From 29bc7deb2104fe84a53644c7d7b599d004b23629 Mon Sep 17 00:00:00 2001
From: Paulo Castellano <paulofcastellano@gmail.com>
Date: Wed, 1 Apr 2026 12:57:43 -0300
Subject: [PATCH] fix: restrict status to user-settable values, validate
 duplicate targets, scope API labels

---
 app/Http/Controllers/App/MediaController.php     | 7 +++++++
 app/Http/Requests/Api/Post/UpdatePostRequest.php | 2 +-
 app/Http/Requests/App/Post/UpdatePostRequest.php | 2 +-
 3 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/app/Http/Controllers/App/MediaController.php b/app/Http/Controllers/App/MediaController.php
index c0227873..310e691e 100644
--- a/app/Http/Controllers/App/MediaController.php
+++ b/app/Http/Controllers/App/MediaController.php
@@ -15,6 +15,7 @@
 use Illuminate\Database\Eloquent\Relations\Relation;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
+use Illuminate\Validation\Rule;
 
 class MediaController extends Controller
 {
@@ -118,6 +119,12 @@ public function duplicate(Media $media, Request $request): JsonResponse
         $sourceModel = $media->mediable;
         $this->authorizeModelOwnership($sourceModel, $request);
 
+        $request->validate([
+            'targets' => ['required', 'array', 'max:50'],
+            'targets.*.model' => ['required', 'string', Rule::in(['postPlatform', 'workspace', 'user'])],
+            'targets.*.model_id' => ['required', 'string'],
+        ]);
+
         $targets = $request->input('targets', []);
         $duplicates = [];
 
diff --git a/app/Http/Requests/Api/Post/UpdatePostRequest.php b/app/Http/Requests/Api/Post/UpdatePostRequest.php
index e317ac84..52434859 100644
--- a/app/Http/Requests/Api/Post/UpdatePostRequest.php
+++ b/app/Http/Requests/Api/Post/UpdatePostRequest.php
@@ -20,7 +20,7 @@ public function authorize(): bool
     public function rules(): array
     {
         return [
-            'status' => ['required', 'string', Rule::in(array_column(Status::cases(), 'value'))],
+            'status' => ['required', 'string', Rule::in([Status::Draft->value, Status::Scheduled->value, Status::Publishing->value])],
             'synced' => ['required', 'boolean'],
             'platforms' => ['required', 'array'],
             'platforms.*.id' => ['required', 'uuid', Rule::exists('post_platforms', 'id')->where('post_id', $this->route('post') instanceof Post ? $this->route('post')->id : $this->route('post'))],
diff --git a/app/Http/Requests/App/Post/UpdatePostRequest.php b/app/Http/Requests/App/Post/UpdatePostRequest.php
index 22df881b..d27ef242 100644
--- a/app/Http/Requests/App/Post/UpdatePostRequest.php
+++ b/app/Http/Requests/App/Post/UpdatePostRequest.php
@@ -19,7 +19,7 @@ public function authorize(): bool
     public function rules(): array
     {
         return [
-            'status' => ['required', 'string', Rule::in(array_column(Status::cases(), 'value'))],
+            'status' => ['required', 'string', Rule::in([Status::Draft->value, Status::Scheduled->value, Status::Publishing->value])],
             'synced' => ['required', 'boolean'],
             'scheduled_at' => [
                 'sometimes',