fix: prevent double-publish race condition, media upload auth bypass, TokenExpired disconnected_at

app/Console/Commands/ProcessScheduledPosts.php

@@ -4,6 +4,7 @@
 
 namespace App\Console\Commands;
 
+use App\Enums\Post\Status as PostStatus;
 use App\Jobs\PublishPost;
 use App\Models\Post;
 use Illuminate\Console\Command;
@@ -18,9 +19,13 @@ public function handle(): void
     {
         Post::query()
             ->due()
-            ->with(['postPlatforms.socialAccount', 'postPlatforms.media'])
-            ->chunk(100, function ($posts) {
-                foreach ($posts as $post) {
+            ->each(function (Post $post) {
+                // Atomically claim the post — only dispatch if we successfully change its status
+                $claimed = Post::where('id', $post->id)
+                    ->where('status', PostStatus::Scheduled)
+                    ->update(['status' => PostStatus::Publishing]);
+
+                if ($claimed) {
                     PublishPost::dispatch($post);
                 }
             });

app/Http/Controllers/App/MediaController.php

@@ -9,6 +9,8 @@
 use App\Models\Media;
 use App\Models\Post;
 use App\Models\PostPlatform;
+use App\Models\User;
+use App\Models\Workspace;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Database\Eloquent\Relations\Relation;
 use Illuminate\Http\JsonResponse;
@@ -162,6 +164,16 @@ private function authorizeModelOwnership(Model $model, Request $request): void
             if ($model->workspace_id !== $workspace->id) {
                 abort(403);
             }
+        } elseif ($model instanceof Workspace) {
+            if ($model->id !== $workspace->id) {
+                abort(403);
+            }
+        } elseif ($model instanceof User) {
+            if ($model->id !== $request->user()->id) {
+                abort(403);
+            }
+        } else {
+            abort(403);
         }
     }
 

app/Models/SocialAccount.php

@@ -136,6 +136,7 @@ public function markAsTokenExpired(string $errorMessage): void
         $this->update([
             'status' => Status::TokenExpired,
             'error_message' => $errorMessage,
+            'disconnected_at' => $this->disconnected_at ?? now(),
         ]);
     }