74bd88d3d6
Self-hosted installs (SELF_HOSTED=true, the default) now close /register
to the public. Workspace invites still work — the AcceptInvite page
links into /register with ?invite={id}, the middleware persists that
into the session, and POST /register passes through.
- EnsureRegistrationEnabled middleware gates GET/POST /register.
Accepts ?invite=… (URL) or pending_invite_id (session) as the pass.
- RegisteredUserController::store clears the marker after signup.
- AcceptInvite.vue passes invite.id in the register link's query string.
- Login.vue hides the "Sign up" link when self_hosted.
- UserSeeder bootstraps a single admin (admin@trypost.it / password).
Idempotent; not wired into DatabaseSeeder — operator runs
`php artisan db:seed --class=UserSeeder` per the install docs.
- Tests cover both flag values for every changed surface.
Docs PR: see trypost-docs self-hosting/installation.mdx step 3.
63 lines
3.3 KiB
PHP
63 lines
3.3 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
use App\Http\Controllers\Auth\AcceptInviteController;
|
|
use App\Http\Controllers\Auth\AuthenticatedSessionController;
|
|
use App\Http\Controllers\Auth\EmailVerificationNotificationController;
|
|
use App\Http\Controllers\Auth\EmailVerificationPromptController;
|
|
use App\Http\Controllers\Auth\GitHubController;
|
|
use App\Http\Controllers\Auth\GoogleController;
|
|
use App\Http\Controllers\Auth\NewPasswordController;
|
|
use App\Http\Controllers\Auth\PasswordResetLinkController;
|
|
use App\Http\Controllers\Auth\RegisteredUserController;
|
|
use App\Http\Controllers\Auth\SignupSuccessController;
|
|
use App\Http\Controllers\Auth\VerifyEmailController;
|
|
use Illuminate\Support\Facades\Route;
|
|
|
|
Route::get('/invites/{invite}', [AcceptInviteController::class, 'show'])->name('app.invites.show');
|
|
|
|
Route::middleware(['guest'])->group(function () {
|
|
Route::middleware('registration.enabled')->group(function () {
|
|
Route::get('/register', [RegisteredUserController::class, 'create'])->name('register');
|
|
Route::post('/register', [RegisteredUserController::class, 'store'])->name('register.store');
|
|
});
|
|
|
|
Route::get('/login', [AuthenticatedSessionController::class, 'create'])->name('login');
|
|
Route::post('/login', [AuthenticatedSessionController::class, 'store'])->name('login.store');
|
|
|
|
Route::get('/forgot-password', [PasswordResetLinkController::class, 'create'])->name('password.request');
|
|
Route::post('/forgot-password', [PasswordResetLinkController::class, 'store'])->name('password.email');
|
|
|
|
Route::get('/reset-password/{token}', [NewPasswordController::class, 'create'])->name('password.reset');
|
|
Route::post('/reset-password', [NewPasswordController::class, 'store'])->name('password.store');
|
|
|
|
Route::get('/auth/google/redirect', [GoogleController::class, 'redirect'])->name('auth.google.redirect');
|
|
Route::get('/auth/github/redirect', [GitHubController::class, 'redirect'])->name('auth.github.redirect');
|
|
});
|
|
|
|
// Callbacks must be reachable by both guests (signup/login) and authenticated
|
|
// users (connect-from-settings). The redirect routes that initiate the OAuth
|
|
// round-trip enforce the right middleware, so the callback can safely branch
|
|
// on `Auth::check()` to dispatch to the matching flow.
|
|
Route::get('/auth/google/callback', [GoogleController::class, 'callback'])->name('auth.google.callback');
|
|
Route::get('/auth/github/callback', [GitHubController::class, 'callback'])->name('auth.github.callback');
|
|
|
|
Route::middleware(['auth'])->group(function () {
|
|
Route::get('/register/success', SignupSuccessController::class)->name('register.success');
|
|
|
|
Route::get('/verify-email', EmailVerificationPromptController::class)->name('verification.notice');
|
|
|
|
Route::get('/verify-email/{id}/{hash}', VerifyEmailController::class)
|
|
->middleware(['signed', 'throttle:6,1'])
|
|
->name('verification.verify');
|
|
|
|
Route::post('/email/verification-notification', [EmailVerificationNotificationController::class, 'store'])
|
|
->middleware('throttle:6,1')
|
|
->name('verification.send');
|
|
|
|
Route::post('/logout', [AuthenticatedSessionController::class, 'destroy'])->name('logout');
|
|
|
|
Route::post('/invites/{invite}/accept', [AcceptInviteController::class, 'accept'])->name('app.invites.accept');
|
|
Route::post('/invites/{invite}/decline', [AcceptInviteController::class, 'decline'])->name('app.invites.decline');
|
|
});
|