Exempt public event registration POST from ladill-link CSRF checks.

Registration forms post to ladl.link first; Events-issued CSRF tokens cannot
validate against the Link app session and caused token mismatch errors.

Co-authored-by: Cursor <cursoragent@cursor.com>

bootstrap/app.php

@@ -13,6 +13,11 @@ return Application::configure(basePath: dirname(__DIR__))
         health: '/up',
     )
     ->withMiddleware(function (Middleware $middleware): void {
+        // Public event registration POSTs land on ladl.link first; CSRF tokens from Events HTML do not match here.
+        $middleware->validateCsrfTokens(except: [
+            '*/register',
+        ]);
+
         $middleware->redirectGuestsTo(fn (Request $request) => route('sso.connect', [
             'redirect' => $request->fullUrl(),
         ]));

tests/Feature/LinkRedirectTest.php

@@ -202,4 +202,35 @@ class LinkRedirectTest extends TestCase
                 && $request->hasHeader('X-Ladill-Internal', '1');
         });
     }
+
+    public function test_event_registration_post_does_not_require_link_app_csrf_token(): void
+    {
+        $user = $this->user();
+        ShortLink::create([
+            'user_id' => $user->id,
+            'slug' => 'sales-webinar',
+            'source_app' => 'events',
+            'source_kind' => 'qr',
+            'is_managed_here' => false,
+            'destination_url' => 'https://ladl.link/sales-webinar',
+            'is_active' => true,
+        ]);
+
+        Http::fake([
+            'https://events.ladill.com/q/sales-webinar/register' => Http::response(json_encode([
+                'paid' => false,
+                'success_url' => 'https://ladl.link/sales-webinar/registered/QRE-TESTREF123456',
+                'badge_code' => 'BADGE123',
+            ]), 200, ['Content-Type' => 'application/json']),
+        ]);
+
+        $this->postJson('https://ladl.link/sales-webinar/register', [
+            'tier' => 'General Admission',
+            'attendee_name' => 'Jane Doe',
+            'attendee_email' => 'jane@example.com',
+            'attendee_phone' => '+233200000000',
+        ])
+            ->assertOk()
+            ->assertJsonPath('badge_code', 'BADGE123');
+    }
 }