Fix ladl.link CORS for Mini payment assets and pay URL.

Allow cross-origin module loads of Mini build assets and use a same-origin pay path when HTML is proxied through ladl.link so fetch and Vite JS work.
2026-07-21 22:05:36 +00:00
parent e03a5dc30f
commit 75d201bcae
4 changed files with 124 additions and 5 deletions
@@ -0,0 +1,73 @@
+<?php
+
+namespace Tests\Feature;
+
+use App\Models\QrCode;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Str;
+use Tests\TestCase;
+
+class MiniPaymentCorsTest extends TestCase
+{
+    use RefreshDatabase;
+
+    public function test_proxied_payment_landing_uses_same_origin_pay_path(): void
+    {
+        $user = User::create([
+            'public_id' => (string) Str::uuid(),
+            'name' => 'Vendor',
+            'email' => 'vendor-cors@example.com',
+        ]);
+
+        $qr = QrCode::query()->create([
+            'user_id' => $user->id,
+            'short_code' => 'paycors01',
+            'type' => QrCode::TYPE_PAYMENT,
+            'label' => 'Till',
+            'payload' => [
+                'content' => [
+                    'business_name' => 'Accra Kiosk',
+                    'currency' => 'GHS',
+                ],
+                'style' => [],
+            ],
+            'is_active' => true,
+        ]);
+
+        $html = $this->withHeader(\App\Support\LadillLink::INTERNAL_HEADER, '1')
+            ->get('/q/'.$qr->short_code)
+            ->assertOk()
+            ->getContent();
+
+        $this->assertStringContainsString('paycors01/pay', $html);
+        $this->assertStringNotContainsString('https://mini.ladill.com/q/paycors01/pay', $html);
+    }
+
+    public function test_payment_landing_redirects_non_internal_to_public_host(): void
+    {
+        $user = User::create([
+            'public_id' => (string) Str::uuid(),
+            'name' => 'Vendor',
+            'email' => 'vendor-mode@example.com',
+        ]);
+
+        $qr = QrCode::query()->create([
+            'user_id' => $user->id,
+            'short_code' => 'paymode1',
+            'type' => QrCode::TYPE_PAYMENT,
+            'label' => 'Till',
+            'payload' => [
+                'content' => [
+                    'business_name' => 'Accra Kiosk',
+                    'currency' => 'GHS',
+                ],
+                'style' => [],
+            ],
+            'is_active' => true,
+        ]);
+
+        // Direct hit (no internal header) is redirected to ladl.link by legacy middleware.
+        $this->get('/q/'.$qr->short_code)->assertRedirect();
+    }
+}