boursecu_server/app/Providers/RouteServiceProvider.php

<?php

namespace App\Providers;

use Illuminate\Cache\RateLimiting\Limit;
use Illuminate\Foundation\Support\Providers\RouteServiceProvider as ServiceProvider;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\RateLimiter;
use Illuminate\Support\Facades\Route;

class RouteServiceProvider extends ServiceProvider
{
    /**
     * The path to the "home" route for your application.
     *
     * This is used by Laravel authentication to redirect users after login.
     *
     * @var string
     */
    public const HOME = '/home';

    /**
     * The controller namespace for the application.
     *
     * When present, controller route declarations will automatically be prefixed with this namespace.
     *
     * @var string|null
     */
    // protected $namespace = 'App\\Http\\Controllers';

    /**
     * Define your route model bindings, pattern filters, etc.
     *
     * @return void
     */
    public function boot()
    {
        $this->configureRateLimiting();

        $this->routes(function () {
            Route::prefix('api')
                ->middleware('api')
                ->namespace($this->namespace)
                ->group(base_path('routes/api.php'));
            Route::prefix('auth')
                ->middleware('api')
                ->namespace($this->namespace)
                ->group(base_path('routes/auth.php'));
            Route::prefix('admin')
                ->middleware('api')
                ->namespace($this->namespace)
                ->group(base_path('routes/admin.php'));
            Route::prefix('customer')
                ->middleware('api')
                ->namespace($this->namespace)
                ->group(base_path('routes/customer.php'));

            Route::prefix('pargar')
                ->middleware('api')
                ->namespace($this->namespace)
                ->group(base_path('routes/pargar.php'));

            Route::middleware('web')
                ->namespace($this->namespace)
                ->group(base_path('routes/web.php'));
        });
    }

    /**
     * Configure the rate limiters for the application.
     *
     * @return void
     */
    protected function configureRateLimiting()
    {
        RateLimiter::for('api', function (Request $request) {
            // throttle قبل از auth اجرا می‌شود → اغلب فقط IP داریم.
            // پنل ادمین با polling قیمت (/admin/p) + اکشن سریع به‌راحتی از ۶۰/دقیقه رد می‌شود → ۴۲۹.
            if ($request->is('admin/*')) {
                return Limit::perMinute(600)->by('admin:'.$request->ip());
            }

            $userId = optional($request->user())->id
                ?? optional($request->user('customer'))->id
                ?? optional($request->user('user'))->id;

            if ($userId) {
                return Limit::perMinute(180)->by((string) $userId);
            }

            return Limit::perMinute(60)->by($request->ip());
        });
    }
}