fix: add .env.local to gitignore

- Move PayPal live/sandbox API keys to env variables
- Move hardcoded API token in isAuthorized middleware to env variable
- Add api_token key to config/app.php
- Update .env.example with new required env vars
- Fix isAuthorized response code from 503 to 401

.env.example

@@ -11,6 +11,13 @@ CACHE_DRIVER=file
 SESSION_DRIVER=file
 QUEUE_DRIVER=sync
 
+PAYPAL_SANDBOX_CLIENT_ID=
+PAYPAL_SANDBOX_SECRET=
+PAYPAL_LIVE_CLIENT_ID=
+PAYPAL_LIVE_SECRET=
+
+API_TOKEN=
+
 MAIL_DRIVER=smtp
 MAIL_HOST=mailtrap.io
 MAIL_PORT=2525

.env.local

@@ -1,26 +0,0 @@
-# Local Development Configuration
-# Copy to .env.local and fill in your values.
-
-# ── MinIO credentials ─────────────────────────────────────────────────────────
-MINIO_KEY=your_minio_root_user
-MINIO_SECRET=your_minio_root_password
-
-# ── SSH tunnel (remote DB) ────────────────────────────────────────────────────
-# Only needed when starting with --profile ssh-db.
-# NOTE: no inline comments allowed after values — Docker reads them literally.
-
-SSH_HOST=136.114.183.15
-SSH_PORT=22
-SSH_USER=webmaster
-# Must be an absolute path — Docker Compose does NOT expand ~
-SSH_KEY_PATH=/Users/webmaster/.ssh/id_ed25519_crew_webmaster
-
-SSH_DB_REMOTE_HOST=127.0.0.1
-SSH_DB_REMOTE_PORT=3306
-
-# Tell the app to route DB traffic through the tunnel container:
-DB_HOST=db-tunnel
-DB_PORT=3306
-DB_DATABASE=custom_designs
-DB_USERNAME=root
-DB_PASSWORD=VeryStrongRootPass2025!

.gitignore

@@ -1,6 +1,7 @@
 /vendor
 /node_modules
 .env
+.env.local
 
 # SSH Keys - Never commit private keys
 *.ppk

app/Http/Middleware/isAuthorized.php

@@ -13,11 +13,11 @@ class isAuthorized {
 	 */
 	public function handle($request, Closure $next)
 	{
-		if(isset(getallheaders()['token']) && getallheaders()['token']=="1HHIaIsT4pvO2S39vMzlVfGWi3AhAz6F5xGBNKil") {
+		$token = $request->header('token') ?? (getallheaders()['token'] ?? null);
+		if ($token && $token === config('app.api_token')) {
 			return $next($request);
-		}else{
-				return response()->json(['status' => false,'error' => "Invalid request"], 503);
 		}
+		return response()->json(['status' => false, 'error' => 'Invalid request'], 401);
 	}
 
 }

config/app.php

@@ -80,6 +80,8 @@ return [
 
 	'key' => env('APP_KEY', 'SomeRandomString'),
 
+	'api_token' => env('API_TOKEN'),
+
 	'cipher' => MCRYPT_RIJNDAEL_128,
 
 	/*

config/services.php

@@ -36,13 +36,13 @@ return [
 
 	// sandbox
 	'paypal_sandbox' => [
-    'client_id' => 'AQuz-HKzQiL7FygkG8skSekaWf-RP6Rgj4f1XeX1Ghp86bUFj7tQXVT1xbpluu5_WCGRbQpOVGtlJKVB',
-		'secret' => 'EJAMKxQsl-mFkL_4J_90cvTamYfcsgswqgIxz9wQPiRAwJ6sy_wNsttMlmrXIpxI96JpYzdMXkLCHAPz'
+		'client_id' => env('PAYPAL_SANDBOX_CLIENT_ID'),
+		'secret'    => env('PAYPAL_SANDBOX_SECRET'),
 	],
 
 	// live
 	'paypal_live' => [
-    'client_id' => 'AUqBUFW5lfyYmrlBtFZA3RNw45sttM3ltbvS_d4qCVBMrkcMG9rEeivGvtNFSy8XTiEp50YyQ6khKxbq',
-	 	'secret' => 'ELlnuiupoFKwGUSc2g5j-sD1EmsvKpdhth1gFV7njpfvyNtKsK8WwIKUMOS0ehJcRatV865eMhfgsnd_'
+		'client_id' => env('PAYPAL_LIVE_CLIENT_ID'),
+		'secret'    => env('PAYPAL_LIVE_SECRET'),
 	],
 ];