trypost/app/Http/Requests/Api/Post/UpdatePostRequest.php
Paulo Castellano 81d43c30f4 fix(api): download and host external media URLs on post create/update
The public REST API accepted inline post media as a free-form array and stored
it verbatim, so a client could create/update a post whose media was a bare
external URL we never hosted. Publishing then depended on that third-party URL
staying alive — when it 404'd (e.g. an image proxy), the post failed across
platforms (Facebook 'unsupported media type', X 'HTTP 404', Instagram 'could
not fetch media').

Inline media URLs on create/update now go through the same download + MIME-
validate + host path as the attach-from-url endpoint (MediaAttacher), so the
stored media always points at our own storage. Items already hosted (carrying a
path) pass through untouched. If any URL can't be fetched the request is
rejected with 422 and nothing is persisted, so a post is never created with
broken media. MCP and the web flow were already safe and are unchanged.

- MediaAttacher: extract fetchToWorkspace() + add resolveInlineMedia()
- Post::allowedMediaTypesFor() so the create flow can compute allowed types
  without a persisted post
- API Store/UpdatePostRequest: media.* item rules (mirroring the web; prevents
  validated() from stripping hosted-item keys)
- PostController store()/update(): host external media before persisting
2026-06-28 17:28:05 -03:00

144 lines
5.3 KiB
PHP

<?php
declare(strict_types=1);
namespace App\Http\Requests\Api\Post;
use App\Enums\Post\Status;
use App\Enums\PostPlatform\ContentType;
use App\Enums\SocialAccount\Platform;
use App\Models\Post;
use App\Models\PostPlatform;
use App\Rules\ContentFitsPlatformLimits;
use App\Rules\ContentTypeCompatibleWithMedia;
use App\Rules\ContentTypeMatchesPostPlatform;
use App\Support\PostPlatformMetaRules;
use Illuminate\Foundation\Http\FormRequest;
use Illuminate\Support\Collection;
use Illuminate\Validation\Rule;
use Illuminate\Validation\Validator;
class UpdatePostRequest extends FormRequest
{
public function authorize(): bool
{
return true;
}
public function rules(): array
{
$enforcesPlatformLimits = in_array(
$this->input('status'),
[Status::Scheduled->value, Status::Publishing->value],
true,
);
return [
'status' => ['required', 'string', Rule::in([Status::Draft->value, Status::Scheduled->value, Status::Publishing->value])],
'content' => [
'nullable',
'string',
'max:10000',
Rule::when(
$enforcesPlatformLimits,
[new ContentFitsPlatformLimits($this->resolveSelectedPlatforms())]
),
],
'media' => ['sometimes', 'array'],
'media.*.id' => ['sometimes', 'nullable', 'string'],
'media.*.path' => ['sometimes', 'nullable', 'string', 'max:500'],
'media.*.url' => ['required', 'string', 'max:2048', 'url:http,https'],
'media.*.type' => ['sometimes', 'nullable', 'string', 'max:32'],
'media.*.mime_type' => ['sometimes', 'nullable', 'string', 'max:255'],
'media.*.original_filename' => ['sometimes', 'nullable', 'string', 'max:500'],
'media.*.size' => ['sometimes', 'nullable', 'integer'],
'media.*.meta' => ['sometimes', 'nullable', 'array'],
'platforms' => ['sometimes', 'array'],
'platforms.*.id' => ['required', 'uuid', Rule::exists('post_platforms', 'id')->where('post_id', $this->route('post') instanceof Post ? $this->route('post')->id : $this->route('post'))],
'platforms.*.content_type' => [
'sometimes',
'string',
Rule::in(array_column(ContentType::cases(), 'value')),
new ContentTypeMatchesPostPlatform,
],
...PostPlatformMetaRules::rules(),
'scheduled_at' => [
'nullable',
'date',
Rule::when(
$this->input('status') === Status::Scheduled->value,
['after:now']
),
],
'label_ids' => ['sometimes', 'array'],
'label_ids.*' => ['uuid', Rule::exists('workspace_labels', 'id')->where('workspace_id', $this->user()->currentWorkspace->id)],
];
}
public function withValidator(Validator $validator): void
{
$validator->after(function (Validator $validator): void {
if (! in_array($this->input('status'), [Status::Scheduled->value, Status::Publishing->value], true)) {
return;
}
$this->addMediaCompatibilityErrors($validator);
$platformsById = $this->resolveSelectedPlatforms();
PostPlatformMetaRules::addRequiredOnPublishErrors(
$validator,
$this->input('platforms', []),
fn ($platform) => $platformsById[data_get($platform, 'id')] ?? null,
);
});
}
/**
* On publish/schedule, validate every platform's *effective* content_type
* (resubmitted in this request, or its stored value) against the *effective*
* media (the request's media when sent, otherwise the post's stored media).
* This closes the gap where a client publishes a misconfigured post — e.g. a
* PDF on a regular LinkedIn post — without resubmitting content_type, which a
* field-level rule on `platforms.*.content_type` would skip.
*/
private function addMediaCompatibilityErrors(Validator $validator): void
{
$routePost = $this->route('post');
$post = $routePost instanceof Post ? $routePost : Post::find($routePost);
if (! $post) {
return;
}
$media = $this->has('media') ? (array) $this->input('media', []) : (array) ($post->media ?? []);
$entries = ContentTypeCompatibleWithMedia::entriesForUpdate(
$post,
$this->has('platforms') ? (array) $this->input('platforms', []) : null,
);
foreach (ContentTypeCompatibleWithMedia::errorsFor($entries, $media) as $key => $message) {
$validator->errors()->add($key, $message);
}
}
/**
* @return Collection<int|string, Platform>
*/
private function resolveSelectedPlatforms(): Collection
{
$ids = collect($this->input('platforms', []))->pluck('id')->filter()->all();
if (empty($ids)) {
return collect();
}
$post = $this->route('post');
$postId = $post instanceof Post ? $post->id : $post;
return PostPlatform::query()
->where('post_id', $postId)
->whereIn('id', $ids)
->pluck('platform', 'id');
}
}