HEAD   api/admin/v1/stores/{store}/orders/{order} api.admin.v1.orders.s…
  POST       api/admin/v1/stores/{store}/orders/{order}/fulfillments api.admi…
  POST       api/admin/v1/stores/{store}/orders/{order}/refunds api.admin.v1.…

                                                            Showing [4] routes


Output:
Chunk ID: 1e0b3f
Wall time: 30.0013 seconds
Process running with session ID 32484
Original token count: 36
Output:

  ............................................................................
  ............................................................


Output:
Chunk ID: 94ec20
Wall time: 5.2819 seconds
Process exited with code 0
Original token count: 34
Output:
................
  ....................................................

  Tests:    204 passed (1083 assertions)
  Duration: 40.63s


The affected tests and full suite are green after token middleware: 204 tests, 1083 assertions. I’m reseeding once and then I’ll update progress and commit this security slice.


php artisan migrate:fresh --seed --no-interaction


Output:
Chunk ID: b1cb73
Wall time: 1.1218 seconds
Process exited with code 0
Original token count: 1968
Output:

  Dropping all tables ............................................ 5.54ms DONE

   INFO  Preparing database.

  Creating migration table ....................................... 1.97ms DONE

   INFO  Running migrations.

  0001_01_01_000000_create_users_table ........................... 1.54ms DONE
  0001_01_01_000001_create_cache_table ........................... 0.41ms DONE
  0001_01_01_000002_create_jobs_table ............................ 1.01ms DONE
  2025_08_14_170933_add_two_factor_columns_to_users_table ........ 0.46ms DONE
  2026_05_03_211409_create_organizations_table ................... 0.23ms DONE
  2026_05_03_211413_create_stores_table .......................... 4.72ms DONE
  2026_05_03_211416_create_store_domains_table ................... 0.41ms DONE
  2026_05_03_211419_create_store_settings_table .................. 0.17ms DONE
  2026_05_03_211425_create_store_users_table ..................... 0.33ms DONE
  2026_05_03_211556_create_customers_table ....................... 0.32ms DONE
  2026_05_03_212158_create_customer_password_reset_tokens_table .. 0.19ms DONE
  2026_05_03_213856_create_products_table ........................ 0.65ms DONE
  2026_05_03_213857_create_product_options_table ................. 0.29ms DONE
  2026_05_03_213858_create_product_option_values_table ........... 0.30ms DONE
  2026_05_03_213859_create_product_variants_table ................ 0.58ms DONE
  2026_05_03_213900_create_variant_option_values_table ........... 0.24ms DONE
  2026_05_03_213901_create_inventory_items_table ................. 0.31ms DONE
  2026_05_03_213902_create_collections_table ..................... 0.40ms DONE
  2026_05_03_213903_create_collection_products_table ............. 0.33ms DONE
  2026_05_03_213904_create_product_media_table ................... 0.45ms DONE
  2026_05_03_223824_create_themes_table .......................... 0.38ms DONE
  2026_05_03_223830_create_theme_files_table ..................... 0.39ms DONE
  2026_05_03_223837_create_theme_settings_table .................. 0.22ms DONE
  2026_05_03_223841_create_pages_table ........................... 0.42ms DONE
  2026_05_03_223844_create_navigation_menus_table ................ 0.31ms DONE
  2026_05_03_223848_create_navigation_items_table ................ 0.33ms DONE
  2026_05_03_225400_create_carts_table ........................... 0.73ms DONE
  2026_05_03_225405_create_cart_lines_table ...................... 0.48ms DONE
  2026_05_03_225409_create_checkouts_table ....................... 0.78ms DONE
  2026_05_03_225413_create_shipping_zones_table .................. 0.33ms DONE
  2026_05_03_225418_create_shipping_rates_table .................. 0.32ms DONE
  2026_05_03_225422_create_tax_settings_table .................... 0.20ms DONE
  2026_05_03_225427_create_discounts_table ....................... 0.53ms DONE
  2026_05_04_000408_create_customer_addresses_table .............. 0.31ms DONE
  2026_05_04_000408_create_orders_table .......................... 0.87ms DONE
  2026_05_04_000410_create_order_lines_table ..................... 0.45ms DONE
  2026_05_04_000411_create_payments_table ........................ 0.49ms DONE
  2026_05_04_000412_create_refunds_table ......................... 0.42ms DONE
  2026_05_04_000413_create_fulfillments_table .................... 0.44ms DONE
  2026_05_04_000414_create_fulfillment_lines_table ............... 0.35ms DONE
  2026_05_04_030847_create_search_settings_table ................. 0.20ms DONE
  2026_05_04_030848_create_products_fts_table .................... 0.33ms DONE
  2026_05_04_030848_create_search_queries_table .................. 0.46ms DONE
  2026_05_04_032640_create_analytics_events_table ................ 0.72ms DONE
  2026_05_04_032641_create_analytics_dailies_table ............... 0.37ms DONE
  2026_05_04_034556_create_apps_table ............................ 0.23ms DONE
  2026_05_04_034601_create_app_installations_table ............... 0.54ms DONE
  2026_05_04_034606_create_oauth_clients_table ................... 0.31ms DONE
  2026_05_04_034611_create_oauth_tokens_table .................... 0.41ms DONE
  2026_05_04_034616_create_webhook_subscriptions_table ........... 0.41ms DONE
  2026_05_04_034621_create_webhook_deliveries_table .............. 0.46ms DONE

   INFO  Seeding database.

  Database\Seeders\OrganizationSeeder ................................ RUNNING
  Database\Seeders\OrganizationSeeder .............................. 5 ms DONE

  Database\Seeders\StoreSeeder ....................................... RUNNING
  Database\Seeders\StoreSeeder ..................................... 1 ms DONE

  Database\Seeders\StoreDomainSeeder ................................. RUNNING
  Database\Seeders\StoreDomainSeeder ............................... 1 ms DONE

  Database\Seeders\AppSeeder ......................................... RUNNING
  Database\Seeders\AppSeeder ....................................... 8 ms DONE

  Database\Seeders\UserSeeder ........................................ RUNNING
  Database\Seeders\UserSeeder .................................... 268 ms DONE

  Database\Seeders\StoreUserSeeder ................................... RUNNING
  Database\Seeders\StoreUserSeeder ................................. 1 ms DONE

  Database\Seeders\StoreSettingsSeeder ............................... RUNNING
  Database\Seeders\StoreSettingsSeeder ............................. 1 ms DONE

  Database\Seeders\SearchSettingsSeeder .............................. RUNNING
  Database\Seeders\SearchSettingsSeeder ............................ 1 ms DONE

  Database\Seeders\CollectionSeeder .................................. RUNNING
  Database\Seeders\CollectionSeeder ................................ 3 ms DONE

  Database\Seeders\ProductSeeder ..................................... RUNNING
  Database\Seeders\ProductSeeder ................................. 205 ms DONE

  Database\Seeders\ThemeSeeder ....................................... RUNNING
  Database\Seeders\ThemeSeeder ..................................... 1 ms DONE

  Database\Seeders\ThemeFileSeeder ................................... RUNNING
  Database\Seeders\ThemeFileSeeder ................................. 9 ms DONE

  Database\Seeders\ThemeSettingsSeeder ............................... RUNNING
  Database\Seeders\ThemeSettingsSeeder ............................. 1 ms DONE

  Database\Seeders\PageSeeder ........................................ RUNNING
  Database\Seeders\PageSeeder ...................................... 2 ms DONE

  Database\Seeders\NavigationMenuSeeder .............................. RUNNING
  Database\Seeders\NavigationMenuSeeder ............................ 7 ms DONE

  Database\Seeders\NavigationItemSeeder .............................. RUNNING
  Database\Seeders\NavigationItemSeeder ............................ 4 ms DONE

  Database\Seeders\TaxSettingsSeeder ................................. RUNNING
  Database\Seeders\TaxSettingsSeeder ............................... 1 ms DONE

  Database\Seeders\ShippingZoneSeeder ................................ RUNNING
  Database\Seeders\ShippingZoneSeeder .............................. 1 ms DONE

  Database\Seeders\ShippingRateSeeder ................................ RUNNING
  Database\Seeders\ShippingRateSeeder .............................. 1 ms DONE

  Database\Seeders\DiscountSeeder .................................... RUNNING
  Database\Seeders\DiscountSeeder .................................. 3 ms DONE

  Database\Seeders\CustomerSeeder .................................... RUNNING
  Database\Seeders\CustomerSeeder ................................ 265 ms DONE

  Database\Seeders\AnalyticsSeeder ................................... RUNNING
  Database\Seeders\AnalyticsSeeder ................................ 65 ms DONE


Input:
*** Begin Patch
*** Update File: /Users/fabianwesner/Herd/shop/specs/progress.md
@@
-| Routes/API | `specs/02-API-ROUTES.md` | partial | Phase 1 auth routes plus catalog/cart/order/customer/discount/content/settings/search/analytics/apps/developers UI routes exist: `/`, `/collections`, `/collections/{handle}`, `/products/{handle}`, `/cart`, `/checkout`, `/checkout/confirmation/{order}`, `/search`, `/pages/{handle}`, `/account/login`, `/account/register`, `/account/forgot-password`, `/account/reset-password/{token}`, `/account`, `/account/orders/{order}`, `/admin/products`, `/admin/products/create`, `/admin/products/{product}/edit`, `/admin/collections`, `/admin/collections/create`, `/admin/collections/{collection}/edit`, `/admin/inventory`, `/admin/orders`, `/admin/orders/{order}`, `/admin/customers`, `/admin/customers/{customer}`, `/admin/discounts`, `/admin/discounts/create`, `/admin/discounts/{discount}/edit`, `/admin/pages`, `/admin/pages/create`, `/admin/pages/{page}/edit`, `/admin/navigation`, `/admin/themes`, `/admin/themes/{theme}/editor`, `/admin/settings`, `/admin/settings/shipping`, `/admin/settings/taxes`, `/admin/settings/checkout`, `/admin/settings/notifications`, `/admin/search/settings`, `/admin/analytics`, `/admin/apps`, `/admin/apps/{installation}`, and `/admin/developers`. Storefront REST API now includes cart line CRUD, checkout address/shipping/discount/payment-method selection, checkout payment completion, token-gated order lookup, product search, search suggestions, and analytics event ingestion under `/api/storefront/v1`. Admin REST API now includes store-scoped order list/detail, fulfillment creation, and refund creation under `/api/admin/v1/stores/{store}`. OAuth/app API endpoints and broader admin REST surfaces are still missing. |
+| Routes/API | `specs/02-API-ROUTES.md` | partial | Phase 1 auth routes plus catalog/cart/order/customer/discount/content/settings/search/analytics/apps/developers UI routes exist: `/`, `/collections`, `/collections/{handle}`, `/products/{handle}`, `/cart`, `/checkout`, `/checkout/confirmation/{order}`, `/search`, `/pages/{handle}`, `/account/login`, `/account/register`, `/account/forgot-password`, `/account/reset-password/{token}`, `/account`, `/account/orders/{order}`, `/admin/products`, `/admin/products/create`, `/admin/products/{product}/edit`, `/admin/collections`, `/admin/collections/create`, `/admin/collections/{collection}/edit`, `/admin/inventory`, `/admin/orders`, `/admin/orders/{order}`, `/admin/customers`, `/admin/customers/{customer}`, `/admin/discounts`, `/admin/discounts/create`, `/admin/discounts/{discount}/edit`, `/admin/pages`, `/admin/pages/create`, `/admin/pages/{page}/edit`, `/admin/navigation`, `/admin/themes`, `/admin/themes/{theme}/editor`, `/admin/settings`, `/admin/settings/shipping`, `/admin/settings/taxes`, `/admin/settings/checkout`, `/admin/settings/notifications`, `/admin/search/settings`, `/admin/analytics`, `/admin/apps`, `/admin/apps/{installation}`, and `/admin/developers`. Storefront REST API now includes cart line CRUD, checkout address/shipping/discount/payment-method selection, checkout payment completion, token-gated order lookup, product search, search suggestions, and analytics event ingestion under `/api/storefront/v1`. Admin REST API now includes store-scoped order list/detail, fulfillment creation, and refund creation under `/api/admin/v1/stores/{store}` with session or scoped bearer-token authentication. OAuth/app API endpoints and broader admin REST surfaces are still missing. |
@@
-| Auth/security | `specs/06-AUTH-AND-SECURITY.md` | partial | Admin Livewire login/logout, customer guard/provider, customer login/register, customer password reset with store-scoped hashed tokens, reset-link throttling, generic reset responses, login rate limiting, session hardening, concrete resource policies, encrypted app client/webhook secrets, and one-time display developer token generation are implemented. Sanctum token auth is still missing. |
+| Auth/security | `specs/06-AUTH-AND-SECURITY.md` | partial | Admin Livewire login/logout, customer guard/provider, customer login/register, customer password reset with store-scoped hashed tokens, reset-link throttling, generic reset responses, login rate limiting, session hardening, concrete resource policies, encrypted app client/webhook secrets, one-time display developer token generation, and a compatible hashed bearer-token admin API middleware with store/ability enforcement are implemented. |
@@
 - 2026-05-04: `vendor/bin/pint --dirty --format agent` passed after the policy typing refactor.
 - 2026-05-04: `php artisan test --compact tests/Feature/Foundation/AuthorizationTest.php` passed after the policy typing refactor: 5 tests, 68 assertions.
 - 2026-05-04: `php artisan test --compact tests/Feature/Foundation` passed after the policy typing refactor: 13 tests, 102 assertions.
 - 2026-05-04: `php artisan test --compact` passed after the policy typing refactor: 201 tests, 1075 assertions.
+- 2026-05-04: `mcp__laravel_boost__.search_docs` consulted Laravel 12 custom guard/middleware and bearer-token authentication docs plus Pest 4 testing docs before the admin API token middleware changes.
+- 2026-05-04: `php artisan make:middleware AuthenticateAdminApi --no-interaction` created the admin API token middleware.
+- 2026-05-04: `vendor/bin/pint --dirty --format agent` fixed import order after the admin API token middleware changes.
+- 2026-05-04: `php artisan test --compact tests/Feature/Api/AdminOrderApiTest.php` passed after the admin API token middleware changes: 6 tests, 25 assertions.
+- 2026-05-04: `php artisan test --compact tests/Feature/Api/AdminOrderApiTest.php tests/Feature/Admin/AppsDevelopersTest.php tests/Feature/Webhooks tests/Feature/Orders` passed after the admin API token middleware changes: 32 tests, 143 assertions.
+- 2026-05-04: `php artisan route:list --path=api/admin/v1 --except-vendor` confirmed the four admin order API routes remain registered.
+- 2026-05-04: `php artisan test --compact` passed after the admin API token middleware changes: 204 tests, 1083 assertions.
+- 2026-05-04: `php artisan migrate:fresh --seed --no-interaction` passed after the admin API token middleware changes.
@@
 - OAuth/Passport app authorization remains deferred per the roadmap; the developer token UI uses the existing app installation and `oauth_tokens` schema as a self-contained local token store, but it is not Sanctum/Passport authentication yet.
+- Admin order API routes use the `admin.api` middleware, which accepts either the existing session-authenticated admin user or a hashed `oauth_tokens` bearer token scoped to the route store; token requests require `read-orders` for GET routes and `write-orders` for refund/fulfillment mutations and update `last_used_at` on successful use.
@@
-- Composer does not currently include Sanctum or Passport, while Spec 06 requires Sanctum personal access tokens and Spec 02 defers Passport OAuth. This will need either an approved dependency addition or a documented compatible alternative before final completion.
 - The Herd app URL in the goal is `http://shop.test/`, while the E2E spec also references `http://acme-fashion.test`; domain handling must support seeded store domains and Herd verification.
*** End Patch


Success. Updated the following files:
M /Users/fabianwesner/Herd/shop/specs/progress.md

@@ -29,3 +29,3 @@
 | Database schema | `specs/01-DATABASE-SCHEMA.md` | partial | Phase 1 tenancy/auth tables, Phase 2 catalog tables, Phase 3 theme/content/navigation tables, Phase 4 cart/checkout/pricing tables, Phase 5 order/payment/fulfillment tables, and Phase 7 search/analytics/apps/webhooks tables are implemented: search_settings, search_queries, SQLite FTS5 `products_fts`, analytics_events, analytics_daily, apps, app_installations, oauth_clients, oauth_tokens, webhook_subscriptions, and webhook_deliveries. |
-| Routes/API | `specs/02-API-ROUTES.md` | partial | Phase 1 auth routes plus catalog/cart/order/customer/discount/content/settings/search/analytics/apps/developers UI routes exist: `/`, `/collections`, `/collections/{handle}`, `/products/{handle}`, `/cart`, `/checkout`, `/checkout/confirmation/{order}`, `/search`, `/pages/{handle}`, `/account/login`, `/account/register`, `/account/forgot-password`, `/account/reset-password/{token}`, `/account`, `/account/orders/{order}`, `/admin/products`, `/admin/products/create`, `/admin/products/{product}/edit`, `/admin/collections`, `/admin/collections/create`, `/admin/collections/{collection}/edit`, `/admin/inventory`, `/admin/orders`, `/admin/orders/{order}`, `/admin/customers`, `/admin/customers/{customer}`, `/admin/discounts`, `/admin/discounts/create`, `/admin/discounts/{discount}/edit`, `/admin/pages`, `/admin/pages/create`, `/admin/pages/{page}/edit`, `/admin/navigation`, `/admin/themes`, `/admin/themes/{theme}/editor`, `/admin/settings`, `/admin/settings/shipping`, `/admin/settings/taxes`, `/admin/settings/checkout`, `/admin/settings/notifications`, `/admin/search/settings`, `/admin/analytics`, `/admin/apps`, `/admin/apps/{installation}`, and `/admin/developers`. Storefront REST API now includes cart line CRUD, checkout address/shipping/discount/payment-method selection, checkout payment completion, token-gated order lookup, product search, search suggestions, and analytics event ingestion under `/api/storefront/v1`. Admin REST API now includes store-scoped order list/detail, fulfillment creation, and refund creation under `/api/admin/v1/stores/{store}`. OAuth/app API endpoints and broader admin REST surfaces are still missing. |
+| Routes/API | `specs/02-API-ROUTES.md` | partial | Phase 1 auth routes plus catalog/cart/order/customer/discount/content/settings/search/analytics/apps/developers UI routes exist: `/`, `/collections`, `/collections/{handle}`, `/products/{handle}`, `/cart`, `/checkout`, `/checkout/confirmation/{order}`, `/search`, `/pages/{handle}`, `/account/login`, `/account/register`, `/account/forgot-password`, `/account/reset-password/{token}`, `/account`, `/account/orders/{order}`, `/admin/products`, `/admin/products/create`, `/admin/products/{product}/edit`, `/admin/collections`, `/admin/collections/create`, `/admin/collections/{collection}/edit`, `/admin/inventory`, `/admin/orders`, `/admin/orders/{order}`, `/admin/customers`, `/admin/customers/{customer}`, `/admin/discounts`, `/admin/discounts/create`, `/admin/discounts/{discount}/edit`, `/admin/pages`, `/admin/pages/create`, `/admin/pages/{page}/edit`, `/admin/navigation`, `/admin/themes`, `/admin/themes/{theme}/editor`, `/admin/settings`, `/admin/settings/shipping`, `/admin/settings/taxes`, `/admin/settings/checkout`, `/admin/settings/notifications`, `/admin/search/settings`, `/admin/analytics`, `/admin/apps`, `/admin/apps/{installation}`, and `/admin/developers`. Storefront REST API now includes cart line CRUD, checkout address/shipping/discount/payment-method selection, checkout payment completion, token-gated order lookup, product search, search suggestions, and analytics event ingestion under `/api/storefront/v1`. Admin REST API now includes store-scoped order list/detail, fulfillment creation, and refund creation under `/api/admin/v1/stores/{store}` with session or scoped bearer-token authentication. OAuth/app API endpoints and broader admin REST surfaces are still missing. |
 | Admin UI | `specs/03-ADMIN-UI.md` | partial | Flux/Livewire admin shell now includes dashboard KPI/date-range reporting, analytics reporting with filters/export, catalog/product/collection/inventory management, product option matrix generation, product media upload/alt text/reorder/delete controls, order/customer/discount management, page index/form, navigation menu editor, theme grid, theme settings editor with iframe preview, theme file list/editor, general settings, domain management, shipping zone/rate management, tax settings, checkout policy settings, notification settings, search settings/reindexing, installed app list/detail, and developer token/webhook management with auth protection and store scoping. |
@@ -33,3 +33,3 @@
 | Business logic | `specs/05-BUSINESS-LOGIC.md` | partial | `ResolveStore`, `BelongsToStore`, `StoreScope`, role checks, customer guard provider, store-scoped `CustomerPasswordResetService`, catalog product lifecycle transitions, SKU uniqueness, variant matrix rebuilding, inventory reserve/release/commit/restock, automatic variant inventory, variant option mapping, media resize/cleanup job, `SearchService` with per-store synonym expansion and stop-word removal, product observer FTS sync, search query logging, search API rate limiting, `AnalyticsService`, analytics event deduplication, daily analytics aggregation, scheduled `AggregateAnalytics`, analytics API rate limiting, `WebhookService`, timestamped HMAC signing/verification, database-queued `DeliverWebhook`, delivery logging/retry backoff metadata, webhook circuit breaker pausing, domain-event webhook dispatch listener, developer token generation backed by `oauth_tokens`, `CartService`, `DiscountService` including one-per-customer code discount redemption checks and automatic/code order-line attribution, `ShippingCalculator`, `TaxCalculator`, `PricingEngine`, checkout transitions through completion, checkout expiration, abandoned cart cleanup, session cart lookup, cart discount handoff to checkout, customer login cart merge, product add-to-cart mutations, `PaymentService`, mock PSP, idempotent order creation, checkout UI/API order submission, session/customer/token-gated order confirmation and lookup, customer order-history scoping, admin dashboard order aggregates, admin analytics reporting, admin customer address management, admin discount rule management, admin content/theme/navigation/settings/search/apps/developers orchestration, admin order UI/API action orchestration, `RefundService`, `FulfillmentService`, bank-transfer payment confirmation, and unpaid bank-transfer cancellation are implemented. |
-| Auth/security | `specs/06-AUTH-AND-SECURITY.md` | partial | Admin Livewire login/logout, customer guard/provider, customer login/register, customer password reset with store-scoped hashed tokens, reset-link throttling, generic reset responses, login rate limiting, session hardening, concrete resource policies, encrypted app client/webhook secrets, and one-time display developer token generation are implemented. Sanctum token auth is still missing. |
+| Auth/security | `specs/06-AUTH-AND-SECURITY.md` | partial | Admin Livewire login/logout, customer guard/provider, customer login/register, customer password reset with store-scoped hashed tokens, reset-link throttling, generic reset responses, login rate limiting, session hardening, concrete resource policies, encrypted app client/webhook secrets, one-time display developer token generation, and a compatible hashed bearer-token admin API middleware with store/ability enforcement are implemented. |
 | Seed/test data | `specs/07-SEEDERS-AND-TEST-DATA.md` | partial | Seeders create Acme Fashion and Acme Electronics stores/domains/settings/admin access with checkout and notification defaults, 2 apps, 4 app installations, 4 OAuth clients, 4 OAuth tokens, 8 webhook subscriptions, 2 search settings rows, 25 indexed products, 60 analytics_daily rows, 210 analytics_events rows, 6 collections, 127 variants, 127 inventory rows, 206 variant option pivots, 2 themes, 6 theme files with local disk contents and metadata, 2 theme settings rows, 6 pages, 4 navigation menus, 17 navigation items, 2 tax settings rows, 2 shipping zones, 6 shipping rates, 6 discounts, and no product media/runtime carts. Order/payment seed data is still missing. |
@@ -299,2 +299,10 @@
 - 2026-05-04: `php artisan test --compact` passed after the policy typing refactor: 201 tests, 1075 assertions.
+- 2026-05-04: `mcp__laravel_boost__.search_docs` consulted Laravel 12 custom guard/middleware and bearer-token authentication docs plus Pest 4 testing docs before the admin API token middleware changes.
+- 2026-05-04: `php artisan make:middleware AuthenticateAdminApi --no-interaction` created the admin API token middleware.
+- 2026-05-04: `vendor/bin/pint --dirty --format agent` fixed import order after the admin API token middleware changes.
+- 2026-05-04: `php artisan test --compact tests/Feature/Api/AdminOrderApiTest.php` passed after the admin API token middleware changes: 6 tests, 25 assertions.
+- 2026-05-04: `php artisan test --compact tests/Feature/Api/AdminOrderApiTest.php tests/Feature/Admin/AppsDevelopersTest.php tests/Feature/Webhooks tests/Feature/Orders` passed after the admin API token middleware changes: 32 tests, 143 assertions.
+- 2026-05-04: `php artisan route:list --path=api/admin/v1 --except-vendor` confirmed the four admin order API routes remain registered.
+- 2026-05-04: `php artisan test --compact` passed after the admin API token middleware changes: 204 tests, 1083 assertions.
+- 2026-05-04: `php artisan migrate:fresh --seed --no-interaction` passed after the admin API token middleware changes.

@@ -349,2 +357,3 @@
 - OAuth/Passport app authorization remains deferred per the roadmap; the developer token UI uses the existing app installation and `oauth_tokens` schema as a self-contained local token store, but it is not Sanctum/Passport authentication yet.
+- Admin order API routes use the `admin.api` middleware, which accepts either the existing session-authenticated admin user or a hashed `oauth_tokens` bearer token scoped to the route store; token requests require `read-orders` for GET routes and `write-orders` for refund/fulfillment mutations and update `last_used_at` on successful use.
 - Outbound webhook delivery jobs are forced onto the database queue and `webhooks` queue name so domain events enqueue delivery work instead of making external HTTP requests inline when the default queue connection is `sync`.
@@ -359,3 +368,2 @@

-- Composer does not currently include Sanctum or Passport, while Spec 06 requires Sanctum personal access tokens and Spec 02 defers Passport OAuth. This will need either an approved dependency addition or a documented compatible alternative before final completion.
 - The Herd app URL in the goal is `http://shop.test/`, while the E2E spec also references `http://acme-fashion.test`; domain handling must support seeded store domains and Herd verification.


Output: {"output":"Success. Updated the following files:\nM /Users/fabianwesner/Herd/shop/specs/progress.md\n","metadata":{"exit_code":0,"duration_seconds":0.0}}


 .../Controllers/Api/Admin/V1/OrderController.php   |  4 +-
 .../Api/Admin/V1/OrderFulfillmentController.php    |  4 +-
 .../Api/Admin/V1/OrderRefundController.php         |  4 +-
 bootstrap/app.php                                  |  2 +
 routes/api.php                                     | 15 +++--
 specs/progress.md                                  | 14 ++++-
 tests/Feature/Api/AdminOrderApiTest.php            | 65 ++++++++++++++++++++++
 7 files changed, 97 insertions(+), 11 deletions(-)


Output:
Chunk ID: a459b4
Wall time: 0.0000 seconds
Process exited with code 0
Original token count: 0
Output:


 M app/Http/Controllers/Api/Admin/V1/OrderController.php
 M app/Http/Controllers/Api/Admin/V1/OrderFulfillmentController.php
 M app/Http/Controllers/Api/Admin/V1/OrderRefundController.php
 M bootstrap/app.php
 M routes/api.php
 M specs/progress.md
 M tests/Feature/Api/AdminOrderApiTest.php
?? .playwright-mcp/console-2026-05-03T23-28-42-443Z.log
?? .playwright-mcp/console-2026-05-04T04-24-15-455Z.log
?? .playwright-mcp/console-2026-05-04T05-29-27-505Z.log
?? app/Http/Middleware/AuthenticateAdminApi.php


Output:
Chunk ID: 905519
Wall time: 0.0000 seconds
Process exited with code 0
Original token count: 127
Output:
 M app/Http/Controllers/Api/Admin/V1/OrderController.php
 M app/Http/Controllers/Api/Admin/V1/OrderFulfillmentController.php
 M app/Http/Controllers/Api/Admin/V1/OrderRefundController.php
 M bootstrap/app.php
 M routes/api.php
 M specs/progress.md
 M tests/Feature/Api/AdminOrderApiTest.php
?? .playwright-mcp/console-2026-05-03T23-28-42-443Z.log
?? .playwright-mcp/console-2026-05-04T04-24-15-455Z.log
?? .playwright-mcp/console-2026-05-04T05-29-27-505Z.log
?? app/Http/Middleware/AuthenticateAdminApi.php


Output:
Chunk ID: f88ed5
Wall time: 0.0000 seconds
Process exited with code 0
Original token count: 125
Output:
 .../Controllers/Api/Admin/V1/OrderController.php   |  4 +-
 .../Api/Admin/V1/OrderFulfillmentController.php    |  4 +-
 .../Api/Admin/V1/OrderRefundController.php         |  4 +-
 bootstrap/app.php                                  |  2 +
 routes/api.php                                     | 15 +++--
 specs/progress.md                                  | 14 ++++-
 tests/Feature/Api/AdminOrderApiTest.php            | 65 ++++++++++++++++++++++
 7 files changed, 97 insertions(+), 11 deletions(-)


/bin/zsh
-lc
git clean -f .playwright-mcp

Removing .playwright-mcp/console-2026-05-03T23-28-42-443Z.log
Removing .playwright-mcp/console-2026-05-04T04-24-15-455Z.log
Removing .playwright-mcp/console-2026-05-04T05-29-27-505Z.log


Output:
Chunk ID: b80d03
Wall time: 0.0000 seconds
Process exited with code 0
Original token count: 47
Output:
Removing .playwright-mcp/console-2026-05-03T23-28-42-443Z.log
Removing .playwright-mcp/console-2026-05-04T04-24-15-455Z.log
Removing .playwright-mcp/console-2026-05-04T05-29-27-505Z.log


sed -n '1,220p' app/Models/Concerns/BelongsToStore.php && sed -n '1,220p' app/Models/Scopes/StoreScope.php


sed -n '1,140p' bootstrap/app.php && sed -n '1,220p' app/Http/Middleware/AuthenticateAdminApi.php


sed -n '1,220p' app/Models/Concerns/BelongsToStore.php && sed -n '1,220p' app/Models/Scopes/StoreScope.php

StoreScope.php

<?php

namespace App\Models\Concerns;

use App\Models\Scopes\StoreScope;
use App\Models\Store;

trait BelongsToStore
{
    public static function bootBelongsToStore(): void
    {
        static::addGlobalScope(new StoreScope);

        static::creating(function (object $model): void {
            if ($model->store_id || ! app()->bound('current_store')) {
                return;
            }

            $store = app('current_store');

            if ($store instanceof Store) {
                $model->store_id = $store->getKey();
            }
        });
    }
}
<?php

namespace App\Models\Scopes;

use App\Models\Store;
use Illuminate\Database\Eloquent\Builder;
use Illuminate\Database\Eloquent\Model;
use Illuminate\Database\Eloquent\Scope;

class StoreScope implements Scope
{
    public function apply(Builder $builder, Model $model): void
    {
        if (! app()->bound('current_store')) {
            return;
        }

        $store = app('current_store');

        if (! $store instanceof Store) {
            return;
        }

        $builder->where($model->qualifyColumn('store_id'), $store->getKey());
    }
}


sed -n '1,140p' bootstrap/app.php && sed -n '1,220p' app/Http/Middleware/AuthenticateAdminApi.php

AuthenticateAdminApi.php

<?php

use App\Http\Middleware\AuthenticateAdminApi;
use App\Http\Middleware\CheckStoreRole;
use App\Http\Middleware\ResolveStore;
use Illuminate\Foundation\Application;
use Illuminate\Foundation\Configuration\Exceptions;
use Illuminate\Foundation\Configuration\Middleware;

return Application::configure(basePath: dirname(__DIR__))
    ->withRouting(
        web: __DIR__.'/../routes/web.php',
        api: __DIR__.'/../routes/api.php',
        commands: __DIR__.'/../routes/console.php',
        health: '/up',
    )
    ->withMiddleware(function (Middleware $middleware): void {
        $middleware->alias([
            'admin.api' => AuthenticateAdminApi::class,
            'role.check' => CheckStoreRole::class,
            'store.resolve' => ResolveStore::class,
        ]);

        $middleware->appendToGroup('storefront', [
            ResolveStore::class,
        ]);

        $middleware->appendToGroup('admin', [
            ResolveStore::class,
            CheckStoreRole::class,
        ]);
    })
    ->withExceptions(function (Exceptions $exceptions): void {
        //
    })->create();
<?php

namespace App\Http\Middleware;

use App\Enums\AppInstallationStatus;
use App\Models\OauthToken;
use App\Models\Store;
use Closure;
use Illuminate\Http\Request;
use Symfony\Component\HttpFoundation\Response;

class AuthenticateAdminApi
{
    /**
     * Handle an incoming request.
     *
     * @param  \Closure(\Illuminate\Http\Request): (\Symfony\Component\HttpFoundation\Response)  $next
     */
    public function handle(Request $request, Closure $next, string ...$abilities): Response
    {
        $store = $this->storeFromRoute($request);

        app()->forgetInstance('admin_api_oauth_token');

        if ($request->user() !== null) {
            if ($request->user()->stores()->whereKey($store->getKey())->exists()) {
                app()->instance('current_store', $store);

                return $next($request);
            }

            return response()->json(['message' => 'Forbidden.'], 403);
        }

        $plainTextToken = $request->bearerToken();

        if (! is_string($plainTextToken) || $plainTextToken === '') {
            return response()->json(['message' => 'Unauthenticated.'], 401);
        }

        $token = OauthToken::query()
            ->with('installation')
            ->where('access_token_hash', hash('sha256', $plainTextToken))
            ->first();

        if (! $token instanceof OauthToken || $token->isExpired()) {
            return response()->json(['message' => 'Unauthenticated.'], 401);
        }

        $installation = $token->installation;

        if ($installation === null
            || $installation->status !== AppInstallationStatus::Active
            || (int) $installation->store_id !== $store->getKey()) {
            return response()->json(['message' => 'Forbidden.'], 403);
        }

        if (! $this->hasAbilities($token, $abilities)) {
            return response()->json(['message' => 'Forbidden.'], 403);
        }

        $token->forceFill(['last_used_at' => now()])->save();

        $request->attributes->set('admin_api_oauth_token', $token);
        app()->instance('admin_api_oauth_token', $token);
        app()->instance('current_store', $store);

        return $next($request);
    }

    private function storeFromRoute(Request $request): Store
    {
        $store = $request->route('store');

        if ($store instanceof Store) {
            return $store;
        }

        return Store::query()->findOrFail($store);
    }

    /**
     * @param  list<string>  $abilities
     */
    private function hasAbilities(OauthToken $token, array $abilities): bool
    {
        if ($abilities === []) {
            return true;
        }

        $tokenAbilities = $token->abilities_json ?? [];

        if (in_array('*', $tokenAbilities, true)) {
            return true;
        }

        foreach ($abilities as $ability) {
            if (! in_array($ability, $tokenAbilities, true)) {
                return false;
            }
        }

        return true;
    }
}


 M app/Http/Controllers/Api/Admin/V1/OrderController.php
 M app/Http/Controllers/Api/Admin/V1/OrderFulfillmentController.php
 M app/Http/Controllers/Api/Admin/V1/OrderRefundController.php
 M bootstrap/app.php
 M routes/api.php
 M specs/progress.md
 M tests/Feature/Api/AdminOrderApiTest.php
?? app/Http/Middleware/AuthenticateAdminApi.php


Output:
Chunk ID: 092673
Wall time: 0.0000 seconds
Process exited with code 0
Original token count: 284
Output:
<?php

namespace App\Models\Concerns;

use App\Models\Scopes\StoreScope;
use App\Models\Store;

trait BelongsToStore
{
    public static function bootBelongsToStore(): void
    {
        static::addGlobalScope(new StoreScope);

        static::creating(function (object $model): void {
            if ($model->store_id || ! app()->bound('current_store')) {
                return;
            }

            $store = app('current_store');

            if ($store instanceof Store) {
                $model->store_id = $store->getKey();
            }
        });
    }
}
<?php

namespace App\Models\Scopes;

use App\Models\Store;
use Illuminate\Database\Eloquent\Builder;
use Illuminate\Database\Eloquent\Model;
use Illuminate\Database\Eloquent\Scope;

class StoreScope implements Scope
{
    public function apply(Builder $builder, Model $model): void
    {
        if (! app()->bound('current_store')) {
            return;
        }

        $store = app('current_store');

        if (! $store instanceof Store) {
            return;
        }

        $builder->where($model->qualifyColumn('store_id'), $store->getKey());
    }
}


Output:
Chunk ID: 36c825
Wall time: 0.0000 seconds
Process exited with code 0
Original token count: 1022
Output:
<?php

use App\Http\Middleware\AuthenticateAdminApi;
use App\Http\Middleware\CheckStoreRole;
use App\Http\Middleware\ResolveStore;
use Illuminate\Foundation\Application;
use Illuminate\Foundation\Configuration\Exceptions;
use Illuminate\Foundation\Configuration\Middleware;

return Application::configure(basePath: dirname(__DIR__))
    ->withRouting(
        web: __DIR__.'/../routes/web.php',
        api: __DIR__.'/../routes/api.php',
        commands: __DIR__.'/../routes/console.php',
        health: '/up',
    )
    ->withMiddleware(function (Middleware $middleware): void {
        $middleware->alias([
            'admin.api' => AuthenticateAdminApi::class,
            'role.check' => CheckStoreRole::class,
            'store.resolve' => ResolveStore::class,
        ]);

        $middleware->appendToGroup('storefront', [
            ResolveStore::class,
        ]);

        $middleware->appendToGroup('admin', [
            ResolveStore::class,
            CheckStoreRole::class,
        ]);
    })
    ->withExceptions(function (Exceptions $exceptions): void {
        //
    })->create();
<?php

namespace App\Http\Middleware;

use App\Enums\AppInstallationStatus;
use App\Models\OauthToken;
use App\Models\Store;
use Closure;
use Illuminate\Http\Request;
use Symfony\Component\HttpFoundation\Response;

class AuthenticateAdminApi
{
    /**
     * Handle an incoming request.
     *
     * @param  \Closure(\Illuminate\Http\Request): (\Symfony\Component\HttpFoundation\Response)  $next
     */
    public function handle(Request $request, Closure $next, string ...$abilities): Response
    {
        $store = $this->storeFromRoute($request);

        app()->forgetInstance('admin_api_oauth_token');

        if ($request->user() !== null) {
            if ($request->user()->stores()->whereKey($store->getKey())->exists()) {
                app()->instance('current_store', $store);

                return $next($request);
            }

            return response()->json(['message' => 'Forbidden.'], 403);
        }

        $plainTextToken = $request->bearerToken();

        if (! is_string($plainTextToken) || $plainTextToken === '') {
            return response()->json(['message' => 'Unauthenticated.'], 401);
        }

        $token = OauthToken::query()
            ->with('installation')
            ->where('access_token_hash', hash('sha256', $plainTextToken))
            ->first();

        if (! $token instanceof OauthToken || $token->isExpired()) {
            return response()->json(['message' => 'Unauthenticated.'], 401);
        }

        $installation = $token->installation;

        if ($installation === null
            || $installation->status !== AppInstallationStatus::Active
            || (int) $installation->store_id !== $store->getKey()) {
            return response()->json(['message' => 'Forbidden.'], 403);
        }

        if (! $this->hasAbilities($token, $abilities)) {
            return response()->json(['message' => 'Forbidden.'], 403);
        }

        $token->forceFill(['last_used_at' => now()])->save();

        $request->attributes->set('admin_api_oauth_token', $token);
        app()->instance('admin_api_oauth_token', $token);
        app()->instance('current_store', $store);

        return $next($request);
    }

    private function storeFromRoute(Request $request): Store
    {
        $store = $request->route('store');

        if ($store instanceof Store) {
            return $store;
        }

        return Store::query()->findOrFail($store);
    }

    /**
     * @param  list<string>  $abilities
     */
    private function hasAbilities(OauthToken $token, array $abilities): bool
    {
        if ($abilities === []) {
            return true;
        }

        $tokenAbilities = $token->abilities_json ?? [];

        if (in_array('*', $tokenAbilities, true)) {
            return true;
        }

        foreach ($abilities as $ability) {
            if (! in_array($ability, $tokenAbilities, true)) {
                return false;
            }
        }

        return true;
    }
}


Output:
Chunk ID: 34f2b9
Wall time: 0.0000 seconds
Process exited with code 0
Original token count: 85
Output:
 M app/Http/Controllers/Api/Admin/V1/OrderController.php
 M app/Http/Controllers/Api/Admin/V1/OrderFulfillmentController.php
 M app/Http/Controllers/Api/Admin/V1/OrderRefundController.php
 M bootstrap/app.php
 M routes/api.php
 M specs/progress.md
 M tests/Feature/Api/AdminOrderApiTest.php
?? app/Http/Middleware/AuthenticateAdminApi.php


Input:
*** Begin Patch
*** Update File: /Users/fabianwesner/Herd/shop/app/Http/Middleware/AuthenticateAdminApi.php
@@
         $store = $this->storeFromRoute($request);

         app()->forgetInstance('admin_api_oauth_token');
+        app()->instance('current_store', $store);

         if ($request->user() !== null) {
             if ($request->user()->stores()->whereKey($store->getKey())->exists()) {
-                app()->instance('current_store', $store);
-
                 return $next($request);
             }
@@
         $request->attributes->set('admin_api_oauth_token', $token);
         app()->instance('admin_api_oauth_token', $token);
-        app()->instance('current_store', $store);

         return $next($request);
     }
*** End Patch


@@ -23,2 +23,3 @@
         app()->forgetInstance('admin_api_oauth_token');
+        app()->instance('current_store', $store);

@@ -26,4 +27,2 @@
             if ($request->user()->stores()->whereKey($store->getKey())->exists()) {
-                app()->instance('current_store', $store);
-
                 return $next($request);
@@ -65,3 +64,2 @@
         app()->instance('admin_api_oauth_token', $token);
-        app()->instance('current_store', $store);


Output: {"output":"Success. Updated the following files:\nM /Users/fabianwesner/Herd/shop/app/Http/Middleware/AuthenticateAdminApi.php\n","metadata":{"exit_code":0,"duration_seconds":0.0}}


Output:
Chunk ID: a24ffa
Wall time: 0.2227 seconds
Process exited with code 0
Original token count: 5
Output:
{"result":"pass"}


Output:
Chunk ID: ace3e9
Wall time: 2.5101 seconds
Process exited with code 0
Original token count: 17
Output:

  ......

  Tests:    6 passed (25 assertions)
  Duration: 2.24s


  ......

  Tests:    6 passed (25 assertions)
  Duration: 2.24s


Output:
Chunk ID: 93b46e
Wall time: 30.0018 seconds
Process running with session ID 38409
Original token count: 34
Output:

  ............................................................................
  ......................................................


Output:
Chunk ID: ba86b0
Wall time: 4.5423 seconds
Process exited with code 0
Original token count: 35
Output:
......................
  ....................................................

  Tests:    204 passed (1083 assertions)
  Duration: 40.94s


Output:
Chunk ID: 994b3b
Wall time: 0.0000 seconds
Process exited with code 0
Original token count: 0
Output:


Output:
Chunk ID: 3f73fc
Wall time: 0.0000 seconds
Process exited with code 0
Original token count: 85
Output:
 M app/Http/Controllers/Api/Admin/V1/OrderController.php
 M app/Http/Controllers/Api/Admin/V1/OrderFulfillmentController.php
 M app/Http/Controllers/Api/Admin/V1/OrderRefundController.php
 M bootstrap/app.php
 M routes/api.php
 M specs/progress.md
 M tests/Feature/Api/AdminOrderApiTest.php
?? app/Http/Middleware/AuthenticateAdminApi.php


Output:
Chunk ID: c6ec77
Wall time: 0.0000 seconds
Process exited with code 0
Original token count: 125
Output:
 .../Controllers/Api/Admin/V1/OrderController.php   |  4 +-
 .../Api/Admin/V1/OrderFulfillmentController.php    |  4 +-
 .../Api/Admin/V1/OrderRefundController.php         |  4 +-
 bootstrap/app.php                                  |  2 +
 routes/api.php                                     | 15 +++--
 specs/progress.md                                  | 14 ++++-
 tests/Feature/Api/AdminOrderApiTest.php            | 65 ++++++++++++++++++++++
 7 files changed, 97 insertions(+), 11 deletions(-)


The admin API token path is now covered by focused and full tests, and the diff check is clean. I’m committing the middleware slice.


git add app/Http/Middleware/AuthenticateAdminApi.php app/Http/Controllers/Api/Admin/V1/OrderController.php app/Http/Controllers/Api/Admin/V1/OrderFulfillmentController.php app/Http/Controllers/Api/Admin/V1/OrderRefundController.php bootstrap/app.php routes/api.php tests/Feature/Api/AdminOrderApiTest.php specs/progress.md && git commit -m "Add admin API token authentication"


git add app/Http/Middleware/AuthenticateAdminApi.php app/Http/Controllers/Api/Admin/V1/OrderController.php app/Http/Controllers/Api/Admin/V1/OrderFulfillmentController.php app/Http/Controllers/Api/Admin/V1/OrderRefundController.php bootstrap/app.php routes/api.php tests/Feature/Api/AdminOrderApiTest.php specs/progress.md && git commit -m "Add admin API token authentication"

[2026-05-04-codex-5-5-goal e43ffb67] Add admin API token authentication
 8 files changed, 200 insertions(+), 11 deletions(-)
 create mode 100644 app/Http/Middleware/AuthenticateAdminApi.php


Output:
Chunk ID: b99740
Wall time: 0.0000 seconds
Process exited with code 0
Original token count: 48
Output:
[2026-05-04-codex-5-5-goal e43ffb67] Add admin API token authentication
 8 files changed, 200 insertions(+), 11 deletions(-)
 create mode 100644 app/Http/Middleware/AuthenticateAdminApi.php


Committed `e43ffb67 Add admin API token authentication`. I’m checking the `acme-fashion.test` domain gap next; this may be verification-only if Herd already resolves the seeded domain correctly.


Output:
Chunk ID: cb884d
Wall time: 0.0000 seconds
Process exited with code 0
Original token count: 0
Output:


### Ran Playwright code
```js
await page.goto('http://acme-fashion.test/');
```
### Open tabs
- 0: [Checkout](http://shop.test/checkout)
- 1: [Dashboard](http://shop.test/admin)
- 2: (current) [Herd - Site not found](http://acme-fashion.test/)
### Page
- Page URL: http://acme-fashion.test/
- Page Title: Herd - Site not found
- Console: 2 errors, 0 warnings
### Snapshot
- [Snapshot](.playwright-mcp/page-2026-05-04T05-45-51-632Z.yml)
### Events
- New console entries: .playwright-mcp/console-2026-05-04T05-45-51-349Z.log#L1-L2


Output:
Wall time: 0.2904 seconds
Output:
[{"type":"text","text":"### Ran Playwright code\n```js\nawait page.goto('http://acme-fashion.test/');\n```\n### Open tabs\n- 0: [Checkout](http://shop.test/checkout)\n- 1: [Dashboard](http://shop.test/admin)\n- 2: (current) [Herd - Site not found](http://acme-fashion.test/)\n### Page\n- Page URL: http://acme-fashion.test/\n- Page Title: Herd - Site not found\n- Console: 2 errors, 0 warnings\n### Snapshot\n- [Snapshot](.playwright-mcp/page-2026-05-04T05-45-51-632Z.yml)\n### Events\n- New console entries: .playwright-mcp/console-2026-05-04T05-45-51-349Z.log#L1-L2"}]


`acme-fashion.test` currently reaches Herd’s “Site not found” page, so the app’s seeded domain exists but Herd is not serving that host. I’m checking Herd’s site list before deciding whether this should be an app-level alias or an environment/site configuration step.