Feat add payment with gateway of montify

app/Http/Controllers/Admin/SettingsController.php

@@ -30,25 +30,25 @@ class SettingsController extends Controller
             ->orderBy('key');
 
         if ($request->boolean('system_only')) {
-            return response()->json(
-                $query
-                    ->where(function ($q) {
-                        $q->where('can_edit', 0)->orWhere('can_edit', false);
-                    })
-                    ->where(function ($q) {
-                        $q->where('is_active', 1)
-                            ->orWhere('is_active', true)
-                            ->orWhere('is_active', '1');
-                    })
-                    ->get()
-            );
+            $rows = $query
+                ->where(function ($q) {
+                    $q->where('can_edit', 0)->orWhere('can_edit', false);
+                })
+                ->where(function ($q) {
+                    $q->where('is_active', 1)
+                        ->orWhere('is_active', true)
+                        ->orWhere('is_active', '1');
+                })
+                ->get();
+
+            return response()->json($this->authorizeSettingsPayload($rows));
         }
 
         if ($request->boolean('editable_only')) {
-            return response()->json($query->where('can_edit', 1)->get());
+            return response()->json($this->authorizeSettingsPayload($query->where('can_edit', 1)->get()));
         }
 
-        return response()->json($query->get());
+        return response()->json($this->authorizeSettingsPayload($query->get()));
     }
 
     public function edit(Request $request)
@@ -134,4 +134,20 @@ class SettingsController extends Controller
     {
         return in_array($key, self::PANEL_MANAGED_KEYS, true);
     }
+
+    /**
+     * اپ کاربر (بدون auth ادمین) هرگز secret/credential نمی‌بیند.
+     * پنل ادمین با auth:user همه کلیدها را می‌بیند.
+     *
+     * @param  \Illuminate\Support\Collection|\Illuminate\Database\Eloquent\Collection|iterable  $rows
+     * @return \Illuminate\Support\Collection
+     */
+    private function authorizeSettingsPayload($rows)
+    {
+        if (auth('user')->check()) {
+            return collect($rows)->values();
+        }
+
+        return Setting::forPublicApi($rows);
+    }
 }