The public REST API accepted inline post media as a free-form array and stored it verbatim, so a client could create/update a post whose media was a bare external URL we never hosted. Publishing then depended on that third-party URL staying alive — when it 404'd (e.g. an image proxy), the post failed across platforms (Facebook 'unsupported media type', X 'HTTP 404', Instagram 'could not fetch media'). Inline media URLs on create/update now go through the same download + MIME- validate + host path as the attach-from-url endpoint (MediaAttacher), so the stored media always points at our own storage. Items already hosted (carrying a path) pass through untouched. If any URL can't be fetched the request is rejected with 422 and nothing is persisted, so a post is never created with broken media. MCP and the web flow were already safe and are unchanged. - MediaAttacher: extract fetchToWorkspace() + add resolveInlineMedia() - Post::allowedMediaTypesFor() so the create flow can compute allowed types without a persisted post - API Store/UpdatePostRequest: media.* item rules (mirroring the web; prevents validated() from stripping hosted-item keys) - PostController store()/update(): host external media before persisting
144 lines
5.3 KiB
PHP
144 lines
5.3 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace App\Http\Requests\Api\Post;
|
|
|
|
use App\Enums\Post\Status;
|
|
use App\Enums\PostPlatform\ContentType;
|
|
use App\Enums\SocialAccount\Platform;
|
|
use App\Models\Post;
|
|
use App\Models\PostPlatform;
|
|
use App\Rules\ContentFitsPlatformLimits;
|
|
use App\Rules\ContentTypeCompatibleWithMedia;
|
|
use App\Rules\ContentTypeMatchesPostPlatform;
|
|
use App\Support\PostPlatformMetaRules;
|
|
use Illuminate\Foundation\Http\FormRequest;
|
|
use Illuminate\Support\Collection;
|
|
use Illuminate\Validation\Rule;
|
|
use Illuminate\Validation\Validator;
|
|
|
|
class UpdatePostRequest extends FormRequest
|
|
{
|
|
public function authorize(): bool
|
|
{
|
|
return true;
|
|
}
|
|
|
|
public function rules(): array
|
|
{
|
|
$enforcesPlatformLimits = in_array(
|
|
$this->input('status'),
|
|
[Status::Scheduled->value, Status::Publishing->value],
|
|
true,
|
|
);
|
|
|
|
return [
|
|
'status' => ['required', 'string', Rule::in([Status::Draft->value, Status::Scheduled->value, Status::Publishing->value])],
|
|
'content' => [
|
|
'nullable',
|
|
'string',
|
|
'max:10000',
|
|
Rule::when(
|
|
$enforcesPlatformLimits,
|
|
[new ContentFitsPlatformLimits($this->resolveSelectedPlatforms())]
|
|
),
|
|
],
|
|
'media' => ['sometimes', 'array'],
|
|
'media.*.id' => ['sometimes', 'nullable', 'string'],
|
|
'media.*.path' => ['sometimes', 'nullable', 'string', 'max:500'],
|
|
'media.*.url' => ['required', 'string', 'max:2048', 'url:http,https'],
|
|
'media.*.type' => ['sometimes', 'nullable', 'string', 'max:32'],
|
|
'media.*.mime_type' => ['sometimes', 'nullable', 'string', 'max:255'],
|
|
'media.*.original_filename' => ['sometimes', 'nullable', 'string', 'max:500'],
|
|
'media.*.size' => ['sometimes', 'nullable', 'integer'],
|
|
'media.*.meta' => ['sometimes', 'nullable', 'array'],
|
|
'platforms' => ['sometimes', 'array'],
|
|
'platforms.*.id' => ['required', 'uuid', Rule::exists('post_platforms', 'id')->where('post_id', $this->route('post') instanceof Post ? $this->route('post')->id : $this->route('post'))],
|
|
'platforms.*.content_type' => [
|
|
'sometimes',
|
|
'string',
|
|
Rule::in(array_column(ContentType::cases(), 'value')),
|
|
new ContentTypeMatchesPostPlatform,
|
|
],
|
|
...PostPlatformMetaRules::rules(),
|
|
'scheduled_at' => [
|
|
'nullable',
|
|
'date',
|
|
Rule::when(
|
|
$this->input('status') === Status::Scheduled->value,
|
|
['after:now']
|
|
),
|
|
],
|
|
'label_ids' => ['sometimes', 'array'],
|
|
'label_ids.*' => ['uuid', Rule::exists('workspace_labels', 'id')->where('workspace_id', $this->user()->currentWorkspace->id)],
|
|
];
|
|
}
|
|
|
|
public function withValidator(Validator $validator): void
|
|
{
|
|
$validator->after(function (Validator $validator): void {
|
|
if (! in_array($this->input('status'), [Status::Scheduled->value, Status::Publishing->value], true)) {
|
|
return;
|
|
}
|
|
|
|
$this->addMediaCompatibilityErrors($validator);
|
|
|
|
$platformsById = $this->resolveSelectedPlatforms();
|
|
|
|
PostPlatformMetaRules::addRequiredOnPublishErrors(
|
|
$validator,
|
|
$this->input('platforms', []),
|
|
fn ($platform) => $platformsById[data_get($platform, 'id')] ?? null,
|
|
);
|
|
});
|
|
}
|
|
|
|
/**
|
|
* On publish/schedule, validate every platform's *effective* content_type
|
|
* (resubmitted in this request, or its stored value) against the *effective*
|
|
* media (the request's media when sent, otherwise the post's stored media).
|
|
* This closes the gap where a client publishes a misconfigured post — e.g. a
|
|
* PDF on a regular LinkedIn post — without resubmitting content_type, which a
|
|
* field-level rule on `platforms.*.content_type` would skip.
|
|
*/
|
|
private function addMediaCompatibilityErrors(Validator $validator): void
|
|
{
|
|
$routePost = $this->route('post');
|
|
$post = $routePost instanceof Post ? $routePost : Post::find($routePost);
|
|
|
|
if (! $post) {
|
|
return;
|
|
}
|
|
|
|
$media = $this->has('media') ? (array) $this->input('media', []) : (array) ($post->media ?? []);
|
|
|
|
$entries = ContentTypeCompatibleWithMedia::entriesForUpdate(
|
|
$post,
|
|
$this->has('platforms') ? (array) $this->input('platforms', []) : null,
|
|
);
|
|
|
|
foreach (ContentTypeCompatibleWithMedia::errorsFor($entries, $media) as $key => $message) {
|
|
$validator->errors()->add($key, $message);
|
|
}
|
|
}
|
|
|
|
/**
|
|
* @return Collection<int|string, Platform>
|
|
*/
|
|
private function resolveSelectedPlatforms(): Collection
|
|
{
|
|
$ids = collect($this->input('platforms', []))->pluck('id')->filter()->all();
|
|
if (empty($ids)) {
|
|
return collect();
|
|
}
|
|
|
|
$post = $this->route('post');
|
|
$postId = $post instanceof Post ? $post->id : $post;
|
|
|
|
return PostPlatform::query()
|
|
->where('post_id', $postId)
|
|
->whereIn('id', $ids)
|
|
->pluck('platform', 'id');
|
|
}
|
|
}
|