fix: restrict status to user-settable values, validate duplicate targets, scope API labels

app/Http/Controllers/App/MediaController.php

@@ -15,6 +15,7 @@
 use Illuminate\Database\Eloquent\Relations\Relation;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
+use Illuminate\Validation\Rule;
 
 class MediaController extends Controller
 {
@@ -118,6 +119,12 @@ public function duplicate(Media $media, Request $request): JsonResponse
         $sourceModel = $media->mediable;
         $this->authorizeModelOwnership($sourceModel, $request);
 
+        $request->validate([
+            'targets' => ['required', 'array', 'max:50'],
+            'targets.*.model' => ['required', 'string', Rule::in(['postPlatform', 'workspace', 'user'])],
+            'targets.*.model_id' => ['required', 'string'],
+        ]);
+
         $targets = $request->input('targets', []);
         $duplicates = [];
 

app/Http/Requests/Api/Post/UpdatePostRequest.php

@@ -20,7 +20,7 @@ public function authorize(): bool
     public function rules(): array
     {
         return [
-            'status' => ['required', 'string', Rule::in(array_column(Status::cases(), 'value'))],
+            'status' => ['required', 'string', Rule::in([Status::Draft->value, Status::Scheduled->value, Status::Publishing->value])],
             'synced' => ['required', 'boolean'],
             'platforms' => ['required', 'array'],
             'platforms.*.id' => ['required', 'uuid', Rule::exists('post_platforms', 'id')->where('post_id', $this->route('post') instanceof Post ? $this->route('post')->id : $this->route('post'))],

app/Http/Requests/App/Post/UpdatePostRequest.php

@@ -19,7 +19,7 @@ public function authorize(): bool
     public function rules(): array
     {
         return [
-            'status' => ['required', 'string', Rule::in(array_column(Status::cases(), 'value'))],
+            'status' => ['required', 'string', Rule::in([Status::Draft->value, Status::Scheduled->value, Status::Publishing->value])],
             'synced' => ['required', 'boolean'],
             'scheduled_at' => [
                 'sometimes',