No description
c871edf144
The previous MediaAttacher had ~5 responsibilities crammed in one class (URL validation, HTTP fetch, streaming, MIME check, Storage write, post.media merge) plus an `if ($app->runningUnitTests()) return true` inside the SSRF guard — production code that knew about test mode. Split into three: - UrlSafetyGuard (interface) + DnsUrlSafetyGuard (default impl). The full SSRF check is now isolated and unit-testable in tests/Unit/Services/Post/DnsUrlSafetyGuardTest. Tests bind a permissive guard in tests/TestCase::setUp so feature tests using Http::fake() with synthetic hosts (cdn.example.com) still work — the runningUnitTests() check inside production code is gone. - MediaDownloader: takes a URL, returns a temp file + MIME or null. Uses Http::sink with a Guzzle progress callback that throws once maxBytes is exceeded, so we abort mid-stream without buffering the body in PHP memory (the previous chunk loop was append-to-string which defeated the whole point of streaming). - MediaAttacher: pure orchestrator. Calls MediaDownloader, validates the MIME against the post's enabled platforms, persists via Storage::putFileAs, appends the Media record under a row lock. Drops from 275 to ~190 lines with zero responsibility overlap. The IO contract (`null` on failure, `['path','mime','bytes']` on success) keeps MediaAttacher free of the temp-file lifecycle on the happy path — ownership is documented in MediaDownloader's PHPDoc and the orchestrator unlinks via try/finally in processOne(). Bind the interface in AppServiceProvider so production resolves DnsUrlSafetyGuard automatically; tests override it. 7 new unit tests cover the SSRF cases (loopback, RFC1918, link-local, zero/broadcast, IPv6 loopback/ULA/link-local, plus a public-IP positive test). The 14 existing AttachMedia feature tests stay green. |
||
|---|---|---|
| .claude/skills | ||
| .github | ||
| app | ||
| bootstrap | ||
| config | ||
| database | ||
| lang | ||
| maizzle | ||
| public | ||
| resources | ||
| routes | ||
| storage | ||
| stubs | ||
| templates | ||
| tests | ||
| .editorconfig | ||
| .env.ci | ||
| .env.example | ||
| .env.testing | ||
| .gitattributes | ||
| .gitignore | ||
| .mcp.json | ||
| .prettierignore | ||
| .prettierrc | ||
| artisan | ||
| boost.json | ||
| CLAUDE.md | ||
| components.json | ||
| compose.yaml | ||
| composer.json | ||
| composer.lock | ||
| eslint.config.js | ||
| GEMINI.md | ||
| LICENSE.md | ||
| package-lock.json | ||
| package.json | ||
| phpunit.xml | ||
| pint.json | ||
| README.md | ||
| tsconfig.json | ||
| vite.config.ts | ||
The open-source social media scheduling platform
Schedule, manage, and publish content to all your social media accounts from one place.
Self-hosted. Privacy-focused. No limits.
Documentation • Roadmap • Community
Why TryPost?
Tired of paying expensive monthly fees for social media scheduling tools? Want full control over your data? TryPost is the solution.
| 100% Open Source | Inspect the code, contribute, make it yours |
| Self-Hosted | Your data stays on your servers |
| No Limits | Schedule unlimited posts, connect unlimited accounts |
| Privacy First | No tracking, no analytics, no data selling |
Features
| Visual Calendar | Drag and drop posts across your content calendar |
| Post Composer | Create and preview posts for multiple platforms at once |
| Media Library | Upload images and videos with automatic optimization |
| Team Collaboration | Invite team members with role-based permissions (Owner, Admin, Member) |
| Workspaces | Manage multiple brands or clients separately |
| REST API | Full API with Bearer token authentication |
| MCP Server | AI-ready with Model Context Protocol support |
| Google Login | Sign up and log in with Google OAuth |
| Notifications | In-app and email notifications for post status |
| i18n | Available in English, Spanish, and Portuguese |
Supported Platforms
 X (Twitter) |
 |
 |
 |
 TikTok |
 YouTube |
 |
 Threads |
 Bluesky |
 Mastodon |
Tech Stack
| Layer | Technology |
|---|---|
| Backend | Laravel 13, PHP 8.4 |
| Frontend | Vue 3, Inertia.js v3, Tailwind CSS v4 |
| Database | PostgreSQL |
| Queue | Redis + Laravel Horizon |
| WebSockets | Laravel Reverb |
| API | REST with Bearer token auth |
| MCP | Laravel MCP for AI integrations |
| Payments | Laravel Cashier (Stripe) |
Getting Started
Get TryPost running in minutes:
| Installation Guide | Step-by-step setup |
| Docker Setup | Run with Laravel Sail |
| Configuration | Environment setup |
| Platform Setup | Connect your social accounts |
Quick Start
git clone https://github.com/trypost-it/trypost.git
cd trypost
cp .env.example .env
composer install
npm install
php artisan key:generate
php artisan migrate
npm run build
API
TryPost includes a REST API for programmatic access. All endpoints are under /api and require a Bearer token.
curl -H "Authorization: Bearer tp_your_token" \
https://your-domain.com/api/posts
See the API documentation for all available endpoints.
MCP Server
TryPost ships with a Model Context Protocol (MCP) server at /mcp/trypost, enabling AI assistants to manage your social media directly.
Contributing
We love contributions! Check the issues for open tasks.
- Discussions - Ask questions, share ideas
- Issues - Report bugs, request features
License
TryPost is licensed under the Functional Source License (FSL).
You can: Use for personal or business use, self-host, modify and contribute.
You cannot: Offer as a competing SaaS, white-label and resell.
If TryPost helps you, please give us a star