SandboxDemo - User Guide (English)

The SandboxDemo plugin provides a “sandbox” mechanism to prevent dangerous write/delete operations in demo environments within the GP247 ecosystem.

1. Plugin Information

Ensure the source code is located at app/GP247/Plugins/SandboxDemo.
Go to the admin Extensions page, find the SandboxDemo plugin and click Install.
After installation, click Enable to activate it.
When enabled, the sandbox-demo middleware will be automatically applied to the following groups: admin, api.extend, partner, pmo.

Alias: sandbox-demo (registered and attached in Provider.php).
Preconditions: A valid login session (admin/partner/pmo/vendor) and SANDBOX_DEMO_ENABLED is enabled.
Allowed: GET requests that are not in the block lists.
Blocked: Other request methods will return 403 or a JSON response { error: 1, msg: "Access denied for sandbox demo" }.
Always-block paths: upload delete/move/rename/crop... endpoints for admin, multivendor, partner groups (auto-built from configured prefixes).
You can extend via:
- routeAlwaysAllow(): allow by route name (highest priority).
- pathAlwaysAllow(): allow by path (highest priority).
- routeAlwaysBlock(): add route names to block.
- pathAlwaysBlock(): add specific paths to block. (Allow-list has higher priority than block-list.)

Sandbox is designed to protect demo environments by restricting dangerous write/delete behaviors.
Plugin Activation: By default, the plugin will not be activated after installation until the SANDBOX_DEMO_ENABLED variable in the .env file is set to 1. If this variable doesn't exist in your .env file, add it:
```
SANDBOX_DEMO_ENABLED=1
```

Note that setting SANDBOX_DEMO_ENABLED=0 or removing the SANDBOX_DEMO_ENABLED variable will disable the plugin even if it is enabled in admin.