fix: replace localhost with machine IP in provision.sh and Laravel config to resolve CSRF issues

back/src/app/Http/Middleware/TrustProxies.php

@@ -12,7 +12,7 @@ class TrustProxies extends Middleware
      *
      * @var array<int, string>|string|null
      */
-    protected $proxies;
+    protected $proxies = '*';
 
     /**
      * The headers that should be used to detect proxies.

back/src/config/cors.php

@@ -19,7 +19,7 @@
 
     'allowed_methods' => ['*'],
 
-    'allowed_origins' => [env('FRONTEND_URL', 'http://localhost:5173')],
+    'allowed_origins' => explode(',', env('FRONTEND_URL', 'http://localhost:5173')),
 
     'allowed_origins_patterns' => [],
 

back/src/config/session.php

@@ -155,7 +155,7 @@
     |
     */
 
-    'domain' => env('SESSION_DOMAIN', 'localhost'),
+    'domain' => env('SESSION_DOMAIN') === '' ? null : env('SESSION_DOMAIN', 'localhost'),
 
     /*
     |--------------------------------------------------------------------------
@@ -168,7 +168,7 @@
     |
     */
 
-    'secure' => env('SESSION_SECURE_COOKIE'),
+    'secure' => env('SESSION_SECURE_COOKIE', false),
 
     /*
     |--------------------------------------------------------------------------

front/src/components/Header.tsx

@@ -86,11 +86,11 @@ export default function Header() {
 
   async function handleLogout() {
     try {
-      await axios.get(`${import.meta.env.VITE_API_URL}/sanctum/csrf-cookie`, {
+      await axios.get(`/sanctum/csrf-cookie`, {
         withCredentials: true,
       });
       await axios.post(
-        `${import.meta.env.VITE_API_URL}/logout`,
+        `/logout`,
         {},
         {
           headers: {

front/src/context/UserContext.tsx

@@ -17,13 +17,13 @@ export function UserProvider({ children }: { children: React.ReactNode }) {
         const token = localStorage.getItem("auth_token");
         if (token) {
             Promise.all([
-                axios.get(`${import.meta.env.VITE_API_URL}/api/user`, {
+                axios.get(`/api/user`, {
                     headers: {
                         Authorization: `Bearer ${token}`,
                         Accept: "application/json"
                     }
                 }),
-                axios.get(`${import.meta.env.VITE_API_URL}/api/user/roles`, {
+                axios.get(`/api/user/roles`, {
                     headers: {
                         Authorization: `Bearer ${token}`,
                         Accept: "application/json"

front/src/main.tsx

@@ -8,7 +8,7 @@ import RealtimeNotifications from "./components/RealtimeNotifications.tsx";
 import axios from "axios";
 
 // Configure axios defaults for the app: base URL and send credentials (for Sanctum)
-const API_URL = import.meta.env?.VITE_API_URL || "http://localhost:8000";
+const API_URL = import.meta.env?.VITE_API_URL || "";
 axios.defaults.baseURL = API_URL;
 axios.defaults.withCredentials = true;
 

front/src/pages/login/Login.tsx

@@ -47,13 +47,13 @@ export default function Login() {
       localStorage.setItem("auth_token", token);
 
       const [userRes, rolesRes] = await Promise.all([
-        axios.get(`${import.meta.env.VITE_API_URL}/api/user`, {
+        axios.get(`/api/user`, {
           headers: {
             Authorization: `Bearer ${token}`,
             Accept: "application/json",
           },
         }),
-        axios.get(`${import.meta.env.VITE_API_URL}/api/user/roles`, {
+        axios.get(`/api/user/roles`, {
           headers: {
             Authorization: `Bearer ${token}`,
             Accept: "application/json",

front/src/pages/perfil/ProfileView.tsx

@@ -109,10 +109,9 @@ function ProfileHeader({ user, setUser, setNotification }: ProfileHeaderProps) {
   const userInitial = displayName.charAt(0).toUpperCase();
 
   async function onSave() {
-    const token = localStorage.getItem("auth_token") || "";
     try {
       setSaving(true);
-      const data = await updateName(name, token);
+      const data = await updateName(name);
       setUser({ ...user, name: data.name });
       setEditing(false);
       setNotification({ type: "success", message: "Nome atualizado com sucesso." });

front/src/services/ActivitiesService.ts

@@ -4,7 +4,7 @@ import { fakePageActivities } from "../mocks";
 import axios from "axios";
 import Cookies from "js-cookie";
 
-const API_URL = import.meta.env.VITE_API_URL;
+const API_URL = "";
 
 function getHeaders() {
   return {

front/src/services/ChangePasswordService.ts

@@ -8,11 +8,11 @@ export async function changePassword({
     newPasswordConfirmation 
 }: ChangePasswordRequest): Promise<void> {
 
-    await axios.get(`${import.meta.env.VITE_API_URL}/sanctum/csrf-cookie`, {
+    await axios.get(`/sanctum/csrf-cookie`, {
         withCredentials: true
     });
 
-    await axios.post(`${import.meta.env.VITE_API_URL}/api/user/change-password`, {
+    await axios.post(`/api/user/change-password`, {
         current_password: currentPassword,
         new_password: newPassword,
         new_password_confirmation: newPasswordConfirmation

front/src/services/ClassesService.ts

@@ -8,7 +8,7 @@ import type {
   AddStudentToClassDTO,
 } from "@/types/classes";
 
-const API_URL = import.meta.env.VITE_API_URL || "http://localhost:8000/api";
+const API_URL = import.meta.env?.VITE_API_URL || "";
 
 const api = axios.create({
   baseURL: API_URL,
@@ -39,7 +39,7 @@ function handleAuthError(error: unknown) {
 
 // Interceptor para adicionar token se necessário
 api.interceptors.request.use((config) => {
-  const token = localStorage.getItem("token");
+  const token = localStorage.getItem("auth_token");
   if (token) {
     config.headers.Authorization = `Bearer ${token}`;
   }
@@ -49,7 +49,7 @@ api.interceptors.request.use((config) => {
 export const ClassesService = {
   // Listar todas as turmas
   getAllClasses: async (): Promise<Class[]> => {
-    const response = await api.get("api/turmas", {
+    const response = await api.get("/api/turmas", {
       headers:getAuthHeaders(),
       withCredentials:true
     });
@@ -58,7 +58,7 @@ export const ClassesService = {
 
   // Buscar turma por ID
   getClassById: async (id: number): Promise<Class> => {
-    const response = await api.get(`api/turmas/${id}`, {
+    const response = await api.get(`/api/turmas/${id}`, {
       headers:getAuthHeaders(),
       withCredentials:true
     });
@@ -67,7 +67,7 @@ export const ClassesService = {
 
   // Criar nova turma
   createClass: async (data: CreateClassDTO): Promise<Class> => {
-    const response = await api.post("api/turmas", data, {
+    const response = await api.post("/api/turmas", data, {
       headers:getAuthHeaders(),
       withCredentials:true
     });
@@ -76,7 +76,7 @@ export const ClassesService = {
 
   // Atualizar turma
   updateClass: async (id: number, data: UpdateClassDTO): Promise<Class> => {
-    const response = await api.put(`api/turmas/${id}`, data, {
+    const response = await api.put(`/api/turmas/${id}`, data, {
       headers:getAuthHeaders(),
       withCredentials:true
     });
@@ -85,15 +85,15 @@ export const ClassesService = {
 
   // Deletar turma
   deleteClass: async (id: number): Promise<void> => {
-    await api.delete(`api/turmas/${id}`, {
+    await api.delete(`/api/turmas/${id}`, {
       headers:getAuthHeaders(),
       withCredentials:true
     });
   },
 
   // Buscar turmas de um professor
   getClassesByTeacher: async (): Promise<Class[]> => {
-    const response = await api.get(`api/turmas`, {
+    const response = await api.get(`/api/turmas`, {
       headers:getAuthHeaders(),
       withCredentials:true
     });
@@ -102,7 +102,7 @@ export const ClassesService = {
 
   // Buscar turmas de um aluno
   getClassesByStudent: async (): Promise<Class[]> => {
-    const response = await api.get(`api/turmas`, {
+    const response = await api.get(`/api/turmas`, {
       headers:getAuthHeaders(),
       withCredentials:true
     });
@@ -112,7 +112,7 @@ export const ClassesService = {
   // Buscar alunos de uma turma
   getClassStudents: async (id: number): Promise<ClassStudent[]> => {
     try {
-      const response = await api.get(`api/turmas/${id}`, {
+      const response = await api.get(`/api/turmas/${id}`, {
         headers: getAuthHeaders(),
         withCredentials: true
       });
@@ -139,7 +139,7 @@ export const ClassesService = {
   // Adicionar aluno a uma turma
   addStudentToClass: async (classId: number, data: AddStudentToClassDTO): Promise<void> => {
     try {
-      await api.post(`api/turmas/${classId}/vincular-aluno/${data.studentId}`, {}, {
+      await api.post(`/api/turmas/${classId}/vincular-aluno/${data.studentId}`, {}, {
         headers: getAuthHeaders(),
         withCredentials: true
       });
@@ -152,7 +152,7 @@ export const ClassesService = {
   // Remover aluno de uma turma
   removeStudentFromClass: async (classId: number, studentId: number): Promise<void> => {
     try {
-      await api.delete(`api/turmas/${classId}/desvincular-aluno/${studentId}`, {
+      await api.delete(`/api/turmas/${classId}/desvincular-aluno/${studentId}`, {
         headers: getAuthHeaders(),
         withCredentials: true
       });

front/src/services/CoursesService.ts

@@ -32,7 +32,7 @@ function handleAuthError(error: unknown) {
  */
 export async function getAllCourses(): Promise<Curso[]> {
   try {
-    const response = await axios.get(`${import.meta.env.VITE_API_URL}/api/cursos`, {
+    const response = await axios.get(`/api/cursos`, {
       headers: getAuthHeaders(),
       withCredentials: true,
     });

front/src/services/ForgotPasswordService.ts

@@ -2,11 +2,11 @@ import axios from "axios";
 import Cookies from "js-cookie";
 
 export async function sendForgotPasswordEmail(email: string): Promise<void> {
-    await axios.get(`${import.meta.env.VITE_API_URL}/sanctum/csrf-cookie`, {
+    await axios.get(`/sanctum/csrf-cookie`, {
         withCredentials: true
     });
 
-    await axios.post(`${import.meta.env.VITE_API_URL}/api/forgot-password-temp`, {
+    await axios.post(`/api/forgot-password-temp`, {
         email
     }, {
         withCredentials: true,
@@ -24,11 +24,11 @@ export async function resetPassword(data: {
     password: string;
     password_confirmation: string;
 }): Promise<void> {
-    await axios.get(`${import.meta.env.VITE_API_URL}/sanctum/csrf-cookie`, {
+    await axios.get(`/sanctum/csrf-cookie`, {
         withCredentials: true
     });
 
-    await axios.post(`${import.meta.env.VITE_API_URL}/reset-password`, data, {
+    await axios.post(`/reset-password`, data, {
         withCredentials: true,
         headers: {
             'Content-Type': 'application/json',

front/src/services/JamSessionService.ts

@@ -2,7 +2,7 @@ import axios from "axios";
 import Cookies from "js-cookie";
 import type { JamSession, CreateJamSessionDTO, JamParticipant } from "@/types/jam";
 
-const API_URL = import.meta.env.VITE_API_URL || "http://localhost:8000/api";
+const API_URL = import.meta.env?.VITE_API_URL || "";
 const WS_URL = import.meta.env.VITE_WS_URL || "ws://localhost:3002";
 
 const api = axios.create({
@@ -24,55 +24,55 @@ function getAuthHeaders() {
 
 export const JamSessionService = {
   getByTurma: async (turmaId: number): Promise<JamSession[]> => {
-    const response = await api.get(`api/jam-sessions?turma_id=${turmaId}`, {
+    const response = await api.get(`/api/jam-sessions?turma_id=${turmaId}`, {
       headers: getAuthHeaders(),
       withCredentials: true,
     });
     return response.data;
   },
 
   getById: async (id: number): Promise<JamSession> => {
-    const response = await api.get(`api/jam-sessions/${id}`, {
+    const response = await api.get(`/api/jam-sessions/${id}`, {
       headers: getAuthHeaders(),
       withCredentials: true,
     });
     return response.data;
   },
 
   create: async (data: CreateJamSessionDTO): Promise<JamSession> => {
-    const response = await api.post("api/jam-sessions", data, {
+    const response = await api.post("/api/jam-sessions", data, {
       headers: getAuthHeaders(),
       withCredentials: true,
     });
     return response.data;
   },
 
   start: async (id: number): Promise<JamSession> => {
-    const response = await api.post(`api/jam-sessions/${id}/start`, {}, {
+    const response = await api.post(`/api/jam-sessions/${id}/start`, {}, {
       headers: getAuthHeaders(),
       withCredentials: true,
     });
     return response.data;
   },
 
   finish: async (id: number): Promise<JamSession> => {
-    const response = await api.post(`api/jam-sessions/${id}/finish`, {}, {
+    const response = await api.post(`/api/jam-sessions/${id}/finish`, {}, {
       headers: getAuthHeaders(),
       withCredentials: true,
     });
     return response.data;
   },
 
   join: async (id: number): Promise<JamParticipant> => {
-    const response = await api.post(`api/jam-sessions/${id}/join`, {}, {
+    const response = await api.post(`/api/jam-sessions/${id}/join`, {}, {
       headers: getAuthHeaders(),
       withCredentials: true,
     });
     return response.data;
   },
 
   getActiveForTurma: async (turmaId: number): Promise<JamSession | null> => {
-    const response = await api.get(`api/turmas/${turmaId}/jam-session/active`, {
+    const response = await api.get(`/api/turmas/${turmaId}/jam-session/active`, {
       headers: getAuthHeaders(),
       withCredentials: true,
     });

front/src/services/LoginService.ts

@@ -4,12 +4,12 @@ import Cookies from "js-cookie";
 
 export async function login({ email, password }: LoginRequest): Promise<string>{
 
-    await axios.get(`${import.meta.env.VITE_API_URL}/sanctum/csrf-cookie`, {
+    await axios.get(`/sanctum/csrf-cookie`, {
         withCredentials: true
     });
 
 
-    const res = await axios.post(`${import.meta.env.VITE_API_URL}/login`, {
+    const res = await axios.post(`/login`, {
         email,
         password
     }, {