refactor: implement strict admin authentication for management actions and add PIN verification flow for client access

app/Http/Controllers/ProjectController.php

@@ -25,10 +25,13 @@ class ProjectController extends Controller
         // Recalculate progress dynamically
         $project->recalculateProgress();
 
-        // Check if admin mode is active (logged in user OR session toggle)
+        // Strict Admin Check: ONLY logged-in admin users can edit/manage
-        $isAdminMode = Auth::check() || session()->get('admin_mode_' . $project->id, true);
+        $isAdminMode = Auth::check();
 
-        return view('projects.show', compact('project', 'isAdminMode'));
+        // Client PIN Verification Check: Admins are auto-verified, clients need PIN verification in session
+        $isVerified = $isAdminMode || session()->get('project_access_' . $project->id, false);
+
+        return view('projects.show', compact('project', 'isAdminMode', 'isVerified'));
     }
 
     /**
@@ -55,6 +58,13 @@ class ProjectController extends Controller
      */
     public function updateModuleStatus(Request $request, string $slug)
     {
+        if (!Auth::check()) {
+            if ($request->wantsJson() || $request->ajax()) {
+                return response()->json(['success' => false, 'message' => 'Bu işlem için yönetici girişi yapmanız gerekmektedir.'], 403);
+            }
+            return back()->withErrors(['error' => 'Yetkisiz erişim.']);
+        }
+
         $project = Project::where('slug', $slug)->firstOrFail();
 
         $request->validate([
@@ -67,8 +77,6 @@ class ProjectController extends Controller
             ->firstOrFail();
 
         $module->update(['status' => $request->input('status')]);
-
-        // Recalculate overall progress %
         $newProgress = $project->recalculateProgress();
 
         if ($request->wantsJson() || $request->ajax()) {
@@ -87,6 +95,13 @@ class ProjectController extends Controller
      */
     public function updateTaskStatus(Request $request, string $slug)
     {
+        if (!Auth::check()) {
+            if ($request->wantsJson() || $request->ajax()) {
+                return response()->json(['success' => false, 'message' => 'Bu işlem için yönetici girişi yapmanız gerekmektedir.'], 403);
+            }
+            return back()->withErrors(['error' => 'Yetkisiz erişim.']);
+        }
+
         $project = Project::where('slug', $slug)->firstOrFail();
 
         $request->validate([
@@ -123,6 +138,10 @@ class ProjectController extends Controller
      */
     public function addTask(Request $request, string $slug)
     {
+        if (!Auth::check()) {
+            return back()->withErrors(['error' => 'Yetkisiz erişim.']);
+        }
+
         $project = Project::where('slug', $slug)->firstOrFail();
 
         $request->validate([
@@ -154,6 +173,13 @@ class ProjectController extends Controller
      */
     public function deleteTask(Request $request, string $slug)
     {
+        if (!Auth::check()) {
+            if ($request->wantsJson() || $request->ajax()) {
+                return response()->json(['success' => false, 'message' => 'Yetkisiz erişim.'], 403);
+            }
+            return back()->withErrors(['error' => 'Yetkisiz erişim.']);
+        }
+
         $project = Project::where('slug', $slug)->firstOrFail();
 
         $request->validate([
@@ -176,6 +202,10 @@ class ProjectController extends Controller
      */
     public function addUpdate(Request $request, string $slug)
     {
+        if (!Auth::check()) {
+            return back()->withErrors(['error' => 'Yetkisiz erişim.']);
+        }
+
         $project = Project::where('slug', $slug)->firstOrFail();
 
         $request->validate([
@@ -200,6 +230,13 @@ class ProjectController extends Controller
      */
     public function deleteUpdate(Request $request, string $slug)
     {
+        if (!Auth::check()) {
+            if ($request->wantsJson() || $request->ajax()) {
+                return response()->json(['success' => false, 'message' => 'Yetkisiz erişim.'], 403);
+            }
+            return back()->withErrors(['error' => 'Yetkisiz erişim.']);
+        }
+
         $project = Project::where('slug', $slug)->firstOrFail();
 
         $request->validate([
@@ -227,22 +264,13 @@ class ProjectController extends Controller
      */
     public function recalculate(Request $request, string $slug)
     {
+        if (!Auth::check()) {
+            return back()->withErrors(['error' => 'Yetkisiz erişim.']);
+        }
+
         $project = Project::where('slug', $slug)->firstOrFail();
         $pct = $project->recalculateProgress();
 
         return back()->with('success', "Proje ilerleme yüzdesi yeniden hesaplandı: %{$pct}");
     }
-
-    /**
-     * Toggle Admin / Client View Mode in session
-     */
-    public function toggleAdminMode(Request $request, string $slug)
-    {
-        $project = Project::where('slug', $slug)->firstOrFail();
-        $key = 'admin_mode_' . $project->id;
-        $current = session()->get($key, true);
-        session()->put($key, !$current);
-
-        return back();
-    }
 }