bmiadmin

Repositories Projects Packages

26

Public activity Starred repositories

factory/jurisdiction (0.5.0)

Published 2026-08-07 18:49:44 +00:00 by bmiadmin

Installation

Setup this registry in your ~/.composer/config.json file:

{
	"repositories": [{
			"type": "composer",
			"url": ""
		}
	]
}

To install the package using Composer, run the following command:

composer require factory/jurisdiction:0.5.0

For more information on the Composer registry, see the documentation.

About this package

SaaS Factory jurisdiction: server-authoritative currency→gateway routing table (platform-admin editable), fail-closed resolver, and a fixed gateway catalogue. Mirrors the factory_core Dart GatewayRouter wire shape.

factory/jurisdiction — v0.2.1

Server-authoritative currency→gateway routing for the factory. Answers one question — "which payment processor charges this currency?" — and lets a founder re-answer it without a redeploy. The PHP peer of factory_core's Dart GatewayRouter: same contract, same wire shape ({currency: gatewayId}), so client and server never disagree.

Provides

• Gateway catalogue — config('jurisdiction.gateways'), id → label. The FIXED set of processors with a real integration adapter (mpesa_daraja, paystack, flutterwave, stripe, mtn_momo_api). Code, not data — a route can only point here. Mirrors kGatewayCatalogue.
• Routing resolver — GatewayResolver::gatewayForCurrency(), fail-closed: platform-admin override → config default (kDefaultGatewayRouter) → null. An unrouted currency returns null and checkout must refuse, never guess. Overrides pointing at a retired (uncatalogued) gateway are ignored, not trusted.
• Editor API — Http\Controllers\GatewayRouteController:
  • GET /api/gateway-routes (public) — {routes: {currency: gatewayId}, catalogue}. Clients hydrate GatewayRouter.fromJson(data.routes).
  • PUT /api/gateway-routes/{currency} (platform_admin) — assign a catalogue gateway.
  • DELETE /api/gateway-routes/{currency} (platform_admin) — drop the override, fall back to the config default (idempotent).
• Real RBAC on the writes — factory.auth → factory.scope → factory.role:platform_admin, from factory/auth. This package ships no authorization mechanism of its own; it consumes one.
• Audited writes — every assign/unassign runs through the kernel audit chokepoint (gateway_route.assigned / .unassigned) inside a transaction; audit failure rolls the change back. The actor is resolved by the chokepoint from the authenticated token, so each row names the person who moved the routing.

Data

• gateway_routes — global (NOT product-scoped): gateway assignment is a platform-level lever. Primary key is the currency, so a currency routes to exactly one processor. Absent row ⇒ config default ⇒ (if also absent) unrouted. updated_by holds the acting user's ref.

Config expected from the host app

None. config/jurisdiction.php is merged by the provider and needs no env keys.

Upgrading 0.1.x → 0.2.0 (breaking)

The X-Super-Admin-Token shared secret is gone, not deprecated. It was fail-closed but it authenticated a string rather than a person: one value shared by everyone who could reroute the world's payments, visible in shell history and CI logs, rotatable only by locking out everybody at once, and every audit row it produced said super-admin — recording that somebody knew the secret, never who.

To upgrade:

1. Install factory/auth (^0.1) — it is now a hard requirement.
2. Grant yourself the platform membership once (Memberships::grant($user, Membership::PLATFORM, Role::PlatformAdmin)), then mint a token: php artisan factory:token you@example.test --product=__platform__ --name=cockpit The role — and therefore the ability ceiling — comes from that membership, so a token can never out-rank the person holding it.
3. Call the editor with Authorization: Bearer <token> instead of X-Super-Admin-Token. Send no X-Product-Slug: this table is global, and a platform token with no header deliberately binds no product.
4. Delete FACTORY_SUPERADMIN_TOKEN from every .env — nothing reads it, and a retired secret left in place is one somebody later assumes still works.

config('jurisdiction.super_admin_token') and the factory.super-admin middleware alias no longer exist; anything still referencing either will fail loudly.

Dependencies

Dependencies

ID	Version
factory/auth	^0.1 || ^0.2 || ^0.3
factory/infra	^0.1 || ^0.2
factory/kernel	^0.3 || ^0.4 || ^0.5 || ^0.6 || ^0.7 || ^0.8 || ^0.9
illuminate/database	^10.0 || ^11.0 || ^12.0 || ^13.0
illuminate/http	^10.0 || ^11.0 || ^12.0 || ^13.0
illuminate/routing	^10.0 || ^11.0 || ^12.0 || ^13.0
illuminate/support	^10.0 || ^11.0 || ^12.0 || ^13.0
php	^8.2

Development dependencies

ID	Version
orchestra/testbench	^8.0 || ^9.0 || ^10.0 || ^11.0
phpunit/phpunit	^10.1 || ^11.0 || ^12.0

Details

Composer

2026-08-07 18:49:44 +00:00

48

proprietary

55 KiB

Assets (1)

factory-jurisdiction.0.5.0.zip 55 KiB

Versions (4) View all

0.5.2 2026-08-16

0.5.1 2026-08-14

0.5.0 2026-08-07

0.4.0 2026-08-06