Critical: - Fix EnsureUserSetupIsComplete middleware route name prefixes and redirect Subscription step to subscribe page (not onboarding) - Fix MCP session pollution: Auth::setUser() instead of Auth::login() - Remove dead BillingController::addWorkspace/removeWorkspace methods - Remove broken Workspace::pendingInvites() method Security (IDOR): - MediaController: add workspace ownership verification on all endpoints - UpdatePostRequest: scope label_ids validation to current workspace - UpdatePostRequest: scope platform IDs validation to current post Security (other): - Fix open redirect in login and registration (validate internal URLs) - Add validation to API PostController store/update (was $request->all()) - Prevent Owner role assignment via updateRole endpoint - Fix API post author attribution to use workspace owner Authorization: - PostController: use createPost policy instead of view for store/update/destroy Logic: - Post Status enum labels now use translation system instead of hardcoded Portuguese - Workspace deletion cleans up current_workspace_id for all affected members - StoreWorkspaceInviteRequest: replace Portuguese validation messages with __() Rename onboarding: - Step1.vue -> Role.vue, Step2.vue -> Connect.vue - Controller methods: step1->role, storeStep1->storeRole, step2->connect, storeStep2->storeConnect All 728 tests passing.
139 lines
4.2 KiB
PHP
139 lines
4.2 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace App\Http\Controllers\App;
|
|
|
|
use App\Enums\SocialAccount\Platform as SocialPlatform;
|
|
use App\Enums\User\Persona;
|
|
use App\Enums\User\Setup;
|
|
use App\Models\User;
|
|
use Illuminate\Http\RedirectResponse;
|
|
use Illuminate\Http\Request;
|
|
use Illuminate\Validation\Rule;
|
|
use Inertia\Inertia;
|
|
use Inertia\Response;
|
|
use Symfony\Component\HttpFoundation\Response as SymfonyResponse;
|
|
|
|
class OnboardingController extends Controller
|
|
{
|
|
public function role(Request $request): Response|RedirectResponse
|
|
{
|
|
$redirect = $this->enforceStep($request->user(), Setup::Role);
|
|
if ($redirect) {
|
|
return $redirect;
|
|
}
|
|
|
|
return Inertia::render('onboarding/Role', [
|
|
'personas' => Persona::toSelectArray(),
|
|
]);
|
|
}
|
|
|
|
public function storeRole(Request $request): RedirectResponse
|
|
{
|
|
$validated = $request->validate([
|
|
'persona' => ['required', Rule::enum(Persona::class)],
|
|
]);
|
|
|
|
$request->user()->update([
|
|
'persona' => $validated['persona'],
|
|
'setup' => Setup::Connections,
|
|
]);
|
|
|
|
return redirect()->route('app.onboarding.connect');
|
|
}
|
|
|
|
public function connect(Request $request): Response|RedirectResponse
|
|
{
|
|
$redirect = $this->enforceStep($request->user(), Setup::Connections);
|
|
if ($redirect) {
|
|
return $redirect;
|
|
}
|
|
|
|
$user = $request->user();
|
|
$workspace = $user->currentWorkspace;
|
|
|
|
$platforms = collect();
|
|
|
|
if ($workspace) {
|
|
$connectedAccounts = $workspace->socialAccounts;
|
|
|
|
$platforms = collect(SocialPlatform::enabled())->map(fn ($platform) => [
|
|
'value' => $platform->value,
|
|
'label' => $platform->label(),
|
|
'color' => $platform->color(),
|
|
'connected' => $connectedAccounts->firstWhere('platform', $platform) !== null,
|
|
'account' => $connectedAccounts->firstWhere('platform', $platform),
|
|
])->values();
|
|
}
|
|
|
|
return Inertia::render('onboarding/Connect', [
|
|
'platforms' => $platforms,
|
|
'hasWorkspace' => $workspace !== null,
|
|
]);
|
|
}
|
|
|
|
public function storeConnect(Request $request): SymfonyResponse|RedirectResponse
|
|
{
|
|
$user = $request->user();
|
|
|
|
if (config('trypost.self_hosted')) {
|
|
$user->update([
|
|
'setup' => Setup::Completed,
|
|
]);
|
|
|
|
session()->flash('flash.banner', __('auth.flash.welcome'));
|
|
session()->flash('flash.bannerStyle', 'success');
|
|
|
|
return redirect()->route('app.calendar');
|
|
}
|
|
|
|
$user->update([
|
|
'setup' => Setup::Subscription,
|
|
]);
|
|
|
|
$subscription = $user->newSubscription('default', config('cashier.plans.monthly.price_id'))
|
|
->allowPromotionCodes()
|
|
->trialDays(config('cashier.trial_days'))
|
|
->quantity(1);
|
|
|
|
$checkoutSession = $subscription->checkout([
|
|
'success_url' => route('app.onboarding.complete').'?session_id={CHECKOUT_SESSION_ID}',
|
|
'cancel_url' => route('app.onboarding.connect'),
|
|
]);
|
|
|
|
return Inertia::location($checkoutSession->url);
|
|
}
|
|
|
|
public function complete(Request $request): RedirectResponse
|
|
{
|
|
$user = $request->user();
|
|
|
|
$user->update([
|
|
'setup' => Setup::Completed,
|
|
]);
|
|
|
|
session()->flash('flash.banner', __('auth.flash.welcome_trial'));
|
|
session()->flash('flash.bannerStyle', 'success');
|
|
|
|
return redirect()->route('app.calendar');
|
|
}
|
|
|
|
private function enforceStep(User $user, Setup $expectedStep): ?RedirectResponse
|
|
{
|
|
if ($user->setup === $expectedStep) {
|
|
return null;
|
|
}
|
|
|
|
if ($user->setup === Setup::Completed) {
|
|
return redirect()->route('app.calendar');
|
|
}
|
|
|
|
return match ($user->setup) {
|
|
Setup::Role => redirect()->route('app.onboarding.role'),
|
|
Setup::Connections => redirect()->route('app.onboarding.connect'),
|
|
Setup::Subscription => redirect()->route('app.subscribe'),
|
|
default => redirect()->route('app.onboarding.role'),
|
|
};
|
|
}
|
|
}
|