06e01797d1
Critical: - Fix EnsureUserSetupIsComplete middleware route name prefixes and redirect Subscription step to subscribe page (not onboarding) - Fix MCP session pollution: Auth::setUser() instead of Auth::login() - Remove dead BillingController::addWorkspace/removeWorkspace methods - Remove broken Workspace::pendingInvites() method Security (IDOR): - MediaController: add workspace ownership verification on all endpoints - UpdatePostRequest: scope label_ids validation to current workspace - UpdatePostRequest: scope platform IDs validation to current post Security (other): - Fix open redirect in login and registration (validate internal URLs) - Add validation to API PostController store/update (was $request->all()) - Prevent Owner role assignment via updateRole endpoint - Fix API post author attribution to use workspace owner Authorization: - PostController: use createPost policy instead of view for store/update/destroy Logic: - Post Status enum labels now use translation system instead of hardcoded Portuguese - Workspace deletion cleans up current_workspace_id for all affected members - StoreWorkspaceInviteRequest: replace Portuguese validation messages with __() Rename onboarding: - Step1.vue -> Role.vue, Step2.vue -> Connect.vue - Controller methods: step1->role, storeStep1->storeRole, step2->connect, storeStep2->storeConnect All 728 tests passing.
88 lines
2.8 KiB
PHP
88 lines
2.8 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace App\Http\Controllers\Auth;
|
|
|
|
use App\Enums\User\Setup;
|
|
use App\Http\Controllers\Controller;
|
|
use App\Models\User;
|
|
use App\Models\Workspace;
|
|
use App\Rules\Timezone;
|
|
use Illuminate\Auth\Events\Registered;
|
|
use Illuminate\Http\RedirectResponse;
|
|
use Illuminate\Http\Request;
|
|
use Illuminate\Support\Facades\Auth;
|
|
use Illuminate\Support\Facades\DB;
|
|
use Illuminate\Validation\Rules;
|
|
use Inertia\Inertia;
|
|
use Inertia\Response;
|
|
|
|
class RegisteredUserController extends Controller
|
|
{
|
|
/**
|
|
* Display the registration view.
|
|
*/
|
|
public function create(Request $request): Response
|
|
{
|
|
return Inertia::render('auth/Register', [
|
|
'email' => $request->query('email'),
|
|
'redirect' => $request->query('redirect'),
|
|
]);
|
|
}
|
|
|
|
/**
|
|
* Handle an incoming registration request.
|
|
*/
|
|
public function store(Request $request): RedirectResponse
|
|
{
|
|
$request->validate([
|
|
'name' => ['required', 'string', 'max:255'],
|
|
'email' => ['required', 'string', 'lowercase', 'email', 'max:255', 'unique:'.User::class],
|
|
'password' => ['required', Rules\Password::defaults()],
|
|
'timezone' => ['nullable', 'string', new Timezone],
|
|
]);
|
|
|
|
// Check if registering via invite link (redirect contains /invites/)
|
|
$isInviteRegistration = str_contains($request->input('redirect', ''), '/invites/');
|
|
|
|
$user = DB::transaction(function () use ($request, $isInviteRegistration) {
|
|
$user = User::create([
|
|
'name' => $request->name,
|
|
'email' => $request->email,
|
|
'password' => $request->password,
|
|
'setup' => $isInviteRegistration ? Setup::Completed : Setup::Role,
|
|
'email_verified_at' => $isInviteRegistration ? now() : null,
|
|
]);
|
|
|
|
// Create default workspace for new user
|
|
$workspace = Workspace::create([
|
|
'user_id' => $user->id,
|
|
'name' => $user->name."'s Workspace",
|
|
'timezone' => $request->input('timezone', 'UTC'),
|
|
]);
|
|
|
|
// Add user as owner member
|
|
$workspace->members()->attach($user->id, ['role' => 'owner']);
|
|
|
|
// Set as current workspace
|
|
$user->update(['current_workspace_id' => $workspace->id]);
|
|
|
|
return $user;
|
|
});
|
|
|
|
event(new Registered($user));
|
|
|
|
Auth::login($user);
|
|
|
|
// Check for redirect param
|
|
if ($redirect = $request->input('redirect')) {
|
|
// Only allow internal redirects (paths starting with /)
|
|
if (str_starts_with($redirect, '/') && ! str_starts_with($redirect, '//')) {
|
|
return redirect($redirect);
|
|
}
|
|
}
|
|
|
|
return redirect()->route('app.onboarding.role');
|
|
}
|
|
}
|