From 67470badb8c836123777364f6a53fc4a2c240192 Mon Sep 17 00:00:00 2001
From: isaacclad <sense.corporate@gmail.com>
Date: Mon, 13 Jul 2026 23:12:16 +0000
Subject: [PATCH] Exempt public Payment QR POSTs from CSRF checks.

Browser sessions stay on ladl.link while Pay is proxied server-side to Mini without cookies, so satellite CSRF tokens cannot bind.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 bootstrap/app.php | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/bootstrap/app.php b/bootstrap/app.php
index a32e4a0..dd0f103 100644
--- a/bootstrap/app.php
+++ b/bootstrap/app.php
@@ -13,6 +13,12 @@ return Application::configure(basePath: dirname(__DIR__))
         health: '/up',
     )
     ->withMiddleware(function (Middleware $middleware): void {
+        // Public Payment QR POSTs are proxied ladl.link → platform → Mini without the
+        // browser session cookie; satellite-rendered CSRF tokens cannot bind here.
+        $middleware->validateCsrfTokens(except: [
+            'q/*/pay',
+        ]);
+
         $middleware->redirectGuestsTo(fn (Request $request) => route('sso.connect', [
             'redirect' => $request->fullUrl(),
         ]));