Harden credit flows and add RevenueCat webhook

2025-09-25 14:05:58 +02:00
parent 9248d7a3f5
commit 215d19f07e
18 changed files with 804 additions and 190 deletions
--- a/tests/Feature/OAuthFlowTest.php
+++ b/tests/Feature/OAuthFlowTest.php
@@ -139,5 +139,16 @@ KEY;
        $this->assertArrayHasKey('access_token', $refreshData);
        $this->assertArrayHasKey('refresh_token', $refreshData);
        $this->assertNotEquals($refreshData['access_token'], $tokenData['access_token']);
+        $this->withServerVariables(['REMOTE_ADDR' => '198.51.100.10'])
+            ->post('/api/v1/oauth/token', [
+                'grant_type' => 'refresh_token',
+                'refresh_token' => $refreshData['refresh_token'],
+                'client_id' => 'tenant-admin-app',
+            ])
+            ->assertStatus(403)
+            ->assertJson([
+                'error' => 'Refresh token cannot be used from this IP address',
+            ]);
    }
 }
+