Update authentication logic and SDK fixes

app/Http/Controllers/WalletController.php

@@ -25,7 +25,7 @@ class WalletController extends Controller
     /** GET /v2/wallet/passenger */
     public function index(Request $request): JsonResponse
     {
-        $id = $request->input('_jwt_user_id');
+        $id = $request->attributes->get('_jwt_user_id');
         $wallet = DB::connection('primary')->table('passengerWallet')
             ->where('passenger_id', $id)->first();
 
@@ -38,7 +38,7 @@ class WalletController extends Controller
     /** GET /v2/wallet/passenger/balance */
     public function balance(Request $request): JsonResponse
     {
-        $id = $request->input('_jwt_user_id');
+        $id = $request->attributes->get('_jwt_user_id');
         $bal = DB::connection('primary')->table('passengerWallet')
             ->where('passenger_id', $id)->value('balance') ?? '0.00';
 
@@ -53,7 +53,7 @@ class WalletController extends Controller
             'payment_method' => 'required|string',
         ]);
 
-        $id = $request->input('_jwt_user_id');
+        $id = $request->attributes->get('_jwt_user_id');
 
         DB::connection('primary')->beginTransaction();
         try {
@@ -95,15 +95,22 @@ class WalletController extends Controller
         }
     }
 
-    /** PUT /v2/wallet/passenger */
+    /** PUT /v2/wallet/passenger — ADMIN ONLY */
     public function update(Request $request): JsonResponse
     {
-        $request->validate(['balance' => 'required|numeric|min:0']);
+        // Only admins can directly set balance
+        $userType = $request->attributes->get('_jwt_user_type');
+        if ($userType !== 'admin') {
+            return response()->json(['status' => 'failure', 'message' => 'Unauthorized'], 403);
+        }
 
-        $id = $request->input('_jwt_user_id');
+        $request->validate([
+            'balance' => 'required|numeric|min:0',
+            'passenger_id' => 'required|string',
+        ]);
 
         DB::connection('primary')->table('passengerWallet')
-            ->where('passenger_id', $id)
+            ->where('passenger_id', $request->input('passenger_id'))
             ->update(['balance' => $request->input('balance')]);
 
         return response()->json(['status' => 'success']);
@@ -112,7 +119,7 @@ class WalletController extends Controller
     /** DELETE /v2/wallet/passenger */
     public function destroy(Request $request): JsonResponse
     {
-        $id = $request->input('_jwt_user_id');
+        $id = $request->attributes->get('_jwt_user_id');
         DB::connection('primary')->table('passengerWallet')
             ->where('passenger_id', $id)->delete();
 
@@ -122,7 +129,7 @@ class WalletController extends Controller
     /** GET /v2/wallet/passenger/transactions */
     public function transactions(Request $request): JsonResponse
     {
-        $id = $request->input('_jwt_user_id');
+        $id = $request->attributes->get('_jwt_user_id');
         $page = (int) $request->input('page', 1);
         $limit = min((int) $request->input('limit', 20), 50);
 
@@ -145,7 +152,7 @@ class WalletController extends Controller
             'amount' => 'required|numeric|min:0.01',
         ]);
 
-        $id = $request->input('_jwt_user_id');
+        $id = $request->attributes->get('_jwt_user_id');
 
         DB::connection('primary')->table('payment_tokens_passenger')->insert([
             'token' => $request->input('token'),