Serve assetlinks.json for Android App Links verification.

Expose /.well-known/assetlinks.json from env-configured Play app signing fingerprints so mini.ladill.com passes Play Console deep link domain checks.

Co-authored-by: Cursor <cursoragent@cursor.com>

.env.example

@@ -40,6 +40,11 @@ PAY_API_KEY_MINI=
 IDENTITY_API_URL=https://ladill.com/api
 IDENTITY_API_KEY_MINI=
 
+# Android App Links — Play Console → Setup → App signing (SHA-256 certificate fingerprint).
+# Comma-separate multiple fingerprints if needed (e.g. upload + app signing keys).
+ANDROID_APP_PACKAGE=com.ladill.mini
+ANDROID_APP_SHA256_FINGERPRINTS=
+
 # Firebase Cloud Messaging — instant seller payment alerts on Android.
 FIREBASE_PROJECT_ID=
 FIREBASE_SERVICE_ACCOUNT_JSON=

DEPLOY.md

@@ -86,7 +86,26 @@ php artisan migrate --force
 php artisan config:cache route:cache view:cache
 ```
 
-## 7. Verify
+## 7. Android App Links
+
+Add the **App signing certificate** SHA-256 fingerprint from Play Console
+(Setup → App signing) to production `.env`:
+
+```env
+ANDROID_APP_PACKAGE=com.ladill.mini
+ANDROID_APP_SHA256_FINGERPRINTS=AA:BB:CC:...
+```
+
+After deploy, confirm:
+
+```bash
+curl -sS https://mini.ladill.com/.well-known/assetlinks.json | jq .
+```
+
+Then re-check deep links in Play Console (App content → Deep links). Users may
+need an app update after verification passes.
+
+## 8. Verify
 
 - SSO login at `mini.ladill.com`
 - Create a payment QR, download PNG

app/Http/Controllers/WellKnown/AssetLinksController.php

@@ -0,0 +1,27 @@
+<?php
+
+namespace App\Http\Controllers\WellKnown;
+
+use App\Http\Controllers\Controller;
+use Illuminate\Http\JsonResponse;
+
+class AssetLinksController extends Controller
+{
+    public function __invoke(): JsonResponse
+    {
+        $fingerprints = config('android_app_links.sha256_cert_fingerprints', []);
+
+        abort_if($fingerprints === [], 404);
+
+        return response()->json([
+            [
+                'relation' => ['delegate_permission/common.handle_all_urls'],
+                'target' => [
+                    'namespace' => 'android_app',
+                    'package_name' => config('android_app_links.package_name'),
+                    'sha256_cert_fingerprints' => $fingerprints,
+                ],
+            ],
+        ], 200, [], JSON_UNESCAPED_SLASHES);
+    }
+}

config/android_app_links.php

@@ -0,0 +1,25 @@
+<?php
+
+return [
+
+    /*
+    |--------------------------------------------------------------------------
+    | Ladill Mini Android App Links (Digital Asset Links)
+    |--------------------------------------------------------------------------
+    |
+    | Served at /.well-known/assetlinks.json for Android App Link verification.
+    | Use the App signing certificate SHA-256 from Play Console → Setup →
+    | App signing (not the upload key unless you opted out of Play signing).
+    |
+    | Multiple fingerprints may be comma-separated in ANDROID_APP_SHA256_FINGERPRINTS.
+    |
+    */
+
+    'package_name' => env('ANDROID_APP_PACKAGE', 'com.ladill.mini'),
+
+    'sha256_cert_fingerprints' => array_values(array_filter(array_map(
+        static fn (string $fingerprint): string => strtoupper(trim($fingerprint)),
+        explode(',', (string) env('ANDROID_APP_SHA256_FINGERPRINTS', '')),
+    ))),
+
+];

routes/web.php

@@ -1,6 +1,7 @@
 <?php
 
 use App\Http\Controllers\Auth\SsoLoginController;
+use App\Http\Controllers\WellKnown\AssetLinksController;
 use App\Http\Controllers\Mini\OverviewController;
 use App\Http\Controllers\Mini\PaymentQrController;
 use App\Http\Controllers\Mini\PaymentsController;
@@ -14,6 +15,8 @@ use App\Http\Controllers\Qr\TeamController;
 use App\Http\Controllers\SearchController;
 use Illuminate\Support\Facades\Route;
 
+Route::get('/.well-known/assetlinks.json', AssetLinksController::class)->name('well-known.assetlinks');
+
 Route::get('/', fn () => auth()->check()
     ? redirect()->route('mini.dashboard')
     : redirect()->route('sso.connect'))->name('mini.root');

tests/Feature/AssetLinksTest.php

@@ -0,0 +1,41 @@
+<?php
+
+namespace Tests\Feature;
+
+use Tests\TestCase;
+
+class AssetLinksTest extends TestCase
+{
+    public function test_assetlinks_returns_404_when_fingerprints_not_configured(): void
+    {
+        config(['android_app_links.sha256_cert_fingerprints' => []]);
+
+        $this->get('/.well-known/assetlinks.json')->assertNotFound();
+    }
+
+    public function test_assetlinks_returns_json_when_configured(): void
+    {
+        config([
+            'android_app_links.package_name' => 'com.ladill.mini',
+            'android_app_links.sha256_cert_fingerprints' => [
+                'AA:BB:CC:DD:EE:FF:00:11:22:33:44:55:66:77:88:99:AA:BB:CC:DD:EE:FF:00:11:22:33:44:55:66:77:88:99',
+            ],
+        ]);
+
+        $this->get('/.well-known/assetlinks.json')
+            ->assertOk()
+            ->assertHeader('Content-Type', 'application/json')
+            ->assertJson([
+                [
+                    'relation' => ['delegate_permission/common.handle_all_urls'],
+                    'target' => [
+                        'namespace' => 'android_app',
+                        'package_name' => 'com.ladill.mini',
+                        'sha256_cert_fingerprints' => [
+                            'AA:BB:CC:DD:EE:FF:00:11:22:33:44:55:66:77:88:99:AA:BB:CC:DD:EE:FF:00:11:22:33:44:55:66:77:88:99',
+                        ],
+                    ],
+                ],
+            ]);
+    }
+}