feat: add API key authentication and update tests

Adds `VerifyApiKey` middleware protecting all API routes with `X-Api-Key` header validation. Wraps `/api/stations`, `/api/stats/searches`, and `/api/prediction` in throttled middleware group (60 req/min). Updates StationSearchTest to use `RefreshDatabase`, adds `meta` assertion checks, and validates `fuel_type` in HTTP request assertions. Removes auth routes from API docs and replaces with API key authentication instructions. Adds `api_secret_key` config option.
2026-04-05 20:27:41 +01:00
parent 1318e3ac3b
commit 1860cf0a49
3 changed files with 31 additions and 97 deletions
--- a/config/app.php
+++ b/config/app.php
@@ -118,6 +118,8 @@ return [
    |
    */

+    'api_secret_key' => env('API_SECRET_KEY'),
+
    'maintenance' => [
        'driver' => env('APP_MAINTENANCE_DRIVER', 'file'),
        'store' => env('APP_MAINTENANCE_STORE', 'database'),