2026-04-15 13:20:37 +00:00
|
|
|
<?php
|
|
|
|
|
|
|
|
|
|
declare(strict_types=1);
|
|
|
|
|
|
|
|
|
|
namespace App\Http\Controllers\App;
|
|
|
|
|
|
feat: complete AI assistant with custom services and brand config
Baseline snapshot of custom AI implementation before Laravel AI SDK migration.
Includes:
- Custom services: GeminiTextGenerationService, TextGenerationService (OpenAI), ImageGenerationService, AudioGenerationService, VideoGenerationService
- IntentDetector for content moderation via keyword matching
- AI enums: Intent, Orientation, UsageType
- Blade prompt templates: system.blade.php, image.blade.php, video.blade.php
- AiMessage with content_html accessor (markdown rendering)
- AiUsageLog for monthly quota tracking per account
- PostAssistantController with regex-based [GENERATE_*] parsing
- WritingAssistantTab with markdown rendering, add-to-post, attachments
- Workspace brand fields (name, description, tone, voice_notes) in system prompt
- Session state block injected into prompts (thread counts, quota remaining)
- AttachmentCollector pattern will replace the regex approach in Phase 2
- Post comments with replies, emoji reactions, real-time via Echo
- Assets page with Unsplash + Giphy integrations
2026-04-16 12:25:08 +00:00
|
|
|
use App\Http\Requests\App\Asset\StoreAssetFromUrlRequest;
|
|
|
|
|
use App\Http\Requests\App\Asset\StoreAssetRequest;
|
2026-05-04 17:54:47 +00:00
|
|
|
use App\Http\Requests\App\Asset\StoreChunkedAssetRequest;
|
2026-04-17 02:05:51 +00:00
|
|
|
use App\Http\Resources\App\MediaResource;
|
2026-04-15 13:20:37 +00:00
|
|
|
use App\Models\Media;
|
2026-07-17 18:40:15 +00:00
|
|
|
use App\Services\Brand\SafeHttpFetcher;
|
2026-07-23 14:18:10 +00:00
|
|
|
use App\Services\Media\ChunkedAssetReceiver;
|
2026-04-15 13:20:37 +00:00
|
|
|
use App\Services\UnsplashService;
|
|
|
|
|
use Illuminate\Http\JsonResponse;
|
|
|
|
|
use Illuminate\Http\RedirectResponse;
|
|
|
|
|
use Illuminate\Http\Request;
|
feat: media gallery picker, custom emoji picker, preview tabs, real platform logos
- gallery: extract /assets tabs (uploads, Unsplash, Giphy) into shared
GalleryBrowser used by both /assets and a new MediaPickerDialog inside the
post editor; add JSON search endpoint for workspace assets with tests
- emoji: replace broken emoji-picker-element web component with a custom
EmojiPicker (full Unicode set, search, categories, recently-used,
light/dark, i18n)
- preview tab: platform selector pills, variant tabs (data-driven from
content_types map) so the user can switch Feed/Reel/Story etc. and have
it autosave through the same handler ScheduleTab uses
- platform logos: shared usePlatformLogo composable (logo + label + content
types); replaces inline maps across 5 components, fixes
instagram-facebook falling back to default.png
- tooltips: hover details (display_name · @username + platform label) on
platform avatars across editor, posts list and calendar
- settings cards: show ` · @username` in the title bar so multiple accounts
on the same network are distinguishable
- routes: drop the throttle:6,1 group middleware on social connect routes
(was 429ing legitimate OAuth retries) and rely on the default limiter
2026-05-01 17:53:49 +00:00
|
|
|
use Illuminate\Http\Resources\Json\AnonymousResourceCollection;
|
2026-04-15 13:20:37 +00:00
|
|
|
use Illuminate\Support\Facades\Storage;
|
|
|
|
|
use Illuminate\Support\Str;
|
|
|
|
|
use Inertia\Inertia;
|
|
|
|
|
use Inertia\Response;
|
2026-07-17 18:40:15 +00:00
|
|
|
use RuntimeException;
|
2026-04-15 13:20:37 +00:00
|
|
|
use Symfony\Component\HttpFoundation\Response as SymfonyResponse;
|
|
|
|
|
|
|
|
|
|
class AssetController extends Controller
|
|
|
|
|
{
|
|
|
|
|
public function index(Request $request): Response|RedirectResponse
|
|
|
|
|
{
|
|
|
|
|
$workspace = $request->user()->currentWorkspace;
|
|
|
|
|
|
|
|
|
|
if (! $workspace) {
|
|
|
|
|
return redirect()->route('app.workspaces.create');
|
|
|
|
|
}
|
|
|
|
|
|
2026-04-15 23:11:36 +00:00
|
|
|
$this->authorize('createPost', $workspace);
|
2026-04-15 13:20:37 +00:00
|
|
|
|
feat: media gallery picker, custom emoji picker, preview tabs, real platform logos
- gallery: extract /assets tabs (uploads, Unsplash, Giphy) into shared
GalleryBrowser used by both /assets and a new MediaPickerDialog inside the
post editor; add JSON search endpoint for workspace assets with tests
- emoji: replace broken emoji-picker-element web component with a custom
EmojiPicker (full Unicode set, search, categories, recently-used,
light/dark, i18n)
- preview tab: platform selector pills, variant tabs (data-driven from
content_types map) so the user can switch Feed/Reel/Story etc. and have
it autosave through the same handler ScheduleTab uses
- platform logos: shared usePlatformLogo composable (logo + label + content
types); replaces inline maps across 5 components, fixes
instagram-facebook falling back to default.png
- tooltips: hover details (display_name · @username + platform label) on
platform avatars across editor, posts list and calendar
- settings cards: show ` · @username` in the title bar so multiple accounts
on the same network are distinguishable
- routes: drop the throttle:6,1 group middleware on social connect routes
(was 429ing legitimate OAuth retries) and rely on the default limiter
2026-05-01 17:53:49 +00:00
|
|
|
return Inertia::render('assets/Index');
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
public function search(Request $request): AnonymousResourceCollection
|
|
|
|
|
{
|
|
|
|
|
$workspace = $request->user()->currentWorkspace;
|
|
|
|
|
|
|
|
|
|
$this->authorize('createPost', $workspace);
|
|
|
|
|
|
|
|
|
|
$term = trim((string) $request->input('search', ''));
|
|
|
|
|
$type = $request->input('type');
|
|
|
|
|
|
2026-04-15 13:20:37 +00:00
|
|
|
$assets = $workspace->getMedia('assets')
|
feat: media gallery picker, custom emoji picker, preview tabs, real platform logos
- gallery: extract /assets tabs (uploads, Unsplash, Giphy) into shared
GalleryBrowser used by both /assets and a new MediaPickerDialog inside the
post editor; add JSON search endpoint for workspace assets with tests
- emoji: replace broken emoji-picker-element web component with a custom
EmojiPicker (full Unicode set, search, categories, recently-used,
light/dark, i18n)
- preview tab: platform selector pills, variant tabs (data-driven from
content_types map) so the user can switch Feed/Reel/Story etc. and have
it autosave through the same handler ScheduleTab uses
- platform logos: shared usePlatformLogo composable (logo + label + content
types); replaces inline maps across 5 components, fixes
instagram-facebook falling back to default.png
- tooltips: hover details (display_name · @username + platform label) on
platform avatars across editor, posts list and calendar
- settings cards: show ` · @username` in the title bar so multiple accounts
on the same network are distinguishable
- routes: drop the throttle:6,1 group middleware on social connect routes
(was 429ing legitimate OAuth retries) and rely on the default limiter
2026-05-01 17:53:49 +00:00
|
|
|
->when($term !== '', fn ($query) => $query->where('original_filename', 'ilike', '%'.$term.'%'))
|
|
|
|
|
->when(in_array($type, ['image', 'video'], true), fn ($query) => $query->where('type', $type))
|
2026-04-15 13:20:37 +00:00
|
|
|
->latest()
|
2026-04-15 14:02:10 +00:00
|
|
|
->paginate(config('app.pagination.default'));
|
2026-04-15 13:20:37 +00:00
|
|
|
|
feat: media gallery picker, custom emoji picker, preview tabs, real platform logos
- gallery: extract /assets tabs (uploads, Unsplash, Giphy) into shared
GalleryBrowser used by both /assets and a new MediaPickerDialog inside the
post editor; add JSON search endpoint for workspace assets with tests
- emoji: replace broken emoji-picker-element web component with a custom
EmojiPicker (full Unicode set, search, categories, recently-used,
light/dark, i18n)
- preview tab: platform selector pills, variant tabs (data-driven from
content_types map) so the user can switch Feed/Reel/Story etc. and have
it autosave through the same handler ScheduleTab uses
- platform logos: shared usePlatformLogo composable (logo + label + content
types); replaces inline maps across 5 components, fixes
instagram-facebook falling back to default.png
- tooltips: hover details (display_name · @username + platform label) on
platform avatars across editor, posts list and calendar
- settings cards: show ` · @username` in the title bar so multiple accounts
on the same network are distinguishable
- routes: drop the throttle:6,1 group middleware on social connect routes
(was 429ing legitimate OAuth retries) and rely on the default limiter
2026-05-01 17:53:49 +00:00
|
|
|
return MediaResource::collection($assets);
|
2026-04-15 13:20:37 +00:00
|
|
|
}
|
|
|
|
|
|
2026-04-17 02:05:51 +00:00
|
|
|
public function store(StoreAssetRequest $request): MediaResource
|
2026-04-15 13:20:37 +00:00
|
|
|
{
|
|
|
|
|
$workspace = $request->user()->currentWorkspace;
|
|
|
|
|
|
2026-04-15 23:11:36 +00:00
|
|
|
$this->authorize('createPost', $workspace);
|
2026-04-15 13:20:37 +00:00
|
|
|
|
feat: media gallery picker, custom emoji picker, preview tabs, real platform logos
- gallery: extract /assets tabs (uploads, Unsplash, Giphy) into shared
GalleryBrowser used by both /assets and a new MediaPickerDialog inside the
post editor; add JSON search endpoint for workspace assets with tests
- emoji: replace broken emoji-picker-element web component with a custom
EmojiPicker (full Unicode set, search, categories, recently-used,
light/dark, i18n)
- preview tab: platform selector pills, variant tabs (data-driven from
content_types map) so the user can switch Feed/Reel/Story etc. and have
it autosave through the same handler ScheduleTab uses
- platform logos: shared usePlatformLogo composable (logo + label + content
types); replaces inline maps across 5 components, fixes
instagram-facebook falling back to default.png
- tooltips: hover details (display_name · @username + platform label) on
platform avatars across editor, posts list and calendar
- settings cards: show ` · @username` in the title bar so multiple accounts
on the same network are distinguishable
- routes: drop the throttle:6,1 group middleware on social connect routes
(was 429ing legitimate OAuth retries) and rely on the default limiter
2026-05-01 17:53:49 +00:00
|
|
|
$clientMeta = (array) $request->input('meta', []);
|
|
|
|
|
|
|
|
|
|
$media = $workspace->addMedia($request->file('media'), 'assets', $clientMeta);
|
2026-04-15 13:20:37 +00:00
|
|
|
|
2026-04-17 02:05:51 +00:00
|
|
|
return new MediaResource($media);
|
2026-04-15 13:20:37 +00:00
|
|
|
}
|
|
|
|
|
|
2026-07-23 14:18:10 +00:00
|
|
|
public function storeChunked(StoreChunkedAssetRequest $request, ChunkedAssetReceiver $receiver): JsonResponse
|
2026-04-15 13:20:37 +00:00
|
|
|
{
|
|
|
|
|
$workspace = $request->user()->currentWorkspace;
|
|
|
|
|
|
2026-04-15 23:11:36 +00:00
|
|
|
$this->authorize('createPost', $workspace);
|
2026-04-15 13:20:37 +00:00
|
|
|
|
2026-07-23 14:18:10 +00:00
|
|
|
return $receiver->receive(
|
2026-07-23 14:16:39 +00:00
|
|
|
$workspace,
|
2026-07-23 14:18:10 +00:00
|
|
|
$request->user(),
|
MCP: workspace settings, viewer read access, and token access (#241)
* Add workspace MCP settings and token access controls.
Ship MCP settings UI, OAuth revoke/list helpers, Passport deploy wiring,
and workspace.token:mcp gating so assistants can connect without pulling
in welcome/onboarding from the parent epic.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Type MCP client config shapes instead of string checks.
Encode http/config-root on each advanced client and tighten primary
client ids so snippet generation does not branch on magic strings.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Polish MCP settings follow-ups from review.
Translate Ukrainian MCP copy, deep-link ChatGPT into connector
creation, drop an unused asset and revoke arg, and assert PATs are
rejected on the MCP endpoint.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Harden MCP connected clients, revoke scope, and OAuth consent.
List recoverable sessions with live refresh tokens, revoke only PATs,
throttle registration alone, and block viewers from authorizing MCP.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Simplify MCP OAuth route throttling to a single middleware group.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Allow workspace viewers read-only MCP access with web policy writes.
Mirror the web app: MCP connects on view + OAuth mcp:use, write tools
enforce createPost/update/delete/manageAccounts/manageTeam, and demotion
to Viewer keeps grants. Cover role denials, consent, and disconnect.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Harden MCP tool authz with shared workspace helpers.
Route ApiKey tools through AuthorizesMcpTool, fail closed on null user
or policy argument, and resolve the current workspace before mutating.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Drop redundant string casts on validated request data.
Enum::from and validated() fields are already strings, so the casts
add noise without changing behavior.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Show only the current user's MCP connections in settings.
Match API keys privacy: list and disconnect your own OAuth clients,
not teammates' across the account.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Cover LoadWorkspaceFromToken gaps and harden AuthorizesMcpTool tests.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Drop redundant is_string guard before UpdatePostTool find.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Refactor AppSidebar to always show MCP link and simplify route middleware definition in ai.php. The MCP link is now consistently displayed regardless of the current workspace state, and the route middleware syntax has been streamlined.
* Refresh MCP connected clients with Inertia usePoll.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Bump laravel/mcp to 0.9.1 and add the TryPost server icon.
Requires laravel/boost 2.5 for the Icon attribute; expose images/trypost/icon.png on TryPostServer.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Drop no-op ReflectionClass import in TryPostServerTest.
Co-authored-by: Cursor <cursoragent@cursor.com>
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-08-06 12:54:51 +00:00
|
|
|
$request->validated('file_name'),
|
2026-07-23 14:18:10 +00:00
|
|
|
$request->getContent(),
|
|
|
|
|
(int) $request->validated('range_start'),
|
|
|
|
|
(int) $request->validated('range_end'),
|
|
|
|
|
(int) $request->validated('total_size'),
|
|
|
|
|
)->toResponse();
|
2026-04-15 13:20:37 +00:00
|
|
|
}
|
|
|
|
|
|
2026-07-17 18:40:15 +00:00
|
|
|
public function storeFromUrl(StoreAssetFromUrlRequest $request, UnsplashService $unsplash, SafeHttpFetcher $safeHttp): MediaResource
|
2026-04-15 13:20:37 +00:00
|
|
|
{
|
|
|
|
|
$workspace = $request->user()->currentWorkspace;
|
|
|
|
|
|
2026-04-15 23:11:36 +00:00
|
|
|
$this->authorize('createPost', $workspace);
|
2026-04-15 13:20:37 +00:00
|
|
|
|
feat: complete AI assistant with custom services and brand config
Baseline snapshot of custom AI implementation before Laravel AI SDK migration.
Includes:
- Custom services: GeminiTextGenerationService, TextGenerationService (OpenAI), ImageGenerationService, AudioGenerationService, VideoGenerationService
- IntentDetector for content moderation via keyword matching
- AI enums: Intent, Orientation, UsageType
- Blade prompt templates: system.blade.php, image.blade.php, video.blade.php
- AiMessage with content_html accessor (markdown rendering)
- AiUsageLog for monthly quota tracking per account
- PostAssistantController with regex-based [GENERATE_*] parsing
- WritingAssistantTab with markdown rendering, add-to-post, attachments
- Workspace brand fields (name, description, tone, voice_notes) in system prompt
- Session state block injected into prompts (thread counts, quota remaining)
- AttachmentCollector pattern will replace the regex approach in Phase 2
- Post comments with replies, emoji reactions, real-time via Echo
- Assets page with Unsplash + Giphy integrations
2026-04-16 12:25:08 +00:00
|
|
|
$validated = $request->validated();
|
2026-04-15 13:20:37 +00:00
|
|
|
|
|
|
|
|
// Trigger Unsplash download tracking (required by API guidelines)
|
|
|
|
|
if ($downloadLocation = data_get($validated, 'download_location')) {
|
|
|
|
|
$unsplash->trackDownload($downloadLocation);
|
|
|
|
|
}
|
|
|
|
|
|
MCP: workspace settings, viewer read access, and token access (#241)
* Add workspace MCP settings and token access controls.
Ship MCP settings UI, OAuth revoke/list helpers, Passport deploy wiring,
and workspace.token:mcp gating so assistants can connect without pulling
in welcome/onboarding from the parent epic.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Type MCP client config shapes instead of string checks.
Encode http/config-root on each advanced client and tighten primary
client ids so snippet generation does not branch on magic strings.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Polish MCP settings follow-ups from review.
Translate Ukrainian MCP copy, deep-link ChatGPT into connector
creation, drop an unused asset and revoke arg, and assert PATs are
rejected on the MCP endpoint.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Harden MCP connected clients, revoke scope, and OAuth consent.
List recoverable sessions with live refresh tokens, revoke only PATs,
throttle registration alone, and block viewers from authorizing MCP.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Simplify MCP OAuth route throttling to a single middleware group.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Allow workspace viewers read-only MCP access with web policy writes.
Mirror the web app: MCP connects on view + OAuth mcp:use, write tools
enforce createPost/update/delete/manageAccounts/manageTeam, and demotion
to Viewer keeps grants. Cover role denials, consent, and disconnect.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Harden MCP tool authz with shared workspace helpers.
Route ApiKey tools through AuthorizesMcpTool, fail closed on null user
or policy argument, and resolve the current workspace before mutating.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Drop redundant string casts on validated request data.
Enum::from and validated() fields are already strings, so the casts
add noise without changing behavior.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Show only the current user's MCP connections in settings.
Match API keys privacy: list and disconnect your own OAuth clients,
not teammates' across the account.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Cover LoadWorkspaceFromToken gaps and harden AuthorizesMcpTool tests.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Drop redundant is_string guard before UpdatePostTool find.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Refactor AppSidebar to always show MCP link and simplify route middleware definition in ai.php. The MCP link is now consistently displayed regardless of the current workspace state, and the route middleware syntax has been streamlined.
* Refresh MCP connected clients with Inertia usePoll.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Bump laravel/mcp to 0.9.1 and add the TryPost server icon.
Requires laravel/boost 2.5 for the Icon attribute; expose images/trypost/icon.png on TryPostServer.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Drop no-op ReflectionClass import in TryPostServerTest.
Co-authored-by: Cursor <cursoragent@cursor.com>
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-08-06 12:54:51 +00:00
|
|
|
$url = data_get($validated, 'url');
|
2026-07-17 18:40:15 +00:00
|
|
|
|
|
|
|
|
try {
|
|
|
|
|
$response = $safeHttp->guardedRequest($url)->timeout(30)->get($url);
|
|
|
|
|
} catch (RuntimeException) {
|
|
|
|
|
abort(SymfonyResponse::HTTP_BAD_REQUEST, 'Failed to download image from URL');
|
|
|
|
|
}
|
2026-04-15 13:20:37 +00:00
|
|
|
|
|
|
|
|
if ($response->failed()) {
|
|
|
|
|
abort(SymfonyResponse::HTTP_BAD_REQUEST, 'Failed to download image from URL');
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
$mimeType = $response->header('Content-Type', 'image/jpeg');
|
|
|
|
|
$extension = match (true) {
|
|
|
|
|
str_contains($mimeType, 'png') => 'png',
|
|
|
|
|
str_contains($mimeType, 'gif') => 'gif',
|
|
|
|
|
str_contains($mimeType, 'webp') => 'webp',
|
|
|
|
|
default => 'jpg',
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
$filename = Str::uuid().'.'.$extension;
|
2026-07-23 14:21:52 +00:00
|
|
|
$path = "medias/{$filename}";
|
2026-04-15 13:20:37 +00:00
|
|
|
|
|
|
|
|
Storage::put($path, $response->body());
|
|
|
|
|
|
|
|
|
|
$meta = [];
|
|
|
|
|
$tempFile = tempnam(sys_get_temp_dir(), 'unsplash');
|
|
|
|
|
file_put_contents($tempFile, $response->body());
|
|
|
|
|
$imageInfo = @getimagesize($tempFile);
|
|
|
|
|
if ($imageInfo) {
|
|
|
|
|
$meta['width'] = $imageInfo[0];
|
|
|
|
|
$meta['height'] = $imageInfo[1];
|
|
|
|
|
}
|
|
|
|
|
@unlink($tempFile);
|
|
|
|
|
|
2026-04-17 02:05:51 +00:00
|
|
|
$media = $workspace->media()->create([
|
2026-04-15 13:20:37 +00:00
|
|
|
'group_id' => Str::uuid()->toString(),
|
|
|
|
|
'collection' => 'assets',
|
|
|
|
|
'type' => 'image',
|
|
|
|
|
'path' => $path,
|
|
|
|
|
'original_filename' => data_get($validated, 'filename'),
|
|
|
|
|
'mime_type' => $mimeType,
|
|
|
|
|
'size' => strlen($response->body()),
|
|
|
|
|
'order' => 0,
|
|
|
|
|
'meta' => $meta,
|
|
|
|
|
]);
|
|
|
|
|
|
2026-04-17 02:05:51 +00:00
|
|
|
return new MediaResource($media);
|
2026-04-15 13:20:37 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
public function destroy(Request $request, Media $media): RedirectResponse
|
|
|
|
|
{
|
|
|
|
|
$workspace = $request->user()->currentWorkspace;
|
|
|
|
|
|
2026-04-15 23:11:36 +00:00
|
|
|
$this->authorize('createPost', $workspace);
|
2026-04-15 13:20:37 +00:00
|
|
|
|
|
|
|
|
if ($media->mediable_type !== $workspace->getMorphClass() || $media->mediable_id !== $workspace->id) {
|
|
|
|
|
abort(SymfonyResponse::HTTP_FORBIDDEN);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
$media->delete();
|
|
|
|
|
|
|
|
|
|
return back();
|
|
|
|
|
}
|
|
|
|
|
}
|