06e01797d1
Critical: - Fix EnsureUserSetupIsComplete middleware route name prefixes and redirect Subscription step to subscribe page (not onboarding) - Fix MCP session pollution: Auth::setUser() instead of Auth::login() - Remove dead BillingController::addWorkspace/removeWorkspace methods - Remove broken Workspace::pendingInvites() method Security (IDOR): - MediaController: add workspace ownership verification on all endpoints - UpdatePostRequest: scope label_ids validation to current workspace - UpdatePostRequest: scope platform IDs validation to current post Security (other): - Fix open redirect in login and registration (validate internal URLs) - Add validation to API PostController store/update (was $request->all()) - Prevent Owner role assignment via updateRole endpoint - Fix API post author attribution to use workspace owner Authorization: - PostController: use createPost policy instead of view for store/update/destroy Logic: - Post Status enum labels now use translation system instead of hardcoded Portuguese - Workspace deletion cleans up current_workspace_id for all affected members - StoreWorkspaceInviteRequest: replace Portuguese validation messages with __() Rename onboarding: - Step1.vue -> Role.vue, Step2.vue -> Connect.vue - Controller methods: step1->role, storeStep1->storeRole, step2->connect, storeStep2->storeConnect All 728 tests passing.
102 lines
3.2 KiB
PHP
102 lines
3.2 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace App\Http\Controllers\Api;
|
|
|
|
use App\Actions\Post\CreatePost;
|
|
use App\Actions\Post\DeletePost;
|
|
use App\Actions\Post\UpdatePost;
|
|
use App\Http\Resources\Api\PostResource;
|
|
use App\Models\Post;
|
|
use Illuminate\Http\JsonResponse;
|
|
use Illuminate\Http\Request;
|
|
use Illuminate\Http\Resources\Json\AnonymousResourceCollection;
|
|
use Symfony\Component\HttpFoundation\Response;
|
|
|
|
class PostController extends Controller
|
|
{
|
|
public function index(Request $request): AnonymousResourceCollection
|
|
{
|
|
$posts = $request->workspace->posts()
|
|
->with(['postPlatforms.socialAccount', 'user', 'labels'])
|
|
->latest('scheduled_at')
|
|
->paginate(15);
|
|
|
|
return PostResource::collection($posts);
|
|
}
|
|
|
|
public function show(Request $request, Post $post): PostResource
|
|
{
|
|
if ($post->workspace_id !== $request->workspace->id) {
|
|
abort(Response::HTTP_NOT_FOUND);
|
|
}
|
|
|
|
$post->load(['postPlatforms.socialAccount', 'user', 'labels']);
|
|
|
|
return new PostResource($post);
|
|
}
|
|
|
|
public function store(Request $request): JsonResponse
|
|
{
|
|
$validated = $request->validate([
|
|
'platforms' => ['required', 'array', 'min:1'],
|
|
'platforms.*.social_account_id' => ['required', 'uuid'],
|
|
'platforms.*.content_type' => ['required', 'string'],
|
|
'platforms.*.content' => ['nullable', 'string'],
|
|
'scheduled_at' => ['nullable', 'date', 'after:now'],
|
|
'status' => ['nullable', 'string', 'in:draft,scheduled,publishing'],
|
|
]);
|
|
|
|
$post = CreatePost::execute(
|
|
$request->workspace,
|
|
$request->workspace->owner,
|
|
$validated
|
|
);
|
|
|
|
$post->load(['postPlatforms.socialAccount']);
|
|
|
|
return (new PostResource($post))
|
|
->response()
|
|
->setStatusCode(Response::HTTP_CREATED);
|
|
}
|
|
|
|
public function update(Request $request, Post $post): PostResource|JsonResponse
|
|
{
|
|
if ($post->workspace_id !== $request->workspace->id) {
|
|
abort(Response::HTTP_NOT_FOUND);
|
|
}
|
|
|
|
$validated = $request->validate([
|
|
'platforms' => ['sometimes', 'array'],
|
|
'platforms.*.id' => ['required', 'uuid'],
|
|
'platforms.*.content' => ['nullable', 'string'],
|
|
'scheduled_at' => ['nullable', 'date'],
|
|
'status' => ['nullable', 'string', 'in:draft,scheduled,publishing'],
|
|
'label_ids' => ['sometimes', 'array'],
|
|
'label_ids.*' => ['uuid'],
|
|
]);
|
|
|
|
$result = UpdatePost::execute($request->workspace, $post, $validated);
|
|
|
|
if (data_get($result, 'action') === 'already_published') {
|
|
return response()->json(
|
|
['message' => 'Cannot edit a published post.'],
|
|
Response::HTTP_UNPROCESSABLE_ENTITY
|
|
);
|
|
}
|
|
|
|
return new PostResource(data_get($result, 'post'));
|
|
}
|
|
|
|
public function destroy(Request $request, Post $post): JsonResponse
|
|
{
|
|
if ($post->workspace_id !== $request->workspace->id) {
|
|
abort(Response::HTTP_NOT_FOUND);
|
|
}
|
|
|
|
DeletePost::execute($post);
|
|
|
|
return response()->json(null, Response::HTTP_NO_CONTENT);
|
|
}
|
|
}
|