c1418c9d21
Code-review surfaced two correctness bugs and a security gap that
needed to land before merging.
- UpdatePost::execute disabled every platform when called without
a `platforms` key. PublishPostTool relied on that path, so every
publish-via-MCP queued a job whose handler then found nothing
enabled to publish to. Wrap the platform toggle in
`Arr::has($data, 'platforms')` (matches the existing label_ids
guard a few lines up). Add a regression assertion to
`PostPublishToolTest::publish post immediate dispatches PublishPost
job` that the previously-enabled platform stays enabled.
- StorePostRequest declared rules for only `platforms`,
`scheduled_at`, and `status`. `validated()` then stripped
`content`, `media`, and `label_ids`, so REST `POST /api/posts`
silently created empty drafts. Added rules for content / media /
label_ids (with workspace-scoped `Rule::exists` for labels) and
dropped the unused `status` field — REST callers transition state
via `PUT /posts/{id}`. Removed the dead `platforms.*.content`
rule. Added a feature test that asserts content + media + labels
roundtrip on create, plus a regression that an `is_active=false`
social_account is rejected at validation.
- CreatePost::execute now syncs label_ids itself so REST and MCP
share the behavior. Removed the duplicate sync from CreatePostTool.
- MCP UpdatePostTool didn't scope `platforms.*.id` to the post being
updated, drifting from the REST UpdatePostRequest which adds
`Rule::exists('post_platforms','id')->where('post_id', ...)`. Now
it loads the post first (failing fast with `Post not found.` if
the workspace check rejects), then uses the same Rule::exists.
- MediaAttacher fetched any URL the caller passed, including
loopback / link-local / private targets — classic SSRF pivot.
Now `isPublicHttpUrl` rejects non-http(s) schemes, restricted IP
ranges, and DNS hostnames whose A/AAAA records resolve into those
ranges (covers DNS rebinding). Bypassed under
`app()->runningUnitTests()` so `Http::fake()` keeps working.
Streaming the response body lets us abort early once we exceed
MAX_BYTES instead of buffering the full payload first; redirects
are disabled so a 200→302 trick can't bypass the host check.
- The `media[]` JSON column had a lost-update race in
`attachFromUrls`: read `$post->media`, mutate in PHP, write back.
Two concurrent calls clobbered each other. Now wrapped in a
transaction with `lockForUpdate()`.
- ESLint: `resources/js/actions/**` and `resources/js/routes/**`
are auto-generated by Wayfinder on every build. Their import
order matches PHP scan order, not alphabetical, so import/order
fought eslint-fix forever. Added them to ignores.
53 lines
1.7 KiB
JavaScript
53 lines
1.7 KiB
JavaScript
import { defineConfigWithVueTs, vueTsConfigs } from '@vue/eslint-config-typescript';
|
|
import prettier from 'eslint-config-prettier';
|
|
import importPlugin from 'eslint-plugin-import';
|
|
import vue from 'eslint-plugin-vue';
|
|
|
|
export default defineConfigWithVueTs(
|
|
vue.configs['flat/essential'],
|
|
vueTsConfigs.recommended,
|
|
{
|
|
ignores: [
|
|
'vendor',
|
|
'node_modules',
|
|
'public',
|
|
'bootstrap/ssr',
|
|
'tailwind.config.js',
|
|
'resources/js/components/ui/*',
|
|
// Wayfinder regenerates these on every build with import order
|
|
// matching PHP file scan, not alphabetical. Excluding them avoids
|
|
// a perpetual fight between the generator and import/order.
|
|
'resources/js/actions/**',
|
|
'resources/js/routes/**',
|
|
],
|
|
},
|
|
{
|
|
plugins: {
|
|
import: importPlugin,
|
|
},
|
|
settings: {
|
|
'import/resolver': {
|
|
typescript: {
|
|
alwaysTryTypes: true,
|
|
project: './tsconfig.json',
|
|
},
|
|
},
|
|
},
|
|
rules: {
|
|
'vue/multi-word-component-names': 'off',
|
|
'@typescript-eslint/no-explicit-any': 'off',
|
|
'import/order': [
|
|
'error',
|
|
{
|
|
groups: ['builtin', 'external', 'internal', 'parent', 'sibling', 'index'],
|
|
'newlines-between': 'always',
|
|
alphabetize: {
|
|
order: 'asc',
|
|
caseInsensitive: true,
|
|
},
|
|
},
|
|
],
|
|
},
|
|
},
|
|
prettier,
|
|
);
|