2026-01-15 01:13:44 +00:00
|
|
|
<?php
|
|
|
|
|
|
refactor: settings redesign, Spanish translations, language system, strict_types
Settings pages:
- Redesign layout to match Sendkit (max-w-4xl, space-y-12, Separator sections)
- Merge Members page into Workspace settings with Table, invite Dialog, ConfirmDeleteModal
- Add workspace logo upload/delete routes and controller methods
- Translate all hardcoded strings in Workspace.vue modals
Language system:
- Drop languages table, replace language_id FK with locale string column on users
- Create config/languages.php for available languages and default locale
- Add Spanish (es) translations (13 files)
- Simplify HandleInertiaRequests, ProfileController, RegisteredUserController
Code quality:
- Add declare(strict_types=1) to all PHP files
- Fix MastodonPublisher using wrong attribute (filename -> original_filename)
- Fix HasMediaTest for new has_photo/photo_url accessors
- Fix PublishToSocialPlatformTest type error revealed by strict_types
- Remove orphaned Language model from AppServiceProvider morph map
- Update User TypeScript interface (has_photo, photo_url, locale)
- Eager load media relation on workspaces to prevent N+1
- Add 8 new tests for workspace logo upload/delete
- Update workspace settings test to assert members/invitations props
All 710 tests passing.
2026-03-30 03:20:43 +00:00
|
|
|
declare(strict_types=1);
|
|
|
|
|
|
2026-01-15 01:13:44 +00:00
|
|
|
namespace App\Http\Controllers\Auth;
|
|
|
|
|
|
feat: social account toggle action, API, MCP + full test coverage
- Extract ToggleSocialAccount action from SocialController
- Add API endpoints: GET /social-accounts, PUT /social-accounts/{id}/toggle
- Add MCP tools: ListSocialAccountsTool, ToggleSocialAccountTool
- Fix all MCP tools: findOrFail → find + Response::error for graceful errors
- Fix MCP tools using $request->validated() without validate() call
- Fix return types to Response|ResponseFactory for error paths
- Add SocialAccountResource is_active/status fields (no tokens exposed)
- Add 43 MCP tests covering all 18 tools (CRUD, validation, cross-workspace)
- Add API response structure tests for posts, hashtags, labels, workspace
- Add API validation tests for post create/update, api-key expiry, label color
- Add API cross-workspace delete tests for hashtags and labels
- Add app validation tests for hashtag/label update, invite fields, password
- Add auth required tests for notifications, profile delete, api-keys index
- Add media reorder validation tests
2026-03-31 04:42:39 +00:00
|
|
|
use App\Actions\SocialAccount\ToggleSocialAccount;
|
2026-05-02 15:22:42 +00:00
|
|
|
use App\Enums\PostPlatform\Status as PostPlatformStatus;
|
2026-01-17 17:44:37 +00:00
|
|
|
use App\Enums\SocialAccount\Platform as SocialPlatform;
|
|
|
|
|
use App\Enums\SocialAccount\Status;
|
feat: per-workspace pricing, onboarding, and billing overhaul
Pricing
- Bill per workspace ($12/mo or $120/yr each); Stripe quantity tracks the
workspace count and syncs on workspace create/delete.
- 2,500 AI credits per workspace, pooled at the account level; monthly reset
on the billing anniversary, annual granted upfront (no rollover).
- One social account per network per workspace; remove all count-based limits
(workspace/social/member) and the legacy plan tiers (single Workspace plan).
Onboarding (cloud only: SELF_HOSTED=false + PostHog)
- Replace the /subscribe plan picker with /onboarding persona selection
(Creator/Freelancer/Startup/Agency/Small business/Other), saved on the user
(users.persona) and mirrored to PostHog, then Stripe Checkout on the monthly
price. 8-day trial so Stripe displays 7.
Billing screen
- Remove the Change Plan dialog (dead with a single plan); add an annual-upgrade
banner for monthly subscribers (swapToYearly).
- Current-plan card shows the workspace count instead of the plan name.
System AI
- Brand analyzer / workspace autofill is always allowed and never debits credits
(system feature, not the user's usage).
Self-hosted (SELF_HOSTED=true) bypasses all billing, credit, limit, network,
and onboarding logic.
2026-06-21 23:40:03 +00:00
|
|
|
use App\Exceptions\SocialAccount\NetworkAlreadyConnectedException;
|
2026-01-15 01:13:44 +00:00
|
|
|
use App\Http\Controllers\Controller;
|
2026-05-02 17:15:41 +00:00
|
|
|
use App\Http\Resources\App\SocialAccountResource;
|
2026-01-15 01:13:44 +00:00
|
|
|
use App\Models\SocialAccount;
|
|
|
|
|
use App\Models\Workspace;
|
|
|
|
|
use Illuminate\Http\RedirectResponse;
|
|
|
|
|
use Illuminate\Http\Request;
|
|
|
|
|
use Illuminate\Support\Facades\Log;
|
2026-01-17 02:46:30 +00:00
|
|
|
use Illuminate\View\View;
|
2026-01-15 01:13:44 +00:00
|
|
|
use Inertia\Inertia;
|
|
|
|
|
use Inertia\Response;
|
|
|
|
|
use Laravel\Socialite\Facades\Socialite;
|
|
|
|
|
use Symfony\Component\HttpFoundation\Response as SymfonyResponse;
|
|
|
|
|
|
|
|
|
|
class SocialController extends Controller
|
|
|
|
|
{
|
2026-01-16 15:36:52 +00:00
|
|
|
protected SocialPlatform $platform;
|
|
|
|
|
|
|
|
|
|
protected function ensurePlatformEnabled(): void
|
|
|
|
|
{
|
|
|
|
|
if (isset($this->platform) && ! $this->platform->isEnabled()) {
|
2026-04-14 21:44:47 +00:00
|
|
|
abort(SymfonyResponse::HTTP_FORBIDDEN, 'This platform is currently unavailable.');
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
2026-01-17 02:46:30 +00:00
|
|
|
public function index(Request $request): Response|RedirectResponse
|
2026-01-15 01:13:44 +00:00
|
|
|
{
|
2026-01-17 02:46:30 +00:00
|
|
|
$workspace = $request->user()->currentWorkspace;
|
|
|
|
|
|
|
|
|
|
if (! $workspace) {
|
2026-03-29 22:24:28 +00:00
|
|
|
return redirect()->route('app.workspaces.create');
|
2026-01-17 02:46:30 +00:00
|
|
|
}
|
|
|
|
|
|
2026-06-22 20:04:09 +00:00
|
|
|
$this->authorize('manageAccounts', $workspace);
|
2026-01-15 01:13:44 +00:00
|
|
|
|
2026-06-25 00:05:09 +00:00
|
|
|
$platforms = collect(SocialPlatform::cases())
|
|
|
|
|
->filter(fn ($platform) => $platform->isConnectable())
|
|
|
|
|
->map(fn ($platform) => [
|
|
|
|
|
'value' => $platform->value,
|
|
|
|
|
'label' => $platform->label(),
|
|
|
|
|
'color' => $platform->color(),
|
|
|
|
|
'network' => $platform->network(),
|
|
|
|
|
])->values();
|
2026-01-15 01:13:44 +00:00
|
|
|
|
|
|
|
|
return Inertia::render('accounts/Index', [
|
|
|
|
|
'workspace' => $workspace,
|
|
|
|
|
'platforms' => $platforms,
|
2026-06-22 15:31:44 +00:00
|
|
|
'connectedAccounts' => SocialAccountResource::collection(
|
|
|
|
|
$workspace->socialAccounts()->orderBy('id')->get(),
|
|
|
|
|
)->resolve(),
|
2026-01-15 01:13:44 +00:00
|
|
|
]);
|
|
|
|
|
}
|
|
|
|
|
|
2026-01-17 02:46:30 +00:00
|
|
|
public function disconnect(Request $request, SocialAccount $account): RedirectResponse
|
2026-01-15 01:13:44 +00:00
|
|
|
{
|
2026-01-17 02:46:30 +00:00
|
|
|
$workspace = $request->user()->currentWorkspace;
|
|
|
|
|
|
|
|
|
|
if (! $workspace) {
|
2026-03-29 22:24:28 +00:00
|
|
|
return redirect()->route('app.workspaces.create');
|
2026-01-17 02:46:30 +00:00
|
|
|
}
|
|
|
|
|
|
2026-01-15 17:24:39 +00:00
|
|
|
$this->authorize('manageAccounts', $workspace);
|
2026-01-15 01:13:44 +00:00
|
|
|
|
|
|
|
|
if ($account->workspace_id !== $workspace->id) {
|
|
|
|
|
abort(403);
|
|
|
|
|
}
|
|
|
|
|
|
2026-05-02 15:22:42 +00:00
|
|
|
// Drop pending platform rows from drafts/scheduled posts so the account
|
|
|
|
|
// disappears cleanly from their UI. Published/failed rows survive via the
|
|
|
|
|
// FK's nullOnDelete cascade and keep their snapshot fields for history.
|
|
|
|
|
$account->postPlatforms()
|
|
|
|
|
->where('status', PostPlatformStatus::Pending->value)
|
|
|
|
|
->delete();
|
|
|
|
|
|
2026-01-15 01:13:44 +00:00
|
|
|
$account->delete();
|
|
|
|
|
|
2026-01-22 01:08:18 +00:00
|
|
|
session()->flash('flash.banner', __('accounts.flash.disconnected'));
|
2026-01-15 17:24:39 +00:00
|
|
|
session()->flash('flash.bannerStyle', 'success');
|
|
|
|
|
|
|
|
|
|
return back();
|
2026-01-15 01:13:44 +00:00
|
|
|
}
|
|
|
|
|
|
2026-03-31 00:18:07 +00:00
|
|
|
public function toggleActive(Request $request, SocialAccount $account): RedirectResponse
|
|
|
|
|
{
|
|
|
|
|
$workspace = $request->user()->currentWorkspace;
|
|
|
|
|
|
2026-03-31 03:40:18 +00:00
|
|
|
if (! $workspace) {
|
|
|
|
|
return redirect()->route('app.workspaces.create');
|
|
|
|
|
}
|
|
|
|
|
|
2026-03-31 00:18:07 +00:00
|
|
|
$this->authorize('manageAccounts', $workspace);
|
|
|
|
|
|
|
|
|
|
if ($account->workspace_id !== $workspace->id) {
|
|
|
|
|
abort(403);
|
|
|
|
|
}
|
|
|
|
|
|
feat: social account toggle action, API, MCP + full test coverage
- Extract ToggleSocialAccount action from SocialController
- Add API endpoints: GET /social-accounts, PUT /social-accounts/{id}/toggle
- Add MCP tools: ListSocialAccountsTool, ToggleSocialAccountTool
- Fix all MCP tools: findOrFail → find + Response::error for graceful errors
- Fix MCP tools using $request->validated() without validate() call
- Fix return types to Response|ResponseFactory for error paths
- Add SocialAccountResource is_active/status fields (no tokens exposed)
- Add 43 MCP tests covering all 18 tools (CRUD, validation, cross-workspace)
- Add API response structure tests for posts, hashtags, labels, workspace
- Add API validation tests for post create/update, api-key expiry, label color
- Add API cross-workspace delete tests for hashtags and labels
- Add app validation tests for hashtag/label update, invite fields, password
- Add auth required tests for notifications, profile delete, api-keys index
- Add media reorder validation tests
2026-03-31 04:42:39 +00:00
|
|
|
ToggleSocialAccount::execute($account);
|
2026-03-31 00:18:07 +00:00
|
|
|
|
|
|
|
|
$status = $account->is_active ? 'activated' : 'deactivated';
|
|
|
|
|
session()->flash('flash.banner', __("accounts.flash.{$status}"));
|
|
|
|
|
session()->flash('flash.bannerStyle', 'success');
|
|
|
|
|
|
|
|
|
|
return back();
|
|
|
|
|
}
|
|
|
|
|
|
2026-01-17 02:46:30 +00:00
|
|
|
protected function redirectToProvider(Request $request, string $driver, array $scopes): SymfonyResponse
|
2026-01-15 01:13:44 +00:00
|
|
|
{
|
2026-01-17 02:46:30 +00:00
|
|
|
$workspace = $request->user()->currentWorkspace;
|
|
|
|
|
|
|
|
|
|
if (! $workspace) {
|
2026-03-29 22:24:28 +00:00
|
|
|
return redirect()->route('app.workspaces.create');
|
2026-01-17 02:46:30 +00:00
|
|
|
}
|
|
|
|
|
|
2026-01-15 01:13:44 +00:00
|
|
|
session(['social_connect_workspace' => $workspace->id]);
|
|
|
|
|
|
|
|
|
|
return Inertia::location(
|
|
|
|
|
Socialite::driver($driver)
|
|
|
|
|
->scopes($scopes)
|
|
|
|
|
->redirect()
|
|
|
|
|
->getTargetUrl()
|
|
|
|
|
);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
protected function handleCallback(
|
|
|
|
|
Request $request,
|
|
|
|
|
SocialPlatform $platform,
|
|
|
|
|
string $driver
|
2026-01-17 02:46:30 +00:00
|
|
|
): View {
|
2026-01-15 01:13:44 +00:00
|
|
|
$workspaceId = session('social_connect_workspace');
|
|
|
|
|
|
|
|
|
|
if (! $workspaceId) {
|
feat: localize OAuth popup callback messages across 12 controllers
User reported the social-account OAuth callback popup ('Threads account
connected!') stayed in English regardless of the active locale. The
hardcoded message was wired through SocialController and 11 platform
controllers (Bluesky, Facebook, Instagram, InstagramFacebook, LinkedIn,
LinkedInPage, Mastodon, Pinterest, Threads, TikTok, YouTube), plus the
Blade view that the popup renders.
Adds an accounts.popup_callback i18n block (en/pt-BR/es) covering:
- The popup chrome (title, closing/close-now status text).
- Generic success/reconnect messages (one shared 'Account connected!'
/ 'Account reconnected!' line — the popup already shows a checkmark
and lives for ~2s so platform-specific wording wasn't pulling weight).
- Error variants (account/page/channel) and contextual edge cases
(page not found, no Facebook pages, no YouTube channels, etc.).
Updates every popupCallback() callsite to read from these keys, plus
the Blade view's title and submessage. Regenerates the JSON locale
bundle so laravel-vue-i18n stays in sync.
2026-05-07 17:03:52 +00:00
|
|
|
return $this->popupCallback(false, __('accounts.popup_callback.session_expired'), $platform->value);
|
2026-01-15 01:13:44 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
$workspace = Workspace::find($workspaceId);
|
|
|
|
|
|
2026-01-15 17:24:39 +00:00
|
|
|
if (! $workspace || ! $request->user()->can('manageAccounts', $workspace)) {
|
feat: localize OAuth popup callback messages across 12 controllers
User reported the social-account OAuth callback popup ('Threads account
connected!') stayed in English regardless of the active locale. The
hardcoded message was wired through SocialController and 11 platform
controllers (Bluesky, Facebook, Instagram, InstagramFacebook, LinkedIn,
LinkedInPage, Mastodon, Pinterest, Threads, TikTok, YouTube), plus the
Blade view that the popup renders.
Adds an accounts.popup_callback i18n block (en/pt-BR/es) covering:
- The popup chrome (title, closing/close-now status text).
- Generic success/reconnect messages (one shared 'Account connected!'
/ 'Account reconnected!' line — the popup already shows a checkmark
and lives for ~2s so platform-specific wording wasn't pulling weight).
- Error variants (account/page/channel) and contextual edge cases
(page not found, no Facebook pages, no YouTube channels, etc.).
Updates every popupCallback() callsite to read from these keys, plus
the Blade view's title and submessage. Regenerates the JSON locale
bundle so laravel-vue-i18n stays in sync.
2026-05-07 17:03:52 +00:00
|
|
|
return $this->popupCallback(false, __('accounts.popup_callback.workspace_not_found'), $platform->value);
|
2026-01-15 01:13:44 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
try {
|
|
|
|
|
$socialUser = Socialite::driver($driver)->user();
|
2026-01-17 02:46:30 +00:00
|
|
|
|
2026-01-15 01:13:44 +00:00
|
|
|
$avatarPath = uploadFromUrl($socialUser->getAvatar());
|
|
|
|
|
|
2026-04-15 12:46:18 +00:00
|
|
|
$workspace->socialAccounts()->updateOrCreate(
|
|
|
|
|
[
|
|
|
|
|
'platform' => $platform->value,
|
|
|
|
|
'platform_user_id' => $socialUser->getId(),
|
|
|
|
|
],
|
|
|
|
|
[
|
|
|
|
|
'username' => $socialUser->getNickname(),
|
|
|
|
|
'display_name' => $socialUser->getName(),
|
|
|
|
|
'avatar_url' => $avatarPath,
|
|
|
|
|
'access_token' => $socialUser->token,
|
|
|
|
|
'refresh_token' => $socialUser->refreshToken,
|
|
|
|
|
'token_expires_at' => $socialUser->expiresIn ? now()->addSeconds($socialUser->expiresIn) : null,
|
|
|
|
|
'scopes' => $socialUser->approvedScopes ?? null,
|
|
|
|
|
'status' => Status::Connected,
|
|
|
|
|
'error_message' => null,
|
|
|
|
|
'disconnected_at' => null,
|
|
|
|
|
],
|
|
|
|
|
);
|
2026-01-15 01:13:44 +00:00
|
|
|
|
feat: localize OAuth popup callback messages across 12 controllers
User reported the social-account OAuth callback popup ('Threads account
connected!') stayed in English regardless of the active locale. The
hardcoded message was wired through SocialController and 11 platform
controllers (Bluesky, Facebook, Instagram, InstagramFacebook, LinkedIn,
LinkedInPage, Mastodon, Pinterest, Threads, TikTok, YouTube), plus the
Blade view that the popup renders.
Adds an accounts.popup_callback i18n block (en/pt-BR/es) covering:
- The popup chrome (title, closing/close-now status text).
- Generic success/reconnect messages (one shared 'Account connected!'
/ 'Account reconnected!' line — the popup already shows a checkmark
and lives for ~2s so platform-specific wording wasn't pulling weight).
- Error variants (account/page/channel) and contextual edge cases
(page not found, no Facebook pages, no YouTube channels, etc.).
Updates every popupCallback() callsite to read from these keys, plus
the Blade view's title and submessage. Regenerates the JSON locale
bundle so laravel-vue-i18n stays in sync.
2026-05-07 17:03:52 +00:00
|
|
|
return $this->popupCallback(true, __('accounts.popup_callback.connected'), $platform->value);
|
feat: per-workspace pricing, onboarding, and billing overhaul
Pricing
- Bill per workspace ($12/mo or $120/yr each); Stripe quantity tracks the
workspace count and syncs on workspace create/delete.
- 2,500 AI credits per workspace, pooled at the account level; monthly reset
on the billing anniversary, annual granted upfront (no rollover).
- One social account per network per workspace; remove all count-based limits
(workspace/social/member) and the legacy plan tiers (single Workspace plan).
Onboarding (cloud only: SELF_HOSTED=false + PostHog)
- Replace the /subscribe plan picker with /onboarding persona selection
(Creator/Freelancer/Startup/Agency/Small business/Other), saved on the user
(users.persona) and mirrored to PostHog, then Stripe Checkout on the monthly
price. 8-day trial so Stripe displays 7.
Billing screen
- Remove the Change Plan dialog (dead with a single plan); add an annual-upgrade
banner for monthly subscribers (swapToYearly).
- Current-plan card shows the workspace count instead of the plan name.
System AI
- Brand analyzer / workspace autofill is always allowed and never debits credits
(system feature, not the user's usage).
Self-hosted (SELF_HOSTED=true) bypasses all billing, credit, limit, network,
and onboarding logic.
2026-06-21 23:40:03 +00:00
|
|
|
} catch (NetworkAlreadyConnectedException) {
|
|
|
|
|
return $this->popupCallback(false, __('accounts.popup_callback.network_taken'), $platform->value);
|
2026-01-15 01:13:44 +00:00
|
|
|
} catch (\Exception $e) {
|
|
|
|
|
Log::error('Social OAuth Error', [
|
|
|
|
|
'platform' => $platform->value,
|
|
|
|
|
'error' => $e->getMessage(),
|
|
|
|
|
]);
|
|
|
|
|
|
feat: localize OAuth popup callback messages across 12 controllers
User reported the social-account OAuth callback popup ('Threads account
connected!') stayed in English regardless of the active locale. The
hardcoded message was wired through SocialController and 11 platform
controllers (Bluesky, Facebook, Instagram, InstagramFacebook, LinkedIn,
LinkedInPage, Mastodon, Pinterest, Threads, TikTok, YouTube), plus the
Blade view that the popup renders.
Adds an accounts.popup_callback i18n block (en/pt-BR/es) covering:
- The popup chrome (title, closing/close-now status text).
- Generic success/reconnect messages (one shared 'Account connected!'
/ 'Account reconnected!' line — the popup already shows a checkmark
and lives for ~2s so platform-specific wording wasn't pulling weight).
- Error variants (account/page/channel) and contextual edge cases
(page not found, no Facebook pages, no YouTube channels, etc.).
Updates every popupCallback() callsite to read from these keys, plus
the Blade view's title and submessage. Regenerates the JSON locale
bundle so laravel-vue-i18n stays in sync.
2026-05-07 17:03:52 +00:00
|
|
|
return $this->popupCallback(false, __('accounts.popup_callback.error_connecting'), $platform->value);
|
2026-01-15 01:13:44 +00:00
|
|
|
}
|
|
|
|
|
}
|
2026-01-17 02:46:30 +00:00
|
|
|
|
|
|
|
|
protected function forgetSocialConnectSession(): void
|
|
|
|
|
{
|
2026-06-22 16:54:42 +00:00
|
|
|
session()->forget('social_connect_workspace');
|
2026-01-17 02:46:30 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* Return a view that closes the popup and notifies the parent window.
|
|
|
|
|
*/
|
|
|
|
|
protected function popupCallback(bool $success, string $message, ?string $platform = null): View
|
|
|
|
|
{
|
|
|
|
|
$this->forgetSocialConnectSession();
|
|
|
|
|
|
|
|
|
|
return view('auth.social-callback', [
|
|
|
|
|
'success' => $success,
|
|
|
|
|
'message' => $message,
|
|
|
|
|
'platform' => $platform,
|
|
|
|
|
]);
|
|
|
|
|
}
|
2026-01-15 01:13:44 +00:00
|
|
|
}
|