From 1fe8aa7a6b4839b86bc1c4ea49421dca123c9fd0 Mon Sep 17 00:00:00 2001
From: "Ronald A. Richardson" <me@ron.dev>
Date: Tue, 13 Oct 2026 16:57:11 +0800
Subject: [PATCH] fix(routes): throttle the public SMS-sending routes per
 address

Driver and customer login-with-sms, forgot-password and request-creation-code
get a 5-a-minute bucket per address on top of the API credential throttle. An
extra layer only: core's SmsGuard budgets bound the spend when an attacker has
many addresses.
---
 server/src/routes.php | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/server/src/routes.php b/server/src/routes.php
index 8060b5512..312b69ecf 100644
--- a/server/src/routes.php
+++ b/server/src/routes.php
@@ -54,14 +54,16 @@ function ($router) {
             // drivers routes
             $router->group(['prefix' => 'drivers', 'middleware' => []], function () use ($router) {
                 $router->post('register-device', 'DriverController@registerDevice');
-                $router->post('login-with-sms', 'DriverController@loginWithPhone');
+                // Routes that send a text message carry a small per-address bucket on top
+                // of the API credential throttle; the SMS guard in core bounds the spend.
+                $router->post('login-with-sms', 'DriverController@loginWithPhone')->middleware('throttle:5,1,fleetops-sms');
                 $router->post('verify-code', 'DriverController@verifyCode');
                 $router->post('login', 'DriverController@login');
                 // Password management. Deliberately separate from the driver
                 // update: changing a password requires proving the old one, and
                 // resetting it requires a code, neither of which a general PUT
                 // can express.
-                $router->post('forgot-password', 'DriverController@forgotPassword');
+                $router->post('forgot-password', 'DriverController@forgotPassword')->middleware('throttle:5,1,fleetops-sms');
                 $router->post('reset-password', 'DriverController@resetPassword');
                 $router->post('{id}/change-password', 'DriverController@changePassword');
                 $router->post('{id}/simulate', 'DriverController@simulate');
@@ -97,12 +99,12 @@ function ($router) {
             //  - Authenticated endpoints: API key + `Customer-Token` header (Sanctum)
             $router->group(['prefix' => 'customers', 'middleware' => []], function () use ($router) {
                 // Public auth flows
-                $router->post('request-creation-code', 'CustomerController@requestCreationCode');
+                $router->post('request-creation-code', 'CustomerController@requestCreationCode')->middleware('throttle:5,1,fleetops-sms');
                 $router->post('/', 'CustomerController@create');
                 $router->post('login', 'CustomerController@login');
-                $router->post('login-with-sms', 'CustomerController@loginWithPhone');
+                $router->post('login-with-sms', 'CustomerController@loginWithPhone')->middleware('throttle:5,1,fleetops-sms');
                 $router->post('verify-code', 'CustomerController@verifyCode');
-                $router->post('forgot-password', 'CustomerController@forgotPassword');
+                $router->post('forgot-password', 'CustomerController@forgotPassword')->middleware('throttle:5,1,fleetops-sms');
                 $router->post('reset-password', 'CustomerController@resetPassword');
 
                 // Authenticated (require Customer-Token)