Fix Woo sync: exempt webhooks from CSRF and backfill on connect.

Auto-import catalog and orders after store activation, add manual order sync, and allow WooCommerce webhooks without CSRF tokens.

Co-authored-by: Cursor <cursoragent@cursor.com>

app/Http/Controllers/Api/StoreActivationController.php

@@ -3,6 +3,7 @@
 namespace App\Http\Controllers\Api;
 
 use App\Http\Controllers\Controller;
+use App\Jobs\StoreBootstrapSync;
 use App\Models\WooStore;
 use App\Services\Woo\InstallTokenService;
 use Illuminate\Http\JsonResponse;
@@ -37,6 +38,8 @@ class StoreActivationController extends Controller
         $pluginToken = $this->tokens->issuePluginToken($store);
         $store = $store->fresh();
 
+        StoreBootstrapSync::dispatch($store->id)->afterResponse();
+
         return response()->json([
             'store_id' => $store->public_id,
             'webhook_url' => $store->webhookUrl(),

app/Http/Controllers/Woo/OrderController.php

@@ -6,6 +6,7 @@ use App\Http\Controllers\Controller;
 use App\Models\WooOrder;
 use App\Models\WooStore;
 use App\Services\Woo\FulfillmentSyncService;
+use App\Services\Woo\OrderSyncService;
 use Illuminate\Http\RedirectResponse;
 use Illuminate\Http\Request;
 use Illuminate\Validation\Rule;
@@ -13,7 +14,10 @@ use Illuminate\View\View;
 
 class OrderController extends Controller
 {
-    public function __construct(private FulfillmentSyncService $sync) {}
+    public function __construct(
+        private FulfillmentSyncService $sync,
+        private OrderSyncService $orderSync,
+    ) {}
 
     public function index(Request $request): View
     {
@@ -58,4 +62,25 @@ class OrderController extends Controller
 
         return back()->with('success', 'Fulfillment status updated.');
     }
+
+    public function sync(Request $request): RedirectResponse
+    {
+        $validated = $request->validate([
+            'store' => ['required', 'integer'],
+        ]);
+
+        $store = WooStore::query()
+            ->where('user_id', $request->user()->id)
+            ->whereKey((int) $validated['store'])
+            ->where('status', WooStore::STATUS_ACTIVE)
+            ->firstOrFail();
+
+        $count = $this->orderSync->syncOrders($store);
+
+        return back()->with('success', sprintf(
+            'Synced %d orders from %s.',
+            $count,
+            $store->site_name ?? $store->site_url,
+        ));
+    }
 }