94 commits

Author	SHA1	Message	Date
vickytechkey	6fe93eea7f	fix(instagram): add Instagram OAuth credentials to deployment and ensure explicit redirect URL	2026-09-13 20:12:28 +05:30
Paulo Castellano	02e44b9785	Connect the Pages a login only reaches through a Business Portfolio (#301) ... * fix: Facebook Page fetch missing New Pages Experience pages /me/accounts silently omits Pages that live under Meta's newer "New Pages Experience" / Business Portfolio model, even when the token's granular scopes show the Page was explicitly granted - confirmed via Meta's own Access Token Debugger against a live account whose Page returned zero results from /me/accounts but resolved fine when queried directly by ID. Falls back through Business Manager's owned_pages/client_pages (via the existing business_management scope) when /me/accounts comes back empty, so Pages under that model are still found. * fix: Instagram-via-Facebook has the same New Pages Experience gap Same root cause and fix as the FacebookController fetchPages() fallback - the Page/Instagram-linked-Page lookup goes through the same /me/accounts call and is subject to the same Meta-side gap. * refactor: one place finds every Page a Meta login can publish to Both controllers walked /me/accounts and, when it came back empty, the Business Portfolio edges behind it. ManagedPages now owns that walk for the Facebook and Instagram-via-Facebook flows alike. Three behaviour changes come with it: The portfolio edges are read on every connect, not only when /me/accounts is empty, and merged by Page id. Someone holding one Page by a classic role and the rest through a portfolio was auto-connected to that single Page and never offered the others. /me/businesses is read only once /me/permissions confirms the login granted business_management, and a failure anywhere along the portfolio walk leaves the /me/accounts list standing. It used to escape into the callback's catch, turning "no pages" into "could not connect" for every login without the scope. Pages the login cannot get an access_token for are dropped. Connecting one produces an account that cannot publish. * test: pin the Page a login only reaches through a portfolio Covers the merge with /me/accounts, the access_token filter, the business_management gate, and a failing portfolio edge leaving the /me/accounts list intact — plus the connect flow end to end on both Meta platforms. The Instagram-via-Facebook request count moves from five to six for the /me/permissions check. * refactor: read the portfolio edges without asking permission first The /me/permissions check saved a rejected /me/businesses call on logins without business_management, at the cost of running a path nobody had verified against a live account. The edges already fail soft, so the check bought log tidiness and nothing else. * test: cover the portfolio walk's remaining shapes The multi-Page selection flow behind a portfolio — the case #292 asked a maintainer to check — plus pages spread across two portfolios, a paginated edge, a portfolio entry with no id, and a portfolio page merging with one /me/accounts already returned. * test: stop the Meta connect tests from calling Graph for real Http::fake only stubs the URLs it is given; anything else goes out over the network. These files stubbed /me/accounts and left /me — and now /me/businesses — unstubbed, so the suite was issuing live requests to graph.facebook.com on every run. They came back 400 and the code under test swallowed them, so nothing ever went red while the assertions were measuring Meta's answer instead of the fixture's. Every Graph call the connect flow makes is stubbed now, and the files prevent stray requests so a missing one fails loudly. Inertia's SSR endpoint is allowed through; it is not what these tests are about. * fix: tell a denied portfolio edge apart from a throttled one GraphPaginator throws so no caller reads a failed fetch as an empty list and auto-connects whatever arrived first. Swallowing that exception on the portfolio edges gave the invariant away: a 429 on owned_pages left the merged list holding only the /me/accounts page, and the callback connected it with no picker. The exception now carries whether the failure was transient, classified by GraphError, which already owns Meta's rate-limit and transient code table. A denied permission reads as "this login reaches no portfolio pages"; a throttle, a 5xx or a truncated walk is raised. The walk also stops at MAX_PORTFOLIOS and logs what it skipped. Each portfolio costs two more paginated edges inside a synchronous OAuth callback, and nothing bounded that loop. * fix: three ways the portfolio walk misread what Meta returned Concurrent Instagram lookups. The Instagram description ran one request per Page, in sequence, at a 15s timeout each. That list used to be the Pages someone holds a role on — a handful. It is now the union with every portfolio's owned_pages and client_pages, so a portfolio holding hundreds of Pages serialised the OAuth callback past any gateway timeout, for exactly the accounts the portfolio walk exists to reach. Meta's ids= batching is no help: each Page carries its own access token and one call takes one token. The lookups run in concurrent rounds. A Page without a token is not a Page you don't have. Meta lets someone decline pages_read_engagement on its per-permission toggles and still lists the Page, without an access_token. Dropping it inside the walk left the caller saying "no Pages found, you need to be an admin of at least one" to an admin. ManagedPages returns everything Meta listed and publishable() separates what can be posted to, so the callbacks can tell the two apart and say which one happened. Stored scopes are what Meta granted. The scope list was written to the account's scopes column straight from the request, claiming access the login may have refused — business_management above all, which needs Advanced Access and is declined by default without it. It now comes from /me/permissions, falling back to the request when Meta cannot be asked. * fix: only drop a scope Meta says was refused PublishToSocialPlatform::failForMissingScopes() blocks a post when a platform's required publish scope is absent from the account's scopes column, so writing that column from /me/permissions can dead-end an account. Meta does not document that the endpoint echoes scope strings verbatim, and the edge is paginated, so a scope it never mentions is unknown rather than refused and stays. Only declined and expired drop. * fix: keep the portfolio walk honest and cheap Raise instead of truncating. The ceiling logged a warning and returned whatever fit, which is the one thing this module refuses to do everywhere else: if the walk cannot finish, the real list is unknown, and a truncated list holding exactly one Page would have been auto-connected without ever showing the picker. It now raises, and the ceiling rises to GraphPaginator::MAX_PAGES' 100 since the walk no longer pays for it serially. Read the edges concurrently. Up to two paginated edges per portfolio ran back to back inside the OAuth callback. They run in rounds now; a URL that does not come back cleanly still goes through GraphPaginator, which owns the single place that logs a Graph failure and decides whether it is a rejection or an unknown. Prefer the record that carries a token. Merging kept whichever copy of a Page id arrived first, and /me/accounts always arrives first — so a Page listed there without a token buried the portfolio copy that had one, and the login was told its permission was missing for a Page it could reach. Describe only the Instagram accounts that survive. The per-Page lookup ran before filterConnectableIdentities discarded them, spending a BUC-rate-limited call on every Page only to throw the answer away. The filter reads instagram_business_account.id straight off the raw Page, so it needs no lookup to run first. Two Instagram tests mocked Socialite without usingGraphVersion, so the callback threw, the generic catch answered, and asserting only success=false passed on the error path instead of the one under test. * test: pin that pages survive past the first pooled round The concurrency test drove 30 portfolios with every edge empty, so the merge across rounds was never exercised with data in it. * fix: keep the paging-host guard on the pooled edge walk GraphPaginator refuses to follow a paging.next that points off the host the walk started from, so a tampered response cannot carry the access token somewhere else. Reading the first page of each edge through the pool and handing its paging.next straight back to GraphPaginator made that URL the *start* of a new walk, which is the one URL the guard trusts implicitly — so the first hop went unchecked. The host is compared before the hand-off now, and a mismatch re-walks the edge from the beginning so GraphPaginator's own guard is what refuses it, with its logging. * fix: stop a cut-short walk from passing for a complete one optional() was written for "this edge may be forbidden" and answers a rejection with an empty list. Following paging.next through it gave a rejected cursor the same answer: page one of a 250-Page portfolio came back and the rest was dropped, and a single connectable Page in that fragment would have been auto-connected with no picker. The same hole sat on /me/businesses, where GraphPaginator is all-or-nothing — a failure on page two threw away the portfolios page one had already listed, degrading the connect back to /me/accounts alone in silence. The exception now carries how many pages arrived. Only a rejection on the very first request reads as "this edge is not readable"; anything after that is a fragment and raises. Cursors skip optional() entirely. A login Meta reports as refusing business_management also stops walking the edges at all. The controllers already read /me/permissions for the scopes column, so the answer costs nothing, and the walk was otherwise spending a request on a certain 403 — and logging it at error level — on every successful connect by such a login. An Instagram account with an empty Name connected as display_name null: data_get's default only fires on an absent key, and describeRound always writes the key. * test: pin reconnecting a card only the portfolio still reaches A card whose Page moved behind a portfolio is the reconnect shape of the bug this branch fixes, and nothing covered it: the walk has to find the Page, and filterConnectableIdentities has to keep the original card rather than offering the portfolio's other Pages. * fix: an unreadable portfolio must not deny the pages that were readable The portfolio edges are additive, but every failure in them was raised and the callback's generic catch turned it into "error connecting" — so one throttled edge among sixty denied a login the Pages /me/accounts had already returned, and each retry burned more of the quota that caused it. Only /me/accounts failing is fatal now; everything else marks the walk incomplete and keeps what arrived. What the raise was protecting is kept where it belongs: a lone Page is only taken without asking when the walk saw everything, or when a reconnect has already pinned which Page is wanted. Otherwise the picker opens, and the login can see for itself that its Page is not there. The ceiling stops pretending. It compared the count after walking every page of /me/businesses — up to ten thousand ids — so the runaway it existed to bound had already happened. One request, one page, and more portfolios than that is an incomplete walk rather than a failed one. A pooled edge that fails is classified where it lands instead of being re-fetched, halving the cost of the common client_pages rejection, and GraphPaginator logs a confirmed rejection at warning: it is Meta answering the question, not something going wrong. A login that declined the permission its platform needs to publish is refused at connect. Meta issues a Page token off pages_show_list, so declining pages_manage_posts still produced a green account whose every scheduled post was then hard-failed by failForMissingScopes. Test fakes address Graph through the config rather than a literal host, which is what CLAUDE.md asks for and what the newer tests already did. * fix: an incomplete walk must not answer as if it were sure Marking the walk incomplete stopped the auto-connect, but every dead end after it still gave a definitive answer. A login whose only Pages sit behind a throttled portfolio was told "no Facebook Pages found, you need to be an admin of at least one" — the exact sentence this branch exists to stop showing to admins, now arriving for a different reason. The already-connected and missing-permission answers were equally sure of themselves. When the walk could not see everything and there is nothing to offer, it says so and asks for a retry. * fix: stop every Inertia test from calling an SSR server inertia.ssr.enabled defaulted to true and nothing in phpunit.xml turned it off, so every test rendering an Inertia page issued a real request to the SSR endpoint. The project does not use SSR, so those calls only ever failed and fell back to client rendering — quietly, on every run. Defaulting it off is what the project already assumed, and it retires the allowStrayRequests hole the Meta connect tests were carrying to work around it. INERTIA_SSR_ENABLED still turns it back on. * fix: a taken slot is a fact, not a guess about the listing Routing every short listing to "try again in a moment" swallowed network_taken: a workspace that already holds its one Facebook account was told to retry, forever, whenever a portfolio edge was throttled. That answer comes from our own rows and does not depend on how far the walk got. all_connected and page_not_found do, and still yield. Also: an off-host cursor now stops the edge instead of re-reading page one, which cost a request and could follow an on-host cursor on the retry, quietly undoing the guard. Cursor follow-ups are budgeted, since they cannot be pooled and were the one unbounded serial path left. The exception's fetched count lost its last reader two commits ago and is gone. Comments trimmed throughout. * fix: bound the cursor walk by requests, and keep what it read MAX_CONTINUATIONS counted edges, not requests: each one then handed off to GraphPaginator, which follows up to a hundred more pages by itself. The budget the docblock promised was fifty times larger than it claimed. Cursors are now followed one budgeted request at a time, so the count means what it says, and pages already read survive a cut-off instead of being thrown away with the exception. A refused /me/businesses is no longer read as "this login has no portfolios". For a single edge a rejection answers the question; for the index of edges it means we could not look — and answering complete there auto-connected the one /me/accounts page while hiding every portfolio Page, which is this branch's own bug wearing a different hat. SSR goes back to its shipped default. Turning it off in config to quiet the test suite would have disabled it wherever it is actually started — docker/Dockerfile builds the bundle. phpunit.xml carries the switch now, next to PULSE, TELESCOPE and NIGHTWATCH, and CLAUDE.md records why. * refactor: one Meta connect flow instead of two kept in step by hand The Facebook and Instagram-via-Facebook callbacks ran the same twenty-five lines: the profile touch Meta's review wants, the granted-scope read and the publish-scope refusal, the page walk, and the answer for a walk with nothing to offer. They only matched because both were edited side by side, every round, which is a guarantee nobody should be making by hand. graphApi() moves to SocialController and reads the host by platform value, so it serves every network rather than the two that had copied it, and graphVersion() derives from it instead of reading config a second time. select() stays as it is. The two differ in the middle — different identity keys, different connect shapes — and folding them would be abstraction for its own sake. * fix: default Inertia SSR off, where this project already stands Nothing in the repo starts an SSR process, so the shipped default was describing a setup that does not exist. With it off the test env needs no override of its own, and CLAUDE.md records that turning it on means starting the process, not just flipping the env. * fix: one rule for a refused portfolio, and a clock on the walk Last round I made a refused /me/businesses mark the walk incomplete, on the argument that refusing the index means "we could not look". That was wrong in the case that matters most: an app without Advanced Access for business_management gets that refusal on every single connect, so every login on such an install lost auto-connect and every login without Pages was told to retry forever. Self-hosted in Live mode is exactly that. The rule that holds everywhere: a Page this login cannot enumerate is a Page it cannot get a token for, so it was never connectable, and the list of connectable Pages is complete. Only an unknown — a throttle, a hiccup, a budget or a ceiling — leaves the walk unable to vouch for itself. Index and edge now answer the same way, which is also what makes the two readable together. The per-request budgets were each bounded while their sum was not: ten pooled rounds plus twenty-five cursor requests can outlive nginx's fastcgi_read_timeout of 120s. The walk now carries a deadline and returns what it has. touchProfile exists only because Meta's review wants the call. It had no timeout and no guard, so a hung /me could stall the callback to the gateway timeout or fail a connect outright, over a response nobody reads. * docs: the walk's contract changed under its own docblock It still said any failure marks the walk incomplete, which stopped being true when a refusal became an answer. A docblock describing an invariant the code no longer holds is how this branch got two of its bugs. * fix: put the whole callback inside the budget it advertises meta_page_walk_seconds bounded the portfolio half of the walk and nothing else. /me/accounts could paginate a hundred pages at fifteen seconds each, and the Instagram lookups pooled in rounds that were themselves serial — a portfolio with three hundred linked Pages is fifteen rounds, after the walk had already spent its own budget. Both honour the deadline now. The lookups skip rather than drop: the Page still connects, only its handle and avatar arrive empty. The first request is always made; the budget bounds what comes after it. A Graph body that is valid JSON but not an object — a proxy answering "throttled" — reached GraphError::isTransient, whose parameter is ?array, and under strict_types raised a TypeError. That is an Error, so it walked past both callbacks' catch(\Exception) and 500'd the popup instead of showing a message. Refusing a login before any listing has happened no longer borrows the wording for "we found your Pages but not the permission to post to them". composer run dev no longer starts an SSR process for SSR that is off, and CLAUDE.md no longer claims nothing in the repo starts one, which composer.json contradicted. * fix: say what actually gets a Page token, per Meta's own reference The Page node reference is explicit: access_token is "only returned if the User making the request has a role (other than Live Contributor) on the Page". Being an admin of the portfolio that owns a Page lists it but does not grant that role, so the walk can surface Pages this login will never get a token for. The popup told those users to reconnect and accept every permission, which cannot produce a Page role and so could never work. It now names the role as well. I rejected this in review on the grounds that a portfolio Page had been published to successfully in the wild. That proved a token comes back when the login holds a role, not that one always does. * fix: one budget for the callback, not one per phase of it The walk and the Instagram lookups each opened a full meta_page_walk_seconds, on top of the profile touch and the permission read, so the callback's worst case was several times the single bounded budget config/trypost.php advertises. They share one deadline now, taken once and passed down. META_PAGE_WALK_SECONDS joins .env.example. An Instagram account described past that deadline arrived with no handle and no name, and a lone one was then persisted with display_name null — a blank, unidentifiable card. It falls back to the Page's own name. Two docblocks were describing behaviour the code does not have. /me/accounts is the base every other Page is added to, so running out of budget there aborts rather than degrades, and the class now says so instead of promising a partial list. GrantedPermissions justified treating an absent permission as unknown but said nothing about a failed request, which lands in the same place for a different reason. * fix: a Pages throttle on a user token was reading as a refusal Meta's BUC rate-limit table lists code 32 for the Pages API when called with a User token. GraphError did not carry it, because until this branch nothing in the app called a Pages surface that way — the publishers use Page tokens, where the same throttle arrives as 80001. The portfolio walk does: /me/accounts, /me/businesses and both edges are read with the user token straight out of OAuth. So an ordinary throttle came back as code 32, was classified as a confirmed rejection, and the walk concluded this login simply reaches no portfolio Pages — vouching for a list missing all of them and auto-connecting whatever /me/accounts happened to hold. A rate limit was producing the exact silence the complete flag exists to prevent. * fix: a reconnect no longer loses its handle to a slow Graph persistIdentity updates a reconnected card with whatever it is handed, so a described-with-nulls card overwrote a working account's username and avatar. Skipping the Instagram lookup — which the shared budget now does whenever the walk spent it — produced exactly that card. A lookup that never ran says nothing about a handle the account already has, so those two keys are left out when it did not. Refusing the portfolio index goes back to marking the walk incomplete. I had it that way, reversed it, and this settles it: Meta's Page reference returns access_token for a Page the login holds a role on, and a Page can carry that token on a portfolio edge while /me/accounts omits it — which is this branch's entire premise. So refusing one edge does say those Pages are unreachable, but refusing the index says no edge was read at all, and the Pages behind it may well have been connectable. Silently vouching for a list without them is the original bug. The budget also starts before the walk and now shapes each request's own timeout, so no single call can outlive it by fifteen seconds. composer dev:ssr was a slower alias of composer dev once the SSR process came out of it. --------- Co-authored-by: StoriaJames <james@storia.tech>	2026-08-26 10:42:59 -03:00
Hafiz Muhammad Moaz	91c3d86d86	Allow multiple social accounts per network via env (#286) ... * feat: expose self-hosted mode to the accounts UI SocialAccountObserver already bypasses the one-account-per-network guard when trypost.self_hosted is true, but the frontend had no way to know that and always collapsed a network to a single card once any account existed - so self-hosted deployments could not surface a second LinkedIn (or Instagram) connection even though the backend would allow creating it. * feat: allow connecting multiple accounts per network when self-hosted NetworkConnectGrid always collapsed a network (LinkedIn profile/page, Instagram standalone/Facebook) to a single card once any account existed, with no way to trigger another OAuth flow - even though SocialAccountObserver already allows unlimited accounts per network in self-hosted mode. A self-hoster connecting their personal LinkedIn profile had no path back to the connect flow to also add a company page (or a second company page/showcase page). Render one card per connected account instead of collapsing to the first, and keep a standing "Connect another" card available for a network's existing connections when self-hosted. Hosted mode is unchanged: still one card per network, matching the backend's still-enforced one-account-per-network limit there. * test: cover the selfHosted prop on accounts and onboarding pages Backend behavior for connecting a second identity per network in self-hosted mode was already covered (LinkedInControllerTest, NetworkUniquenessTest) - these just confirm the new prop the frontend now depends on is actually present and reflects config correctly. * style: apply prettier formatting Pre-existing drift in this file unrelated to the selfHosted change. * refactor: read selfHosted from shared Inertia props The flag is already shared by HandleInertiaRequests, so the accounts and onboarding controllers do not need to pass it again. Co-authored-by: Cursor <cursoragent@cursor.com> * feat: gate multiple social accounts with a dedicated env Cloud cannot flip SELF_HOSTED, so one-per-network is now ALLOW_MULTIPLE_SOCIAL_ACCOUNTS (default false). Co-authored-by: Cursor <cursoragent@cursor.com> * fix: tighten multiple-account gates after review Keep every connected identity visible, share occupiesNetwork, and return network_taken instead of a generic connect error. Co-authored-by: Cursor <cursoragent@cursor.com> * fix: bind reconnect to the card and unique social identity Reconnect now updates the selected account, and a unique index plus connectIdentity keep the same platform identity from being inserted twice. Co-authored-by: Cursor <cursoragent@cursor.com> * refactor: build the OAuth URL before opening the popup Keep the popup opener URL-only so reconnect query params are assembled at the call site. Co-authored-by: Cursor <cursoragent@cursor.com> * refactor: drop dead social-account guards and slim the connect grid Skip migration cleanup that production never needs, trust the platform enum in the observer, and move card theming out of the grid. Co-authored-by: Cursor <cursoragent@cursor.com> * refactor: scope social reconnect to the current network Drop dead instanceof/isset guards and filter reconnect targets in the query so a stale session cannot update another network's card. Co-authored-by: Cursor <cursoragent@cursor.com> * refactor: slim connectable-identity filtering Index OAuth identities by id so reconnect and occupancy use only/except instead of hand-rolled filters. Co-authored-by: Cursor <cursoragent@cursor.com> * refactor: slim social identity persist helpers Drop the unused occupiesNetwork exception and persist reconnects with update() instead of fill/save/fresh. Co-authored-by: Cursor <cursoragent@cursor.com> * fix: keep reconnect updates on the original social card Co-authored-by: Cursor <cursoragent@cursor.com> * test: run the suite with multiple social accounts enabled phpunit.xml forced ALLOW_MULTIPLE_SOCIAL_ACCOUNTS=false, overriding the true value in .env.ci. That broke eight tests across Automation, MCP, PostApi, RefreshExpiringTokens and VerifyUpcomingConnections which only needed two accounts of one network as a fixture, not as a rule under test. Match .env.ci instead. Every test that exercises the one-per-network rule already sets the config itself; the accounts index test was the only one leaning on the implicit default, so it now pins it. * fix: align the multi-account fallback with the self-hosted default allow_multiple_social_accounts fell back to env('SELF_HOSTED', false) while self_hosted itself defaults to env('SELF_HOSTED', true). A self-hosted install that never wrote SELF_HOSTED to its .env resolved to false and silently lost multiple accounts per network on upgrade, which is the opposite of what the documented fallback promises. * fix: collapse duplicate identities before adding the unique index Installs predating the index can hold the same identity twice: the network guard was bypassed for multi-account installs and Pinterest always created a fresh row. Creating the index on that data aborts migrate mid-deploy. Keep the newest row per identity and move its post_platforms over before dropping the duplicates - the FK is nullOnDelete, so deleting outright would orphan drafts and scheduled posts. * fix: refuse a reconnect that authorized a different identity connectIdentity overwrote platform_user_id with whatever the provider returned, so reconnecting a card while signed into another account repointed the row - and every draft and scheduled post bound to it - at a stranger. LinkedIn guarded this at the controller and Facebook via its filtered page list; nothing covered X, TikTok, Threads, Discord, Bluesky, Mastodon, Pinterest, Instagram or Telegram. Enforce the identity match at the single choke point every connect flow goes through. Every call site already maps NetworkAlreadyConnectedException to network_taken, so the refusal surfaces without new plumbing. Also restore the null-platform guard in the observer: occupiesNetwork type-hints a non-nullable Platform, so a row without one died with a TypeError instead of the database's NOT NULL error. * fix: filter connectable identities on every picker step YouTubeController::select re-fetched the channels and matched the posted id straight off the raw list, unlike callback and selectChannel. With a live youtube_oauth session it let a POST name any channel the Google account owns and bind it to the reconnect target. It also read the reconnect from the session while the connect below it read youtube_oauth.reconnect_id, so the two could disagree - pass the resolved account through instead. filterConnectableIdentities also short-circuited in multi-account mode, and the unique index is scoped to platform rather than network. That let one Instagram account connect twice, once directly and once via Facebook, publishing every Instagram post to it twice. The existing except() already spans networkPlatformValues(), so dropping the short-circuit closes it. * refactor: type the connect cards and drop the dead accounts grid The cards computed inferred account as a required ConnectedAccount and then pushed undefined onto it (TS2345). CI only runs eslint so it stayed green, but vue-tsc and editors flag it. SocialAccountsGrid is referenced nowhere; its reconnect button was updated in this branch without passing the card id, which would have been a bug had anything rendered it. * test: keep the suite on the cloud one-account-per-network default CI runs the Cloud build, so the suite baseline should be the Cloud default rather than the self-hosted one. Put phpunit.xml and .env.ci back to false and make the eight tests that merely need two accounts of one network as a fixture opt in for themselves. This also un-deads the config()->set(true) calls the branch had already added to AuthenticationTest, SyncAccountUsageTest, HasUsageTraitTest and SocialAccountObserverTest, which the forced true had turned into no-ops. * fix: connect standalone instagram instead of reopening the picker The picker emits an already-resolved connect method, but this branch rewired @select from openOAuthPopup to startConnect. startConnect sends a bare 'instagram' straight back into its own picker branch, so choosing "Instagram" closed the dialog and immediately reopened it - the OAuth window never opened and the standalone flow was unreachable. Only the via-Facebook button still worked. Split the URL-opening tail out of startConnect and let the dialog call that directly. * fix: reject a telegram reconnect before burning the connect code The nonce was consumed before connectIdentity ran, so posting /connect in the wrong chat spent the one-off code and forced the user to generate a new one. Check the identity first and report wrong_chat instead of network_taken, which told them to disconnect an account when the real fix was posting in the channel they were reconnecting. * fix: leave one target per post when merging duplicate accounts post_platforms has no unique on (post_id, social_account_id), so a post holding a row per duplicate account ended up with two enabled rows aimed at the surviving account and would publish to it twice. Keep one row per post, preferring a published one so history survives. * refactor: collapse the repeated connect-flow boilerplate Four shapes were copy-pasted across the connect controllers: - the session + permission guard opening 16 actions, now connectWorkspace() throwing a ConnectPopupException that renders the popup itself - the reconnected/connected ternary in 13 places, now connectedCallback() - the "nothing left to connect" branch in 4 places, now noConnectableIdentities() - validatedReconnectId() re-querying what reconnectAccount() already does Facebook, Instagram-via-Facebook and YouTube also re-queried the reconnect account three or four times per callback; it is resolved once and passed down. The three GET pickers skipped the manageAccounts check their POST siblings had, and pick it up from the shared guard. Drops the color key from connectableOptions and the matching frontend field - nothing read it. Platform::color() stays; the disconnection emails use it. * fix: keep an expired connect popup out of the error log ConnectPopupException escapes to the framework handler so it can render itself, which also meant report() ran first: every session_expired and workspace_not_found popup filed an ERROR and a Nightwatch issue for what used to be a silent return. A stale popup is a normal outcome, so it now implements ShouldntReport. The Mastodon and Threads guards also cleared their provider session after connectWorkspace(), so a workspace that vanished mid-flow left the client secret and the OAuth state behind. Clear first, then resolve. clearMastodonSession() no longer touches social_connect_workspace - whatever closes the popup already does. * fix: stop telling users to disconnect an account that is not the problem Two flows reused popup_callback.network_taken - "This workspace already has an account for this network. Disconnect it first." - for situations where that is neither true nor actionable: - reconnecting a card while signed into a different account on the provider, now wrong_account - an empty picker in multi-account mode, where every page or channel on that login is simply already connected, now all_connected NetworkAlreadyConnectedException carries the message key so the catch sites stay one line. handleCallback() also drops its $platform argument; it read $this->platform for the reconnect lookup and the identity filter either way, so a caller passing a different platform would have scoped the lookup to the wrong network. * refactor: filter linkedin identities with the shared helper The picker hand-rolled its own reconnect narrowing because the profile and the pages arrive in two different shapes. Flatten them into one pool of LinkedIn identities, run the shared filter, and split them again for the view - the same path Facebook, YouTube and Instagram already take. Side effect worth having: the picker previously only narrowed on a reconnect, so it would offer an identity that is already connected and only fail once the user picked it. It now hides taken identities up front and says so when nothing is left. * fix: keep the linkedin picker's own empty state Routing the picker through the shared filter made every empty pool look like "nothing left to take", including the pool LinkedIn never filled. A self-hoster running pages-only who administers no page was told the network was already connected, or that every account on the login was taken - both false - and the picker's own "you are not an admin of any LinkedIn page" state became unreachable. Only treat it as taken when filtering is what emptied it. Splitting the pool back also compared the person id loosely on one side and strictly on the other; one predicate now drives both. Threads had two forget() calls for a key the top of the action already clears, and YouTube's picker resolved the reconnect account twice on the failure path. * fix: keep the enabled row when collapsing duplicate post targets SyncPostPlatforms seeds a disabled post_platforms row for every account in the workspace, so the usual duplicate is one row the user actually checked next to one they never saw - both pending, both created in the same second. Ordering only by published-then-newest made that a coin flip, and PublishPost iterates enabled() only, so half the time a scheduled post would silently stop reaching that account and take its caption and per-platform meta with it. This runs once against production data and the dropped row is gone, so enabled now beats disabled. Also: the empty-pool exit from the LinkedIn picker was the only one leaving linkedin_pending - and its tokens - in the session. The rationale comments move to the docblocks they belong in, and usePage() comes out of the cards computed. * fix: stop the migration destroying publish history and automations Two ways the one-shot merge lost data that cannot be rebuilt: Surplus published post_platforms rows were deleted. Two duplicate accounts really could each have published, and each row carries the platform_post_id for a live post on the network - dropping one leaves that post unmanageable and invisible to metrics. The docblock claimed published beat everything; now the code does, and only unpublished repeats collapse. Automation nodes persist social_account_id inside a JSON column with no foreign key, so deleting the loser left RunGenerateNode skipping that target, or generating nothing at all when it was the node's only account. The ids are rewritten - current and legacy shapes both - and entries the merge just turned into duplicates are collapsed. Ordering is now total (null created_at sorts oldest on every engine, then id) so a rehearsal on a replica keeps the same rows as the real run. The LinkedIn picker also passes onboardingProgress inline: it clears linkedin_pending on the empty path, and a deferred reload would re-GET the route and swap the empty state for a session-expired popup. * fix: make the identity merge auditable and stop a second delivery Self-hosted installs run this unattended and it cannot be undone, so each collapsed group now logs the workspace, the identity, which row was kept, which were dropped, and how many post_platforms and automations it touched. down() says plainly that it drops the index only. Two narrower fixes: A post holding a published row plus an enabled unpublished row for the same account kept both, and PostPlatform::scopeEnabled() filters on `enabled` alone with no status check - so a republish would deliver the same content to that identity twice. Once a published row exists, every unpublished repeat goes. The automation dedupe ran on every automation in the workspace, not just the ones the merge rewrote. A node legitimately holding two entries for one account under different content types would be collapsed to whichever came first in the array. It now runs only where an id was actually substituted. * test: rehearse the identity merge against a messy database Every test on this migration so far covered a case someone thought to write, which is why three separate review rounds each found a defect the earlier ones missed. This builds a deliberately messy database instead - three workspaces, four networks, one to three copies of each identity, posts mixing published, pending and failed rows across the duplicates with enabled flags varying, and automations referencing them in both the current and legacy JSON shapes - then runs the real migration and asserts what must be true afterwards rather than what happens to a particular fixture. Invariants: no duplicate identity survives, no published row is ever destroyed, no post ends up enabled twice against one account, nothing in post_platforms or automations points at a deleted account, and the newest row of each identity is the one kept. The generator is seeded, so a failure reproduces, and it asserts its own output is adversarial - roughly nine duplicate groups and fourteen published rows - so it cannot quietly degrade into passing on an empty problem. Verified by mutation: dropping the automation repoint, the published guard, or the repeated-target collapse each fails exactly the invariant that covers it. * fix: stop the youtube picker refetching itself into a cleared session HandleInertiaRequests defers onboardingProgress for anyone mid-onboarding - exactly the people connecting their first accounts - so Inertia re-GETs the picker route right after it mounts. For Facebook and Instagram that re-entry is harmless and deliberately left deferred, but YouTube calls the Google API again, and fetchChannels() turns any failure into an empty list that clears the connect session and swaps the mounted picker for an error the user cannot retry from. Same guard the LinkedIn picker already got. LinkedIn also answered a reconnect that authorized a different identity with "Page not found", including in the person branch where no page is involved. Every other platform says wrong_account, which this PR added. * refactor: drop the unreachable youtube channel picker Google's own delegation screen already lists every channel on the account and makes the user pick one before it issues the token, so channels?mine=true always answers with that single channel and count($channels) === 1 always won. The picker behind it was never reached - its Vue page was deleted back in 7c00c338 (January) and nothing broke, which is the clearest evidence it was dead. Removes selectChannel(), select(), both routes, the youtube_oauth session payload and the tests that drove them. If Google ever does return more than one, the callback connects the first and logs a warning rather than routing to a screen that no longer exists. * fix: serialize connects so two popups cannot seat one network twice The observer's occupiesNetwork() is a check-then-insert with nothing holding the gap, and the new unique index covers the identity, not the network. Two tabs finishing OAuth at the same moment for *different* identities on one network both passed the exists() check and both inserted, leaving a Cloud workspace with the two accounts the rule exists to prevent. The same-identity race was already safe - the unique violation is caught and re-queried. A database constraint cannot hold this: allow_multiple_social_accounts is a runtime flag, so the rule is on for Cloud and off for self-hosted, and an index cannot read config. Lock per workspace and network instead, the way markAsDisconnected() and ConnectionVerifier already do. This covers connectIdentity(), which every OAuth flow and the Telegram action go through. A direct create() still answers to the observer alone, and a self-hosted install running file cache across several nodes locks per node. * fix: handle a busy connect lock on the telegram path Every other caller funnels LockTimeoutException into its generic \Exception catch and closes the popup with error_connecting. Telegram has no such catch, so the new lock could 500 the webhook - and because the nonce is spent before connectIdentity runs, Telegram's retry of the same update short-circuits on the consumed code and returns without dispatching anything. The dialog would spin forever on a code that can no longer be used. Also restores coverage the picker removal dropped: the deleted select tests were the only ones driving a multi-channel response, so nothing exercised the reconnect narrowing to its own card, or multi-account mode skipping an already-connected channel. Both are back against the callback, and removing the narrowing in filterConnectableIdentities fails them. * fix: stop the instagram login seating an account already held via facebook filterConnectableIdentities() drops every identity already connected on the network, which is what keeps one Instagram account from being seated twice under its two platforms. Every flow that persists an identity ran it except the direct Instagram Login callback, so the guard only held in one direction: InstagramFacebookController refused an account already connected as `instagram`, but the reverse was allowed through. With multiple accounts per network enabled the observer's network check is bypassed and the unique index does not span platforms, so authorizing the same account through the direct flow created a second row. Both then seed a post_platform row and the post goes out twice to one account. * fix: name the real reason when a linkedin profile reconnect switches member Reconnecting a card narrows the authorized identities to that card's own, so authorizing a different LinkedIn login empties the pool. selectIdentity() reported that as "Page not found." for every card, including personal profiles where no page was ever involved. A profile reconnect has no page to be missing: an empty pool there can only mean this login is a different member. Say so with the wrong_account wording select() already uses for the same condition. Page reconnects keep page_not_found, where the organization really can be absent from the login. * fix: surface the busy telegram connect instead of a generic failure The connect lock timing out dispatches its own 'busy' reason so the dialog can tell the user to retry, but the dialog only mapped network_taken and wrong_chat and fell back to error_generic for everything else. The reason reached the browser and died there, leaving "Could not start the connection" for a case that just needs another moment. * test: cover reconnect on every flow that gained it rememberConnectSession() gave Instagram, TikTok, Threads, Mastodon and Bluesky a reconnect path they did not have before — TikTok had been actively clearing social_reconnect_id on connect — and none of them had a test for it. Facebook, LinkedIn, YouTube, X, Discord, Pinterest and Telegram already did. Each now covers both halves: authorizing the same identity refreshes the existing card and reports it as a reconnect, and authorizing a different one is refused with wrong_account instead of quietly seating a stranger on the card and every post scheduled against it. * fix: repair what a reconnect leaves behind when it cannot proceed cleanly Two things connectIdentity got wrong once the reconnect path existed. A reconnect through the other variant of a network moves the card to the new platform — same identity, different API flavor. Post targets carry their own platform snapshot, and that snapshot picks the publisher, the queue and the scopes checked before publishing. Left behind, it failed every pending post on a permission the account no longer needs: an Instagram card moved to the Facebook variant still demanded instagram_business_content_publish and stopped with "Missing permissions". Pending targets now follow the card and reset a content type the new platform cannot publish; published targets keep theirs, since they record what really went out under a platform_post_id from that API. The network lock timing out also arrived as a raw LockTimeoutException, which every OAuth callback filed through its generic catch: an error log and "Error connecting account" for the exact race the lock exists to absorb. It now carries a busy messageKey through the branch each flow already handles, the same way the Telegram path already reported it. * refactor: resolve the linkedin reconnect card once per select select() already looked the card up before deciding whether the chosen identity matches it, then connectPerson() and connectOrganization() looked it up again on their own — two identical queries per submit, and two places that could disagree about what is being reconnected. The caller passes what it already holds. * test: render the grid's multi-account branch phpunit.xml forces ALLOW_MULTIPLE_SOCIAL_ACCOUNTS false and no browser test overrode it, so the card the flag exists to add never rendered anywhere. The pair pins both sides: a taken network offers no second card when multiples are off, and offers one when they are on. * test: pin why the linkedin select guards exist connectIdentity() already refuses a mismatched reconnect and answers with the same wrong_account message, so every existing test passes with the two guards in select() deleted — which is exactly how they would get deleted. What they actually buy is skipping the avatar download that building the connect payload runs first. Both now assert the fetch never happens, so the guards fail loudly instead of looking redundant. * fix: carry retrying targets through a variant move, atomically Two holes in the move added a commit ago. It only carried pending targets, but a retrying one is not finished either — the publish job reschedules itself and reads the snapshot fresh on the next attempt, so leaving it behind meant it retried against the old variant until it exhausted its budget on a permission the account no longer needs. Failed and published targets stay put; a publishing one has a job mid-flight already working from the snapshot it read. The card and its targets also moved in three separate statements, so a crash between them left exactly the split this was meant to close. They share a transaction now. * chore: drop the dusk selectors nothing reads Laravel Dusk is not installed — no laravel/dusk requirement, no DuskTestCase, no browse(). Browser tests run on pest-plugin-browser driving Playwright, and its @selector resolves to data-testid. The 45 dusk attributes left across 18 components selected nothing. CLAUDE.md was the reason they kept coming back: it told every agent to add them. Its browser-testing section now describes the setup that exists — data-testid targeting, the wait helper these tests need because assertions do not auto-wait on SPA paint, and why BrowserTestCase keeps Vite real. Verified before removing: every @selector used in tests/Browser resolves to a data-testid, seven of them through bound :data-testid, so none depended on a dusk attribute. * chore: drop the last one-account-per-network helper hasConnectedPlatform() has no callers left anywhere — app, tests, views or routes. It sat directly above getSocialAccount(), which this branch already removed, and is the same leftover from when a workspace could hold one account per platform. --------- Co-authored-by: Paulo Castellano <paulo@castellanos.llc> Co-authored-by: Cursor <cursoragent@cursor.com>	2026-08-25 07:28:14 -03:00
Paulo Castellano	de54ea24f9	feat: fire signup/checkout PostHog events from the backend (#277) ... * feat: fire user.signed_up, checkout.started, checkout.completed from the backend These 3 PostHog conversion events only fired client-side (useTracking.ts), so ad blockers and cut-short page unloads could drop them the same way they were dropping the GTM/ad-platform click IDs. Moves the PostHog side to the backend, same reliability rationale, same touchpoints already established for the click-id work: - user.signed_up: App\Actions\User\CreateUser, right after SyncUser is dispatched, gated on !is_invite. auth_provider derived from google_id/github_id presence, same values the frontend session-based flow used. - checkout.started: WelcomeController::storeReferralSource, alongside the existing WelcomeEvent::Referral capture, right before checkout starts. - checkout.completed: new TrackCheckoutCompleted job, dispatched from StripeEventListener::handleSubscriptionCreated (webhook-driven — more reliable than the old frontend flow, which depended on the user staying on billing/Processing.vue). Conversion value/currency/transaction_id read from the subscription webhook payload; transaction_id is the Stripe subscription id rather than the old Checkout Session id. Two new enums (UserEvent, CheckoutEvent) follow the existing per-domain PostHog event enum convention (WelcomeEvent, BillingEvent, PostEvent). useTracking.ts keeps its GTM dataLayer pushes (untouched, separate concern) and drops only the captureEvent(...) calls for these 3 events — PostHog already had CreateUser/WelcomeController/StripeEventListener as established backend touchpoints, so this reuses them instead of adding new infrastructure. * chore: remove now-dead GTM dataLayer pushes from useTracking.ts All 3 conversion events (sign_up, begin_checkout, purchase) now go to PostHog exclusively from the backend, and PostHog is the single source feeding Meta/Google/LinkedIn/etc ad destinations (not GTM). The dataLayer.push(...) calls in useTracking.ts had no consumer left, so the composable is now fully dead — deleted, along with its 3 call sites. Each call site's surrounding scaffolding that existed only to support the tracking call was simplified alongside it: ReferralSource.vue's submit() no longer needs the onStart/onError/onHttpException/onFinish dance (that was only there to gate trackBeginCheckout), and Processing.vue's completePurchase() no longer reads auth.plan just to pass it to trackPurchase(). datalayer.ts is untouched — it only pushes context variables (user name/ email, account/workspace name) that Crisp reads, not events. * feat: split checkout.completed into trial.started / checkout.completed / trial.converted checkout.completed used to fire on every customer.subscription.created regardless of the resulting status, conflating two different business events: a card-required trial starting (status trialing, no charge yet) and an immediate paid subscription starting (status active — first-month coupon or no trial). These are now separate PostHog events: - trial.started: subscription created with status trialing. No conversion_value (nothing has been charged) — carries trial_ends_at instead. - checkout.completed: subscription created with status active (coupon or immediate full-price checkout) — unchanged behavior, still carries conversion_value/currency/transaction_id. - trial.converted (new): the trial's first successful charge, detected on customer.subscription.updated via Stripe's own previous_attributes.status transitioning from trialing to active. This is the Stripe-recommended way to detect what changed in an .updated webhook, and doesn't depend on our own DB write ordering — Cashier's WebhookController dispatches WebhookReceived before it syncs the local subscription row, so trusting our own stripe_status here would be fragile. TrackCheckoutCompleted and the new TrackTrialConverted share their plan/interval/persona/conversion_* property computation via App\Support\StripeSubscriptionConversion (same shape, two different moments in the billing lifecycle) instead of duplicating it. Deliberately out of scope per product decision: trial-expired-without- converting tracking (signups minus conversions already gives that number), and the async-payment-method incomplete status edge case (card/debit only, Stripe Checkout resolves 3DS inline before redirecting back — incomplete essentially can't happen in this flow). * refactor: derive auth_provider from the created User model, not the input array $user already has google_id/github_id populated (they were passed straight into User::create() a few lines above), so re-reading them from $data was redundant — same information, extra indirection. * fix: OAuth signup silently drops pending invites and bypasses the self-hosted registration gate Found while reviewing why CreateUser's `! $isInviteRegistration` PostHog gate never actually excluded anyone via Google/GitHub — because is_invite was always false for OAuth registrations, regardless of whether the person arrived from an invite link. Two real, pre-existing bugs: 1. SocialLogin.vue's Google/GitHub buttons linked to the OAuth redirect routes with no query params at all — invite, redirect and email were silently dropped the moment someone clicked "Sign up with Google" instead of using the email form. The person got a brand-new independent account + workspace instead of joining the inviter's account; the invite itself sat unaccepted with zero feedback. 2. /auth/google/redirect and /auth/github/redirect were never wrapped in the `registration.enabled` middleware that gates /register in self-hosted mode — so self-hosted installs could be signed up into via OAuth with no invite at all, bypassing the intended lock. Fix: - New PreservesInviteRedirect trait carries `invite`/`redirect` across the OAuth round-trip via session (PreservesAttributionParameters' pattern, but kept separate since this isn't marketing data). - SocialLogin.vue now forwards `redirect`/`invite` from its parent page onto the Google/GitHub links; Register.vue and Login.vue pass their props through. - registerNewUser() now passes the same `is_invite` semantics RegisterRequest already uses for the email flow, and both registerNewUser()/loginExistingUser() honor the pending redirect (same target AcceptInvite.vue already sends the email flow to), so accepting via OAuth now lands back on the invite page authenticated, exactly like email/password does — no auto-accept, same explicit-consent UX. - The self-hosted gate can only be enforced in registerNewUser() (after the callback resolves an identity) since /redirect is shared with login and can't tell new vs. returning users apart beforehand. New App\Models\Invite::fromId() (safe UUID-checked lookup) and App\Support\SafeInternalRedirect (same-app-path-only check) replace duplicated inline logic in RegisterRequest, RegisteredUserController and AuthenticatedSessionController, and are now shared with the OAuth path too. * refactor: replace client-supplied redirect param with server-resolved invite redirect Never trust a redirect URL from the client. Login/register/OAuth now only accept an invite id (already validated via Invite::fromId()) and derive the return-to-invite route server-side, eliminating the open-redirect surface instead of validating around it. * refactor: use Request::string() for invite id, trim comments Str::isNotEmpty()/toString() replace manual is_string/empty checks. Also cut oversized inline comments down to one line each. * refactor: tighten Invite::fromId, drop redundant is_string check * test: cover GitHub invite acceptance and self-hosted gate scenarios Mirrors the existing Google coverage — GitHubController has the same invite-completion and self-hosted-gate logic but only Google had tests for it. * refactor: fold null-account check into owner_id guard via nullsafe operator * refactor: dedupe Stripe conversion tracking jobs and properties TrackCheckoutCompleted, TrackTrialStarted, and TrackTrialConverted shared near-identical boilerplate (guard clause, capture call, tries/timeout). Extracted AbstractTrackStripeSubscriptionEvent so each job only declares its event name and properties. StripeSubscriptionConversion now exposes baseProperties() (plan_name/interval/persona) shared by all three, with propertiesFor() adding conversion_* on top for the two charge-backed events. * refactor: extract named status helpers in StripeEventListener currentStatus()/wasTrialing()/isNowActive() replace inline data_get() comparisons in trackSubscriptionStart() and trackTrialConversion(). * refactor: drop redundant persona from Stripe PostHog event properties Persona is already set as a person property via identify() during onboarding, so it is joinable on every event without repeating it — sending it again on every billing capture was dead weight. * refactor: drop redundant plan property in TrackBilling PostHogService::capture() already injects 'plan' from $account when an account is passed — the manual key was silently overwritten by the identical value. * feat: log PostHog payloads to laravel.log in local environment Lets capture()/identify()/groupIdentify() be verified from laravel.log during local testing (e.g. signup, invite flows) without a real PostHog API key configured. Logging is independent of isEnabled() — the actual dispatch to PostHog stays gated on it as before. * fix: cold-review pass — dead code, ordering bug, missing test coverage - Fire checkout.started only after the price-ID guard, not before it, so a misconfigured plan can't record a phantom checkout.started for a checkout that never starts (WelcomeController). - Reorder OAuth registerNewUser() so the destructive session pull of attribution parameters happens after the self-hosted invite gate, not before — a rejected attempt no longer discards UTM/click-id attribution (GoogleController, GitHubController). - Delete the SignupSuccess page/controller/route entirely: it only ever displayed a 5s cosmetic transition before redirecting home, its tracking call was already removed, and app.calendar's own middleware handles onboarding redirects regardless of entry point. The 3 post-registration redirects now go straight to app.welcome (was silently dropped to app.home in an earlier pass of this cleanup — welcome is correct, that was the whole point of the intermediate page). - Remove dead code left behind by the useTracking.ts removal: unused persona/conversion props (and the Stripe API call in BillingController that only existed to populate them), unused auth_provider session flash across 3 controllers, unused captureEvent() export in posthog.ts, and unused RegisterRequest::isInviteRegistration(). - Add missing test coverage: login with a valid/unknown invite param (AuthenticatedSessionController's invite-redirect branch had zero coverage), and a regression test locking in the checkout.started ordering fix. * fix: second cold-review pass — invite email mismatch, stale session leak, null interval bug - Reject OAuth registration (Google/GitHub) when the invite's email doesn't match the authenticated provider account's email, mirroring the check RegisterRequest already enforces for the web form. Previously an invite for one email could be completed by signing in with a different Google/ GitHub account, leaving a permanently workspace-less orphaned account (AcceptInvite's WrongEmail path never runs the shell-account cleanup, since that only fires on Result::Accepted). - Fix PreservesInvite::storeInvite() to always overwrite the session value (matching PreservesAttributionParameters, which it claimed to mirror but didn't). It previously only wrote when the invite param was present, so a stale invite id from an aborted OAuth attempt could leak into a later, unrelated login/registration in the same session. - Fix StripeSubscriptionConversion::baseProperties() mislabeling a conversion as 'yearly' when both the webhook price id and the plan's stripe_yearly_price_id are null (null === null) — now requires the plan price id to be non-null before comparing, matching the equivalent guard in App\Support\BillingCycle::intervalMonths(). - Remove the fully dead fromCheckout/Cache::add mechanism in BillingController::processing() — its only consumer (the frontend trackPurchase call) was already deleted earlier in this PR. - Drop the unused owner eager-load in AbstractTrackStripeSubscriptionEvent and TrackBilling — neither reads $account->owner, only owner_id. * fix: normalize invite email casing at creation; resolve PostHogService via container - CreateInvite::execute() now lowercases the invite email before storing it. Invite acceptance/decline/registration all compare it verbatim against User.email (itself always lowercase), so a mismatched-case invite created before this fix could otherwise never be accepted by its own recipient. - CreateUser::execute() resolves PostHogService from the container instead of `new PostHogService`, matching the DI pattern used by every other PostHog call site added in this PR. * fix: validate self-hosted invites against the DB; enforce OAuth provider toggles server-side; count past_due recovery as a trial conversion - EnsureRegistrationEnabled, GoogleController, and GitHubController now require the invite param to resolve to a real Invite (Invite::fromId()) instead of just checking presence. Previously any random string/UUID satisfied the self-hosted "invite required" gate and produced a fully functional account with its own workspace, defeating the restriction entirely. - google_auth_enabled/github_auth_enabled were only ever read on the frontend to show/hide the login button — the actual OAuth routes (GoogleController/GitHubController::redirect(), and the settings connect-provider endpoint) had no backend check, so a disabled provider could still be used end-to-end by hitting the URL directly. Both are now gated with abort_unless(..., 404). The settings Authentication page also stops rendering a "Connect" button for a disabled, not-yet-connected provider. - StripeEventListener::trackTrialConversion now also fires trial.converted on a past_due -> active recovery (a trial's first charge attempt failing and then succeeding on retry), not just the immediate trialing -> active transition. Guarded by trial_end being set so a long-time paying customer's unrelated payment-method recovery is never miscounted as a trial conversion. * refactor: merge the two connectProvider abort_unless checks into one * refactor: centralize social auth providers in a SocialAuthProvider enum google/github were each hand-checked against config("trypost.{provider}_auth_enabled") independently in GoogleController, GitHubController, AuthenticationController (3 different shapes: hardcoded config key, in_array against a private const array, and a duplicated string list for labels), plus a fourth copy of the enabled flags in HandleInertiaRequests. Adding a provider meant touching all of them by hand. App\Enums\Auth\SocialAuthProvider is now the single source of truth: cases() replaces the PROVIDERS const array everywhere it was iterated, label() replaces the hand-written label map, and isEnabled() replaces every direct config() call. AuthenticationController::connectProvider() collapses its two abort_unless checks into one via tryFrom()?->isEnabled(). * refactor: add User::isConnectedTo() and drop the manual foreach in canDisconnect() The same "{$provider}_id" dynamic-property pattern was hand-written in three places in AuthenticationController (disconnectProvider's column lookup, getConnectedAccounts' connected flag, canDisconnect's loop). User::isConnectedTo() centralizes it, and canDisconnect() now reads as a single collection pipeline ("is there some other connected provider or a password") instead of a counter-then-compare loop. disconnectProvider() also switches to the already-resolved SocialAuthProvider throughout instead of re-deriving from the raw string, and its flash message now uses ->label() instead of ucfirst($provider) (which mis-cased "github" as "Github" instead of "GitHub"). * refactor: remove the fixed 5s post-checkout redirect delay REDIRECT_DELAY_MS existed to give a client-side PostHog/ad-pixel capture call time to flush before navigating away. That call was removed earlier in this PR (checkout.completed now fires from the Stripe webhook, server-side, independent of this page), so the delay had nothing left to wait for — navigate immediately once the poll confirms subscriptionActive. * refactor: extract SocialProvider type instead of repeating the 'google' | 'github' union * fix: Login.vue never displayed session-flashed email errors GoogleController/GitHubController flash OAuth failures (wrong invite email, GitHub email unavailable) via redirect()->route('login')->withErrors([...]). That lands as page.props.errors (Inertia's page-level error bag), not as the <Form> component's own local submission errors — so the InputError bound to errors.email never showed it, silently swallowing the redirect's whole point. Falls back to usePageErrors() (already used elsewhere in the app for this exact scenario) when the form's own errors are empty. * test: add a browser test for the Login.vue flashed-error display fix Pest feature tests can only assert session state, not what actually renders — this drives a real browser through the OAuth invite-email-mismatch redirect and asserts the error text is visible on /login. Confirmed it fails without the Login.vue fix (assertSee fails at the expected point) and passes with it restored. * fix: PostHog debug logging silently skipped by redundant isEnabled() pre-checks signup, trial, and billing events never reached PostHogService::capture() locally because CreateUser and StripeEventListener short-circuited on isEnabled() before the local-logging path in capture() could run. Added shouldTrack() (isEnabled() || local environment) and applied it at every dispatch/handle guard in the chain, while the real API call in SendEvent stays gated on isEnabled() alone so production behavior is unchanged. * fix: correctly guard past_due trial-conversion recovery against a later unrelated payment retry convertedFromTrial() used trial_end being non-null to detect a past_due -> active recovery as a trial conversion, but Stripe never clears trial_end once set, so the guard could never actually exclude a long-time paying customer's unrelated card-decline recovery months later — it would fire trial.converted again, double-counting conversion_value. Now compares the subscription item's current_period_start against trial_end, which only match for the trial's own first billing period. Also reverts the CreateInvite.php Str::lower() normalization added earlier in this branch — invite emails are stored and compared as submitted, with no manual casing normalization anywhere. Adds a diagnostic log in trackTrialConversion() (unconditional, not gated on shouldTrack()) to verify this against a real Stripe webhook payload via a test-clock walkthrough. * fix: don't fire checkout.started before the Stripe checkout session actually exists; drop diagnostic logging WelcomeController::storeReferralSource captured checkout.started before calling StartSubscriptionCheckout::redirect(), so a failure creating the Stripe session (e.g. the coupon/promo-code conflict ConfigureSubscription Checkout throws on, or any Stripe API error) still left a false-positive conversion event in PostHog. redirect() now runs first; the capture only fires once the checkout session was actually created. Also removes the unconditional Log::info() added to trackTrialConversion() for the manual Stripe test-clock verification — the current_period_start fix it was added to confirm has now been validated against a real webhook payload, so it's no longer needed and shouldn't keep logging on every production subscription.updated event. * refactor: centralize OAuth invite-registration validation in PreservesInvite GoogleController and GitHubController each duplicated the same self-hosted registration gate and invite-email-mismatch check verbatim. Moved both into resolveInviteForRegistration() and inviteEmailMismatchRedirect() on the shared PreservesInvite trait so a future OAuth provider (or an edit to one controller) can't silently drift from the other on these security-relevant checks.	2026-08-12 11:47:47 -03:00
Paulo Castellano	ca1e346227	feat: capture ad click IDs for ad-platform conversion attribution (#276) ... * feat: capture ad click IDs for Meta/Google/LinkedIn/TikTok/Reddit/Pinterest attribution Adds gclid, fbclid, li_fat_id, ttclid, rdt_cid, and epik columns to users, captured the same way UTM parameters already are (query string -> session -> persisted on signup, surviving the OAuth redirect round-trip via the new PreservesClickIds trait). Forwards them as first-touch ($set_once) PostHog person properties in SyncUser, so PostHog's native ad-platform destinations (Meta Ads Conversions API, Google Ads Conversions, LinkedIn Ads, TikTok Ads, Reddit Ads, Pinterest) have first-party click IDs to match conversions back to the originating ad click. * refactor: unify PreservesUtmParameters and PreservesClickIds into one trait Both traits captured a set of query-string keys into the session and retrieved them at signup, with identical extract/store/retrieve logic and every call site always using both together — the split added no real separation, just duplicated the same mechanism twice. PreservesAttributionParameters replaces both with a single ATTRIBUTION_KEYS list and one session key. Adding a future ad network's click ID is now one line in that list instead of a second trait. * refactor: split UTM_KEYS and CLICK_ID_KEYS into separate constants Same single trait, single session key, single extract/store/retrieve mechanism — just two named arrays instead of one merged list, so it's clear at a glance which key belongs to which category. * fix: don't truncate ad click IDs to 255 chars, only UTM parameters Ad platforms explicitly warn against assuming a fixed max length for click IDs (Google: gclid has already grown from 26 to 100+ chars, and their docs say never truncate or validate against a fixed length). Truncating would silently corrupt the value into something that no longer matches the real click ID, which is worse than not capturing it at all. Widens the click-id columns from string (VARCHAR 255) to text — safe to edit the migration in place since it hasn't shipped to production yet. UTM parameters still get truncated to 255, since those are ours (our own campaign URLs) and the column stays VARCHAR(255). * refactor: use Laravel collection/Str helpers, forward UTMs to PostHog too - extractAttributionParameters now reads through collect()/Str::limit() instead of raw array_filter/array_map/mb_substr; storeAttributionParameters drops its now-redundant emptiness check since retrieveAttributionParameters already treats "absent" and "present-but-empty" the same via pull()'s default. - SyncUser forwards utm_source/medium/campaign/term/content alongside the click ids as first-touch ($set_once) PostHog person properties. UTMs were never sent to PostHog before this, on any prior code — now that PostHog is the source of truth for ad-platform attribution, it should have the full picture, not just click ids. - Adds the missing GitHub-existing-user click-id session test, mirroring the Google one (parity with the existing UTM coverage). * fix: 3 issues found by review — empty-string leak, duplicated key list, comment style - extractAttributionParameters no longer keeps an empty-string value (e.g. ?utm_source=&gclid=, which some ad/email templates always append even for unfilled slots). The refactor to collect()/Str::limit() a few commits back dropped the outer array_filter() that used to strip these, so they were slipping into User::create() as '' instead of staying null. Restored via a trailing ->filter() on the merged result, and extended the same protection to click ids (which never had it, even before that refactor). - New App\Support\AttributionKeys centralizes the UTM_KEYS/CLICK_ID_KEYS lists that PreservesAttributionParameters and SyncUser each maintained independently. SyncUser previously hand-listed the same 11 field names as a second array with no shared source of truth — a future ad network added to the trait would silently never reach PostHog unless someone remembered to update this second copy too. - Removed the // comment block from the click-id migration explaining the text-column rationale — CLAUDE.md's PHP rules reserve inline comments for exceptionally complex logic; the rationale already lives in the commit message that introduced it.	2026-08-11 15:07:23 -03:00
Paulo Castellano	173a1e4c61	Fix Facebook Page connect pagination (#212) (#253) ... * Fix Facebook and Instagram-via-Facebook Page connect pagination. Follow Graph API paging.next on /me/accounts so authorized non-first Pages are found and multi-Page accounts get the picker instead of silently connecting the first result. Co-authored-by: Cursor <cursoragent@cursor.com> * Paginate Meta accounts until paging.next is exhausted. Drop the artificial 50-page cap and stop only when there is no next URL, or the same request URL repeats (broken pagination loop). Co-authored-by: Cursor <cursoragent@cursor.com> * Redact tokens in Graph pagination logs and harden test coverage. Cover happy-path and failure cases for Meta /me/accounts pagination, including mid-loop failures, invalid paging.next, and Instagram pages without a linked IG account. Co-authored-by: Cursor <cursoragent@cursor.com> * Fail closed on incomplete Meta accounts pagination. If a later /me/accounts page fails after earlier pages succeeded, throw instead of returning a truncated list that could auto-connect the wrong Page. Also revert the IG detail timeout that could wipe the whole connect list. Co-authored-by: Cursor <cursoragent@cursor.com> * Simplify Graph pagination helpers and page fetchers. Bake the first request query into the URL, drop requestKey, and let IncompleteGraphPaginationException bubble from the controllers without catch/rethrow noise. Co-authored-by: Cursor <cursoragent@cursor.com> * Move incomplete pagination exception under Social\Meta. Colocate it with GraphPaginator so the Meta scope is clear from the namespace instead of a generic Social exception name. Co-authored-by: Cursor <cursoragent@cursor.com> * Rename pagination exception to IncompleteMetaGraphPaginationException. Keep it under Exceptions/Social with Meta in the class name instead of moving it into Services. Co-authored-by: Cursor <cursoragent@cursor.com> * Make GraphPaginator results explicit before mapping pages. Assign the paginated accounts to a variable first so the Facebook and Instagram-via-Facebook fetchers read more clearly. Co-authored-by: Cursor <cursoragent@cursor.com> * Build Meta Graph pagination URLs with Laravel Uri. Replace manual http_build_query concatenation with Uri::of()->withQuery(). Co-authored-by: Cursor <cursoragent@cursor.com> * Use Laravel HTTP and Uri helpers in Meta Graph pagination. Prefer response collect/json key access, filled(), and Uri path parsing over manual array and parse_url handling. Co-authored-by: Cursor <cursoragent@cursor.com> * Simplify graphVersion using Uri path and str(). Drop basename and native string casts; Uri::path() already yields the Graph API version segment. Co-authored-by: Cursor <cursoragent@cursor.com> * Drop unnecessary str() around graph API config. Uri: :of() already accepts the string returned by config(). Co-authored-by: Cursor <cursoragent@cursor.com> * Simplify GraphPaginator with Laravel helpers. Consolidate failure handling via abort(), and use collect, when, throw_if, and Uri::value() for a shorter pagination loop. Co-authored-by: Cursor <cursoragent@cursor.com> * Refactor social OAuth page/channel selection handling. Update selectPage and selectChannel methods in Facebook, Instagram, and YouTube controllers to return popup callbacks instead of redirecting on session expiration or workspace not found. Enhance HandleInertiaRequests middleware to prevent deferring onboarding progress on social OAuth popup routes. Add tests to verify behavior for expired sessions and onboarding progress. * Unify Instagram connect behind one card with a method picker. Hide the Instagram-via-Facebook grid card and offer Instagram Login vs Facebook Pages from a single network entry, matching LinkedIn. Co-authored-by: Cursor <cursoragent@cursor.com> * Move social popup onboarding assertions into connection tests. Cover the deferred-prop popup regression on Facebook, Instagram, and YouTube select routes instead of a synthetic onboarding share check. Co-authored-by: Cursor <cursoragent@cursor.com> * Stop suppressing onboarding defer on all social routes. Override onboardingProgress only in popupCallback so picker pages stay deferred and the close page does not re-hit select after session clear. Co-authored-by: Cursor <cursoragent@cursor.com> * Always open the Instagram method dialog on connect. Drop connectMethods and the single-method OAuth shortcut; the picker always offers both Login and Facebook Pages. Co-authored-by: Cursor <cursoragent@cursor.com> * Filter Instagram dialog options by enabled platforms. Keep always opening the method picker, but only list OAuth entry points that are turned on. Co-authored-by: Cursor <cursoragent@cursor.com> * Extract Instagram connect methods into a dedicated helper. Keep connectableOptions focused on shaping grid options while the enabled OAuth list lives in instagramConnectMethods(). Co-authored-by: Cursor <cursoragent@cursor.com> * Harden Meta Graph pagination and localize Instagram connect copy. Fail closed on Graph request errors and pathological paging, keep Instagram connect going when profile detail lookups time out, and translate the Instagram method dialog strings. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Cursor <cursoragent@cursor.com>	2026-08-08 12:01:46 -03:00
Paulo Castellano	a1fa897106	Activation checklist + MCP OAuth authorize UX (#239) (#250) ... * Wire onboarding activation into Account, observers, and shared Inertia data Add onboarding casts/hasFinishedOnboarding, AccessToken ObservedBy, Platform::connectableOptions, Post/SocialAccount onboarding broadcast hooks, and lazy onboardingResidual share + SharedData types. * Register onboarding routes and post-checkout activation redirects. Wire billing processing and the sidebar checklist so owners land on activation after subscribe, with locale sidebar/uk onboarding strings. * Align MCP grant usability with onboarding activation checks Unbound MCP tokens fall back to the user's current workspace and require createPost so viewer/unscoped grants neither unlock the checklist nor broadcast onboarding status. * Require bound MCP workspace for onboarding activation. Drop current-workspace fallback from usable MCP grants so checklist detection and broadcasts match Passport token scoping; viewers still cannot unlock the MCP step. Co-authored-by: Cursor <cursoragent@cursor.com> * Harden onboarding review findings and tighten locale strings. Fix Welcome/Persona/TrackPost suites broken by the activation route reuse and PostObserver analytics side effects, restore Echo poll fallbacks, reject unbound MCP grants in tests, and drop unused onboarding.mcp keys. Co-authored-by: Cursor <cursoragent@cursor.com> * Remove unused sidebar and MCP authorization locale keys. Drop dead sidebar menu/theme strings (including the overwritten workspace label and api_keys nav entry) and unused MCP authorize app_title/approving copy across all locales. Co-authored-by: Cursor <cursoragent@cursor.com> * Fix SetLocale crashing on Passport Symfony OAuth responses. OAuth errors return a raw Symfony Response without withCookie(); attach the default locale cookie via headers so authorize no longer 500s. Co-authored-by: Cursor <cursoragent@cursor.com> * Prompt OAuth guests to log in before rejecting unknown clients. MCP Inspector often reuses a stale client_id; validateAuthorizationRequest was returning invalid_client JSON before the login redirect. Guests now hit /login first, then client validation runs after authentication. Co-authored-by: Cursor <cursoragent@cursor.com> * Render Inertia OAuth authorize errors for browser logins. After login, Inertia follows the intended authorize URL; raw invalid_client JSON broke that visit. HTML/Inertia requests now get mcp/AuthorizeError while API JSON clients still receive the OAuth error payload. Co-authored-by: Cursor <cursoragent@cursor.com> * Detect Inertia OAuth error pages via Request::inertia(). Use the framework helper so post-login authorize failures keep returning an Inertia page instead of raw OAuth JSON. Co-authored-by: Cursor <cursoragent@cursor.com> * Simplify OAuth authorize error page detection to expectsJson. Drop the X-Inertia header sniff; browser and Inertia visits already do not expectsJson, while API clients still receive the OAuth JSON payload. Co-authored-by: Cursor <cursoragent@cursor.com> * Share MCP authorize layout and drop the error close button. Keep authorize and authorize-error on the same centered card shell instead of the auth split layout. Co-authored-by: Cursor <cursoragent@cursor.com> * Simplify onboarding activation for reviewability and safety. Use an exists-based MCP check, keep GETs read-only, move sync into syncAndNotify, clear MCP skips on connect, restrict complete to owners, and share Echo/poll via one composable. Co-authored-by: Cursor <cursoragent@cursor.com> * Move MCP OAuth authorize UX out of the onboarding PR. Keep the activation checklist focused; OAuth guest/error-page work now lives on fix/mcp-oauth-authorize-ux. Co-authored-by: Cursor <cursoragent@cursor.com> * Fix corrupted French MCP locale after OAuth key cleanup. Co-authored-by: Cursor <cursoragent@cursor.com> * Restore MCP OAuth authorize UX onto the onboarding branch. Keep authorize error page, guest login-before-client validation, and SetLocale Symfony cookie fix in #250. Co-authored-by: Cursor <cursoragent@cursor.com> * Fix OAuth prompt=none redirects and harden onboarding tests. Keep login_required/consent_required as redirects instead of Inertia, add regression coverage for owner-only activation, require invite email confirmation, and align MCP connected apps with the sessions list UI. Co-authored-by: Cursor <cursoragent@cursor.com> * Simplify onboarding guards and dedupe viewed analytics. Introduce isOnboardingOpen / belongsToAccount helpers, collapse duplicated sync/dispatch paths, and capture onboarding.viewed once per account. Co-authored-by: Cursor <cursoragent@cursor.com> * Simplify onboarding event, observers, and status helpers. Tighten Account onboarding predicates, drop nullable broadcast/dispatch APIs, and collapse repeated observer/controller guards. Co-authored-by: Cursor <cursoragent@cursor.com> * Treat in-app users as always having an account. Add resolveAccount(), tighten belongsToAccount to string ids, and fold guest residual handling into ResolveOnboardingStatus. Co-authored-by: Cursor <cursoragent@cursor.com> * Rename onboarding residual share test to progress. Co-authored-by: Cursor <cursoragent@cursor.com> * Simplify onboarding status and rename residual to progress. Use accountOrFail, extract MCP onboarding scope, auto-leave the ready screen, and send non-onboarding checkout back to accounts. Co-authored-by: Cursor <cursoragent@cursor.com> * Extract HasAccount and prefer data_get in onboarding flows. Move account helpers off User, drop nullable sidebarProgress, and read OAuth/onboarding payloads with data_get. Co-authored-by: Cursor <cursoragent@cursor.com> * Simplify onboarding checks and extract HasOnboarding. Use Eloquent + policies for MCP/backfill paths, and move account onboarding helpers into a dedicated trait. Co-authored-by: Cursor <cursoragent@cursor.com> * Add trait tests and tidy onboarding imports. Cover HasAccount and HasOnboarding under Models/Traits, prefer filled() for checkout session ids, and import Throwable instead of FQCN. Co-authored-by: Cursor <cursoragent@cursor.com> * Simplify checkout session_id and OAuth error props. Read session_id via request->string(), and take OAuth error details from the League exception instead of decoding the response body. Co-authored-by: Cursor <cursoragent@cursor.com> * Simplify PostObserver onboarding notify path. Share one otherPosts check for first-create and last-delete instead of separate callbacks. Co-authored-by: Cursor <cursoragent@cursor.com> * Use post author as onboarding sync actor. Drop Auth::user() preference in PostObserver; checklist sync attributes to $post->user. Co-authored-by: Cursor <cursoragent@cursor.com> * Simplify SocialAccountObserver and OAuth authorize flow. Share create/delete onboarding notify, drop Auth actor fallback to owner, and inline Passport Inertia error handling. Co-authored-by: Cursor <cursoragent@cursor.com> * Use lazy Inertia props for onboarding partial reloads. Drop partial-header branching; wrap page props in closures and always redirect completed/dismissed accounts to the calendar. Co-authored-by: Cursor <cursoragent@cursor.com> * Defer sidebar onboarding progress and stamp completion as owner-only. Skip the MCP checklist work on full Inertia visits via deferred shared props, early-exit token scans, and keep account completion stamps owner-gated. Co-authored-by: Cursor <cursoragent@cursor.com> * Simplify deferred onboarding progress share via canShowProgress. Co-authored-by: Cursor <cursoragent@cursor.com> * Add User firstName for shared auth and simplify onboarding page. Co-authored-by: Cursor <cursoragent@cursor.com> * Move User firstName coverage into UserTest. Co-authored-by: Cursor <cursoragent@cursor.com> * Use first_name directly without empty-name fallbacks. Co-authored-by: Cursor <cursoragent@cursor.com> * Resolve onboarding sample prompt on the frontend via i18n. Co-authored-by: Cursor <cursoragent@cursor.com> * Stamp onboarding completion via the account owner after teammate unlocks. Co-authored-by: Cursor <cursoragent@cursor.com> * Count only the account owner MCP grant toward onboarding activation. Co-authored-by: Cursor <cursoragent@cursor.com> * Fix OAuth consent auth-token mismatch for mid-activation owners. Skip deferred onboardingProgress on Passport authorize so Inertia does not rotate the session authToken, cover happy and stale-token paths in tests, and polish MCP setup copy plus sidebar/onboarding layout. Co-authored-by: Cursor <cursoragent@cursor.com> * Keep users on onboarding after activation completes. Stamp completion and re-render the finished checklist instead of redirecting to the calendar so owners can review the done state. Co-authored-by: Cursor <cursoragent@cursor.com> * Clarify Passport consent-view opt-out and guard app-route deferral. Rename the authorize-only route check and assert onboardingProgress still defers on calendar, onboarding, and MCP settings. Co-authored-by: Cursor <cursoragent@cursor.com> * Harden onboarding completion and MCP consent workspace binding. Reject OAuth approve without a workspace, retry auto-complete until stamped, send dismissed complete straight to calendar, and cover the device consent defer opt-out. Co-authored-by: Cursor <cursoragent@cursor.com> * Enable activation checklist for self-hosted installs. Remove the self-hosted onboarding redirects, keep the SaaS-only dismiss backfill, and cover subscription-less owners plus skip/complete destinations. Co-authored-by: Cursor <cursoragent@cursor.com> * Add GitHub, Hacker News, and directories referral sources. Expand the welcome referral step with open-source and directory discovery channels. Co-authored-by: Cursor <cursoragent@cursor.com> * Refine welcome referral sources and labels. Split Instagram/Threads, add Founder, and shorten Google, GitHub, AI, and blog option labels. Co-authored-by: Cursor <cursoragent@cursor.com> * Sort accounts platforms alphabetically and drop connect hover plus. Reuse connectableOptions for the accounts index and remove the unused plus badge on disconnected cards. Co-authored-by: Cursor <cursoragent@cursor.com> * Centralize PostHog once-capture so disabled installs don't burn dedupe keys. Move isEnabled + Cache::add into PostHogService::captureOnce and route onboarding viewed/step events through it. Co-authored-by: Cursor <cursoragent@cursor.com> * Simplify onboarding backfill to complete every existing open account. Drop self-hosted and subscription filters; down clears completed_at again. Co-authored-by: Cursor <cursoragent@cursor.com> * Drop PostHog captureOnce and use plain capture for onboarding. Remove cache-based event dedupe; callers rely on PostHogService::capture gating. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Cursor <cursoragent@cursor.com>	2026-08-07 20:34:43 -03:00
Paulo Castellano	53a5a8bf22	Allow account owners to delete workspaces (#208) ... * Allow owners and admins to delete workspaces from settings. Expose a danger zone with name confirmation, sync Stripe quantity on SaaS, and skip billing constraints in self-hosted mode. Co-authored-by: Cursor <cursoragent@cursor.com> * Drop redundant canDelete prop from workspace settings. The settings page is already gated by update (owner/admin), which matches delete. Co-authored-by: Cursor <cursoragent@cursor.com> * Extract workspace delete danger zone into DeleteWorkspace component. Co-authored-by: Cursor <cursoragent@cursor.com> * Clarify workspace delete billing copy across locales. Co-authored-by: Cursor <cursoragent@cursor.com> * Match workspace delete card to the delete-account settings pattern. Co-authored-by: Cursor <cursoragent@cursor.com> * Harden workspace and account deletion around shared members. Enforce owner-only workspace creation, rehome stranded members to a personal account, warn about member access loss, and clarify the only-workspace SaaS exit paths. Co-authored-by: Cursor <cursoragent@cursor.com> * Harden workspace delete: owner-only billing impact and safer member rehome. Restrict delete to account owners, rehome stranded members transactionally with account-scoped fallbacks, and clean up the danger-zone UI/copy. Co-authored-by: Cursor <cursoragent@cursor.com> * Fix workspace delete review findings. Prune pending invites and media on delete, lock the account for the last-workspace guard, fall back to account-owned workspaces for owners, redirect self-hosted last deletes to create, cancel Stripe after local cleanup, align personal-account trials, and gate Index create for owners. Co-authored-by: Paulo Castellano <hello@paulocastellano.com> * Harden invite accept and account delete edge cases. Stop invite accept from demoting existing roles, expire dead invites on show, preserve flash by avoiding calendar bounces, move media file I/O outside locked delete transactions, and finish account deletion even if Stripe cancel fails. Co-authored-by: Paulo Castellano <hello@paulocastellano.com> * Fix remaining invite redirect and media cleanup edge cases. Distinguish already-accepted invites from gone workspaces, rehome members removed from their last shared workspace, capture media paths inside the delete lock, extract orphaned-file cleanup, and use Wayfinder for the expired-invite home link. Co-authored-by: Paulo Castellano <hello@paulocastellano.com> * Fix invite current-workspace and account-delete edge cases. Switch invitees onto an invite-account workspace when accepting, prefer same-account fallbacks when removing members, abort account deletion if Stripe cancel fails, and clear avatar media on profile delete. Co-authored-by: Paulo Castellano <hello@paulocastellano.com> * Fix Stripe-failure media leak and invite cross-account redirect. Flush workspace media files before billing cancel can abort account delete, and rehome stranded non-owners before picking an invite redirect fallback so current workspace never points across accounts. Co-authored-by: Paulo Castellano <hello@paulocastellano.com> * Never set cross-account current workspace on member rehome. Keep RemoveMember and account-delete member fallbacks same-account only, clarify the billing-failure flash that workspaces were already removed, and assert storage deletion in media cleanup tests. Co-authored-by: Paulo Castellano <hello@paulocastellano.com> * Sync Stripe workspace quantity when account delete billing fails. After local workspaces are wiped, a stuck cancelNow must still drop seat quantity so the subscription cannot keep billing the old count. Co-authored-by: Paulo Castellano <hello@paulocastellano.com> * Prune account invites when owner delete wipes workspaces. Pending and accepted invites are removed with the workspaces so a Stripe cancel failure cannot leave unique email/account rows that block re-invites to a gutted account. Co-authored-by: Paulo Castellano <hello@paulocastellano.com> * Extract DeleteWorkspaceMedia to purge workspace media rows. Call sites capture returned paths inside the lock and still flush orphaned storage files after commit via DeleteOrphanedMediaFiles. Co-authored-by: Paulo Castellano <hello@paulocastellano.com> * Redirect to calendar after deleting a workspace with a fallback. When DeleteWorkspace already sets another current workspace, sending the owner to the workspace picker is unnecessary — take them back into the app instead. Co-authored-by: Paulo Castellano <hello@paulocastellano.com> * Use Wayfinder for invite redirect and logo home links. Replace hardcoded /invites/{id} and / hrefs in AcceptInvite with show.url() and home() route helpers. Co-authored-by: Paulo Castellano <hello@paulocastellano.com> * Use Wayfinder home() for AcceptInvite logo link. Co-authored-by: Paulo Castellano <hello@paulocastellano.com> * Extract AcceptInvite title and description into computeds. Keeps the expired/active copy logic out of the template and matches the existing trans() pattern used elsewhere. Co-authored-by: Paulo Castellano <hello@paulocastellano.com> * Fix lazy-loading crash when deleting a workspace. isAccountOwner() no longer touches the account relation unless it is already loaded, and delete/rehome queries eager-load account when they need ownership checks under Model::shouldBeStrict(). Co-authored-by: Paulo Castellano <hello@paulocastellano.com> * Avoid isAccountOwner during workspace delete fallback. Compare against the already-loaded account owner_id so current-workspace reassignment cannot touch the account relation under shouldBeStrict(). Co-authored-by: Paulo Castellano <hello@paulocastellano.com> * Add tests for DeleteWorkspace functionality Introduce comprehensive tests for the DeleteWorkspace action, covering scenarios such as deleting stranded members, handling multiple workspaces, restoring members with personal workspaces, and managing invites. Ensure that workspace media files are deleted and verify behavior when the last workspace is blocked by SaaS settings. This enhances the reliability of workspace deletion processes and ensures proper account management during deletions. * Refactor member removal process to delete or restore stranded members Updated the RemoveMember action to utilize the new DeleteOrRestoreStrandedMember class, which handles the deletion of stranded members or restoration to personal accounts. This change improves the management of user accounts when members are removed from workspaces, ensuring that non-owner members are properly handled based on their account status. Additionally, tests have been updated to reflect these changes, ensuring that the functionality works as intended. * Enhance member removal and media management during account deletion Updated the RemoveMember action to collect media paths for orphaned files when removing members. Integrated the DeleteOrphanedMediaFiles action to ensure that any media associated with deleted users is properly purged. Additionally, refactored the DeleteOrRestoreStrandedMember class to return media paths for cleanup, improving overall resource management during user account deletions. This change ensures that all orphaned media files are handled efficiently, maintaining system integrity. * Enhance user account deletion process with force delete option Updated the DeleteOrRestoreStrandedMember class to include a forceDelete parameter, allowing for immediate deletion of members and their associated personal accounts and workspaces. This change ensures that when an account is forcefully deleted, all remnants of the user's data are purged, improving data integrity and resource management. Additionally, updated related methods and tests to accommodate this new functionality, ensuring comprehensive coverage and correct behavior during account deletions. * Extract shared delete/invite actions out of fat controllers. Centralize workspace/account/user teardown and invite accept/decline so ProfileController and AcceptInviteController stay thin HTTP wrappers. Co-authored-by: Cursor <cursoragent@cursor.com> * Harden delete/invite invariants and replace invite string outcomes. Block cross-account workspace listing/switching, cancel Stripe on owned accounts before purge, lock RemoveMember, fold owner fallback into ReassignCurrentWorkspace, and type invite results with an enum. Co-authored-by: Cursor <cursoragent@cursor.com> * Polish delete/invite teardown APIs and cancel Stripe on empty accounts. Extract DeleteEmptyOwnedAccounts, rename settle-after-invite, and expose clearer stranded-member entry points so cancel never races the invite lock. Co-authored-by: Cursor <cursoragent@cursor.com> * Finish stranded teardown craft: settle outside locks, clearer names. Defer empty-account Stripe cancel until after the account lock, rename stranded handling to SettleStrandedMember, and extract AccountsRequiringCancel. Co-authored-by: Cursor <cursoragent@cursor.com> * Harden multi-account Stripe cancel order and typed stranded settlements. Cancel member personals before the shared account, introduce CancelAccounts and StrandedSettlement::flush so partial Stripe failures leave billing intact. Co-authored-by: Cursor <cursoragent@cursor.com> * Reuse strandedMemberOnSharedAccount across delete/invite feature tests. Expand the Pest helper for shared workspaces and owner injection so stranded-member fixtures stop being hand-rolled in every suite. Co-authored-by: Cursor <cursoragent@cursor.com> * Lock the account row during owner account teardown. Serialize DeleteAccount with DeleteWorkspace/RemoveMember so concurrent stranded restores cannot move members off the account before force-delete. Co-authored-by: Cursor <cursoragent@cursor.com> * Drop personal-account restore when leaving a shared account. Invitees abandon their previous personal account on accept, and stranded members are always deleted — matching the real product flow. Co-authored-by: Cursor <cursoragent@cursor.com> * Close the account model and consolidate teardown actions. Block invites to emails that already belong to a registered user — accounts are closed (one user, one account), so members never own a personal account. This removes the whole leftover/restore surface. Consolidate: fold AccountsRequiringCancel/CancelAccounts into CancelAccountSubscription, drop DeleteEmptyOwnedAccounts/DeleteOwnedAccount/ PurgeOwnedAccounts, and fold DeleteAccount into DeleteUser. 23 -> 15 new action files. Co-authored-by: Cursor <cursoragent@cursor.com> * Remove orphaned members.errors.already_member translation key. Co-authored-by: Cursor <cursoragent@cursor.com> * Block invitees from creating a workspace on the invite shell. A pending invitee could open workspaces/create (outside EnsureHasWorkspace) and add a workspace (then billing) on their empty signup shell before accept. Accept only tears down an empty shell, so this left an abandoned, billable account. Deny create/store while an invite is pending — the invitee joins via the invite instead. Co-authored-by: Cursor <cursoragent@cursor.com> * Tighten stranded-member fixtures to the closed-account model. Drop the member's empty signup shell in strandedMemberOnSharedAccount and the billing-abort profile test so the setup matches what accept actually leaves (member owns nothing). Remove the never-overridden attachOwner param. Co-authored-by: Cursor <cursoragent@cursor.com> * Bind invite registration to the invited email. The register form shows the invited email as read-only when an invite id is present, and store() rejects a different email for a valid invite. Also fixes a latent bug: EnsureRegistrationEnabled only read the invite id from the query string, so the self-hosted invite registration POST always 404'd. Co-authored-by: Cursor <cursoragent@cursor.com> * Move register validation into RegisterRequest. Inline $request->validate() and the invite-email check move into App\Http\Requests\App\Auth\RegisterRequest (withValidator). Invite detection no longer sniffs a /invites/ redirect string — it resolves the invite id directly; the invite registration test now uses a real invite. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Cursor <cursoragent@cursor.com>	2026-08-01 13:00:38 -04:00
Paulo Castellano	c8f875550a	Replace generic token-TTL constant with per-platform Platform::defaultTokenTtlSeconds() ... The single LONG_LIVED_TOKEN_TTL_SECONDS constant (Meta 60-day) plus a loose inline 7200 for X made it unclear which networks each value applied to. Express the fallback TTL as a per-platform match method instead, matching how the enum already exposes every other per-network value, so the network->value mapping is visible in one place: X 2h, Instagram/Threads 60d, everyone else null (they always return expires_in). Behavior is unchanged.	2026-07-03 13:11:36 -03:00
Paulo Castellano	3d3150bd20	Redact the Threads token-exchange failure logs ... The connect flow logged the raw response body of a failed token exchange, unlike the TokenRedactor discipline used everywhere else. A failure body carries no token, but redacting keeps it consistent and defensive.	2026-07-03 11:26:48 -03:00
Paulo Castellano	4d5ca6b274	Centralize the Meta long-lived token TTL and clarify the extension helper ... The 60-day fallback used when Meta omits expires_in was duplicated as a bare 5184000 across the Instagram/Threads connect and refresh code; it now lives in one place, Platform::LONG_LIVED_TOKEN_TTL_SECONDS. Also renames Platform::extensionModelValues() to accessTokenExtendingPlatformValues() so the name states what it returns without needing the extendsAccessTokenOnRefresh docblock.	2026-07-03 11:07:54 -03:00
Paulo Castellano	545a779848	Never leave Instagram/Threads with a null token expiry ... A null token_expires_at drops an account from every refresh path (the cron's whereNotNull filter and the is_token_expired / is_token_expiring_soon checks all treat null as "nothing to do"), so the token silently lapses. Threads could persist null two ways: the long-lived exchange failing at connect (kept the ~1h short-lived token) — now fails the connect instead; and a refresh response omitting expires_in — now defaults to 60 days for both Instagram and Threads, matching the X refresh convention.	2026-07-03 10:33:26 -03:00
Paulo Castellano	12a1baa757	refactor(social): address PR review follow-ups ... - DeleteWorkspace now reassigns affected users to another workspace they belong to (instead of nulling current_workspace_id), so deleting the current workspace while owning others no longer bounces to "create". - Remove the dead LINKEDIN_PAGE_CLIENT_REDIRECT env (the unified flow uses a single callback; config no longer reads a page redirect). - useOAuthPopup uses the Wayfinder connect helpers per platform instead of hardcoding /connect/{platform}. - Unify the Inertia\Response alias in Mastodon/Bluesky controllers to InertiaResponse, matching the other connect controllers. - Add tests: workspace reassignment on delete, and independent refresh of a linkedin row vs its linkedin-page sibling.	2026-06-25 15:01:23 -03:00
Paulo Castellano	dba6346226	refactor(auth): split workspace gate into EnsureHasWorkspace middleware ... EnsureAccountReady bundled a subscription gate (redirects to onboarding, SaaS only) with a workspace gate (redirects to workspace creation). The connect routes can't sit behind it because connecting/disconnecting happens during onboarding, before a subscription exists. Split the workspace gate into a standalone EnsureHasWorkspace middleware: - EnsureAccountReady is now subscription-only. - EnsureHasWorkspace redirects to workspace creation when there is no current workspace, in both SaaS and self-hosted modes. - The social connect group gains EnsureHasWorkspace; the main app group gains it alongside EnsureAccountReady (listed after it, so the subscription gate still runs first — no custom middleware priority). - The repeated `if (! $workspace) redirect()` guard is removed from the connect/store/authorize/disconnect/index/toggle handlers, and their return types are tightened (no more dangling RedirectResponse). LinkedIn connect's no-workspace path changes from a popup callback to the same redirect as the other platforms.	2026-06-25 14:30:15 -03:00
Paulo Castellano	cd2798fd8d	refactor(social): use native Inertia for all connect popup flows ... Replace the per-platform native form POST + manual CSRF + JSON/Blade popup callback with a single Inertia mechanism: - popupCallback() renders the accounts/PopupCallback Inertia page (notifies the opener + closes the popup) for both the GET OAuth callbacks and the selection submits. Drops the auth.social-callback Blade view, the expectsJson JSON branch, and useHttp/useSocialConnect on the frontend. - Selection/credential pages (LinkedIn, Facebook, Instagram, Bluesky, Mastodon) use Inertia useForm: automatic CSRF + native validation errors. - Unify the three selection screens on one row + View/Choose layout; the LinkedIn company tag now uses a building icon. - Bluesky auth failures throw ValidationException (422 for XHR, redirect back with errors otherwise). Controller tests updated from assertViewIs/assertViewHas to assertInertia.	2026-06-25 13:54:16 -03:00
Paulo Castellano	d84666360a	refactor(linkedin): infer post format from media + unify account connection ... Collapse LinkedIn to one content type per account kind (linkedin_post, linkedin_page_post). Publishers infer the publish format from the attached media — text, single image/video, multi-image carousel, or PDF document — matching how facebook_post/x_post already work; PDF is exclusive of any other attachment. Removes the editor variant picker, keeping only the PDF document title field. Includes a data migration collapsing the retired carousel/document content types. Replace the two LinkedIn account cards with a single Connect LinkedIn button: one unified OAuth grant (linkedin-openid driver, union of scopes) then a post-callback identity picker to post as the personal profile (linkedin) or a company page the member administers (linkedin-page). The chosen organization is validated against the admin-verified list from the OAuth grant. Per-capability gating via LINKEDIN_ENABLED / LINKEDIN_PAGE_ENABLED supports profile-only or org-only self-hosting. Removes LinkedInPageController, LinkedInTokenSynchronizer, the standalone linkedin-page connect routes, and the unused redirect_page config.	2026-06-24 21:05:09 -03:00
Paulo Castellano	1c9ab462d0	feat(permissions): viewers review drafts in a read-only editor; lock /accounts to admins ... Viewers are typically the client: they need to open a draft in the editor to use the comments tab, but must not change anything. - post editor (edit) now authorizes view, so viewers can open it; the composer + schedule tab render read-only and the comments tab stays interactive (defaults to the comments tab for viewers) - all mutations stay member+ (update/delete) — the autosave/save/publish/ schedule/delete affordances are hidden and the PUT is still 403 for viewers; SyncPostPlatforms only runs for users who can update - drafts route to the editor for everyone again (reverts the read-only Show detour); Show stays the published-post view - /accounts now authorizes manageAccounts (admin+), so viewers and members get 403; the Connections sidebar item is admin+ only and the connect/ disconnect grid is reverted to main (no per-button gating needed) Tests: draft→editor redirect for every member, viewer can open the editor, viewer cannot save, and only admins+ can open /accounts.	2026-06-22 17:04:09 -03:00
Paulo Castellano	6c47bac1b8	fix(members): preserve invited role on accept and surface viewer in role menu ... AcceptInviteController attached invited users with a hardcoded member role, ignoring the invite's role entirely (a viewer invite joined as member). Use the invite's role on accept, require role on invite creation (no silent default), and drop the role from the request/CreateInvite defaults. Add the Viewer option to the member role dropdown (now iterates all roles), hide the dropdown on the current user's own row, and require the member's email to confirm removal. Covered by tests asserting the accepted role matches the invited role for viewer/admin/member, plus invite role validation.	2026-06-22 14:24:19 -03:00
Paulo Castellano	2d07002325	chore: remove vestigial onboarding OAuth flag and legacy plan env vars ... The onboarding/connect and accounts screens now share the same NetworkConnectGrid with the same popup-close-and-reload flow, so the social_connect_onboarding flag no longer affects anything in the normal path. Remove the frontend plumbing (useOAuthPopup query param, the grid's onboarding prop) and the dormant backend scaffolding (the session flag in 6 OAuth controllers, getRedirectRoute, and the ignored isOnboarding arg); the YouTube no-channels error now redirects to app.accounts directly. Also drop the unused legacy plan price-id env vars from .env.example (only the Workspace plan remains).	2026-06-22 13:54:42 -03:00
Paulo Castellano	3e15144399	chore: remove unused Pennant package and dead user-timezone handling ... Pennant: all feature flags were replaced by BillingCycle, so remove the package (composer), the now-empty app/Features discovery, the pennant-development skill, and replace the create_features_table migration with a drop_features_table. Timezone: the registration flow collected a user timezone (seeder, request validation, hidden field) but no timezone column ever existed and CreateUser discarded it. Remove the dead handling, the orphaned Timezone rule, and the tests that covered the now-removed validation.	2026-06-22 13:37:38 -03:00
Paulo Castellano	7cc88f1036	fix: address PR review findings ... - LinkedInController: catch NetworkAlreadyConnectedException so a profile colliding with a connected Page shows the specific network_taken message instead of the generic error (+ test). - Billing.vue: pass a string to transChoice replacements (vue-tsc TS2322). - NetworkConnectGrid: drop the now-unused 'connect' emit (no listener after AddSocialDialog removal). - Tests: assert the BillingCycle trial window; fix a stale section comment in StripeEventListenerTest.	2026-06-22 12:53:13 -03:00
Paulo Castellano	09d4e9d6b1	feat(onboarding): require connecting a social network before checkout ... Add a connect step between persona selection and Stripe checkout: persona -> connect >=1 network (server-enforced) -> checkout. Extract the network grid into a shared NetworkConnectGrid used by both onboarding and the accounts page, which is redesigned from a table into the same grid (one account per network, with per-card connect / connected+disconnect / reconnect states). Drop the openDialog auto-open flow now that networks are shown inline.	2026-06-22 12:31:44 -03:00
Paulo Castellano	0619f2a0f4	refactor: address code review for per-workspace pricing ... Bug fix - Surface the localized "network already connected" message on the Facebook/Instagram/InstagramFacebook/LinkedInPage/Threads/YouTube OAuth callbacks: catch NetworkAlreadyConnectedException before the generic catch so the conflict no longer falls through to a generic error + Log::error. Scope / dead code - Remove the orphaned BillingController::checkout() + app.billing.checkout route (onboarding starts checkout directly); delete the now-dead DiscordWidget and useFeatureAccess composable; prune orphaned i18n keys left by removing the plan picker / upgrade dialog / count limits (billing.subscribe.*, accounts.limit_reached, workspaces.limit_reached, common.discord.*). - Drop the unused `plan` prop from the usage page and the unused `label` from the onboarding persona payload (labels come from i18n); remove Persona::options()/label(). Conventions - declare(strict_types=1) on the two new migrations. - Extract autofill validation into AutofillBrandRequest (FormRequest). - Drop the unused $plan param from AccountPolicy::swapPlan. - CreateUser: drop the stale config('cashier.trial_days', 7) fallback (now 8). - Rename LimitEnforcementTest to InvitePermissionTest; use Pest mock() helper in WorkspaceQuantitySyncTest; move shared test helpers into Pest.php. - Memoize BillingCycle window() + subscription lookup.	2026-06-21 21:28:47 -03:00
Paulo Castellano	cbf8fb283c	feat: per-workspace pricing, onboarding, and billing overhaul ... Pricing - Bill per workspace ($12/mo or $120/yr each); Stripe quantity tracks the workspace count and syncs on workspace create/delete. - 2,500 AI credits per workspace, pooled at the account level; monthly reset on the billing anniversary, annual granted upfront (no rollover). - One social account per network per workspace; remove all count-based limits (workspace/social/member) and the legacy plan tiers (single Workspace plan). Onboarding (cloud only: SELF_HOSTED=false + PostHog) - Replace the /subscribe plan picker with /onboarding persona selection (Creator/Freelancer/Startup/Agency/Small business/Other), saved on the user (users.persona) and mirrored to PostHog, then Stripe Checkout on the monthly price. 8-day trial so Stripe displays 7. Billing screen - Remove the Change Plan dialog (dead with a single plan); add an annual-upgrade banner for monthly subscribers (swapToYearly). - Current-plan card shows the workspace count instead of the plan name. System AI - Brand analyzer / workspace autofill is always allowed and never debits credits (system feature, not the user's usage). Self-hosted (SELF_HOSTED=true) bypasses all billing, credit, limit, network, and onboarding logic.	2026-06-21 20:40:03 -03:00
Paulo Castellano	c2dd4515b2	feat(channels): add Discord as a social channel ... Connect a Discord server via OAuth (bot authorization) and schedule/publish messages to its channels, with mentions and rich embeds. - Connect: custom Socialite Discord provider (bot scope) maps the authorized guild to a SocialAccount; throws if no server was authorized. - Publish: DiscordPublisher posts via the global bot token, validates the chosen channel belongs to the connected guild (anti cross-guild), optimizes media, builds allowed_mentions only from explicit mention chips (no accidental pings), and renders rich embeds. - Compose: per-post channel picker (live lookup), mention autocomplete and an embed editor, gated by a required-channel compliance rule; Discord post preview. - Enum/config/content-type wiring, ConnectionVerifier health check, throttled lookup endpoints, i18n (en/es/pt-BR), and tests. Operators must create a Discord application and set DISCORD_CLIENT_ID, DISCORD_CLIENT_SECRET, DISCORD_BOT_TOKEN and DISCORD_CLIENT_REDIRECT.	2026-06-16 14:44:00 -03:00
Paulo Castellano	b9fa8be513	Group Telegram service classes under Services/Social/Telegram	2026-06-14 13:32:03 -03:00
Paulo Castellano	ce5d59a149	Detect Telegram connection via broadcast instead of polling	2026-06-14 10:58:13 -03:00
Paulo Castellano	d729c34c0e	Harden Telegram connect: one-time code, drop session, decode validation; switch icon to png; widen add-social dialog	2026-06-14 09:18:24 -03:00
Paulo Castellano	2284596f9d	Make Telegram connect codes stateless: drop the model/table, use a signed code + session	2026-06-14 08:57:38 -03:00
Paulo Castellano	c096092c7b	Polish PR: status FormRequest, sanitizer anchor guard, webhook limit, dedupe OAuth popup	2026-06-13 22:48:21 -03:00
Paulo Castellano	2585d89cb4	Address PR review: connect-status enum, publisher cleanup, fill test gaps	2026-06-13 22:38:23 -03:00
Paulo Castellano	a4cf8aa4ce	Add Telegram connection flow (controller + webhook) ... Connect a channel by issuing a one-time code the user posts as /connect <code> in their channel. A secret-token-guarded webhook matches the code, links the channel as a SocialAccount (chat_id in meta), and records it on the request so the connect endpoint can poll for completion. Adds the TelegramConnectRequest model + migration, the connect/status endpoints, the public webhook route (CSRF exempt), a ConnectionVerifier branch (getChat liveness), and a telegram:set-webhook command. Tests cover the code issue, webhook link, secret rejection, expired/ unknown codes, status polling, and the command.	2026-06-13 21:39:03 -03:00
Paulo Castellano	8cfdd4c128	Centralize AT Protocol NSIDs in BlueskyLexicon ... The Bluesky lexicon identifiers (createRecord, createSession, feed.post, facet types, etc.) were repeated as magic strings across BlueskyPublisher, BlueskyAnalytics, ConnectionVerifier and BlueskyController, where a typo fails silently at runtime as "Invalid request". Define them once as named constants so a typo is an undefined-constant error instead. Tests keep the literal NSIDs as the independent contract.	2026-06-13 20:18:39 -03:00
Falconiere Barbosa	a2a7f44c9a	refactor(linkedin): drive OAuth scopes from LINKEDIN_SCOPES env via config ... Replace the additive LINKEDIN_EXTRA_SCOPES approach with a single full-override env var per flow, exploded into an array at the config layer (config/trypost.php -> platforms.linkedin{,-page}.scopes). This keeps env values as plain comma-separated strings, lets self-hosters override the entire set in one place, and removes the controller-side scope-merge logic. - config/trypost.php: explode LINKEDIN_SCOPES / LINKEDIN_PAGE_SCOPES into the scopes arrays (deprecated r_basicprofile stays out of the personal default) - LinkedInController: drop resolveScopes(), read config scopes directly - LinkedInPageController: drop the hardcoded $scopes property, read config scopes at both call sites - tests: drive the connect scope assertions from config overrides - .env.example, docker/.env.docker.example: document LINKEDIN_SCOPES and LINKEDIN_PAGE_SCOPES	2026-06-10 15:04:57 -03:00
Falconiere Barbosa	21bbe96d6b	refactor(linkedin): move OAuth scopes into config/trypost.php platforms ... Consolidate the default scope set alongside the existing LinkedIn host config under config/trypost.php -> platforms.linkedin, matching the project convention that per-platform service config lives there. The default still drops the deprecated r_basicprofile scope, and LINKEDIN_EXTRA_SCOPES stays additive (merged onto the defaults rather than replacing them) so operators can opt back into legacy scopes without risking a misconfigured full-replacement. - config/trypost.php: add scopes + extra_scopes to platforms.linkedin - config/services.php: drop the moved extra_scopes key - LinkedInController::resolveScopes(): read both from trypost config - tests: repoint config() overrides to the new key	2026-06-10 15:04:57 -03:00
Falconiere Barbosa	410eb9612e	fix(linkedin): drop deprecated r_basicprofile from default scopes ... Make r_basicprofile opt-in via LINKEDIN_EXTRA_SCOPES so self-hosted users unblock by default and ops with legacy/enterprise products keep working. Why --- LinkedIn rejects OAuth authorize requests with a generic "Bummer, something went wrong" page when an app asks for a scope it can't grant. `r_basicprofile` is a legacy scope deprecated in 2018; new LinkedIn dev apps don't have it, so every self-hosted user hits the rejection immediately on `/connect/linkedin`. The two products LinkedIn actually grants to standard apps today are: - Sign In with LinkedIn using OpenID Connect → `openid profile email` - Share on LinkedIn → `w_member_social` That set is enough for the connect flow. The only piece of data `r_basicprofile` was buying us is `/v2/me`'s `vanityName` (pretty `linkedin.com/in/<slug>`). `fetchVanityName()` already handles HTTP failure gracefully (returns null), and the only downstream consumer — `LinkedInPagePublisher`'s post-URL builder — already falls back to a numeric `linkedin.com/feed/update/<id>` URL when `$account->username` is null. Backward compatibility ---------------------- Ops with legacy or enterprise LinkedIn products approved on their dev app (so they DO have `r_basicprofile`) can opt back in via env: LINKEDIN_EXTRA_SCOPES=r_basicprofile `LinkedInController::resolveScopes()` merges this comma-separated list into the default scope array. The connect flow's `Socialite::scopes()` call then includes the legacy scope, preserving the pre-PR behaviour end-to-end (including `vanityName` lookup). Net effect for users without `r_basicprofile`: - Connect flow works (was previously rejected by LinkedIn). - Posts publish exactly the same way. - Generated post URLs use the numeric form instead of the vanity slug. Tests ----- - `linkedin connect requests the default scope set when LINKEDIN_EXTRA_SCOPES is unset` - `linkedin connect appends LINKEDIN_EXTRA_SCOPES to the default scope set` - Existing `splits comma-separated approvedScopes` fixture updated to match the new default set.	2026-06-10 13:51:07 -03:00
Paulo Castellano	74bd88d3d6	feat(auth): self-hosted registration gate + admin seeder (closes #46) ... Self-hosted installs (SELF_HOSTED=true, the default) now close /register to the public. Workspace invites still work — the AcceptInvite page links into /register with ?invite={id}, the middleware persists that into the session, and POST /register passes through. - EnsureRegistrationEnabled middleware gates GET/POST /register. Accepts ?invite=… (URL) or pending_invite_id (session) as the pass. - RegisteredUserController::store clears the marker after signup. - AcceptInvite.vue passes invite.id in the register link's query string. - Login.vue hides the "Sign up" link when self_hosted. - UserSeeder bootstraps a single admin (admin@trypost.it / password). Idempotent; not wired into DatabaseSeeder — operator runs `php artisan db:seed --class=UserSeeder` per the install docs. - Tests cover both flag values for every changed surface. Docs PR: see trypost-docs self-hosting/installation.mdx step 3.	2026-05-19 11:45:16 -03:00
Paulo Castellano	1660084227	refactor(social): use config for OAuth hosts everywhere ... Earlier in the PR the new configs (linkedin.oauth_api, youtube.oauth_api, bluesky.default_service, mastodon.default_instance) were only read by ConnectionVerifier. The same URLs were still hardcoded in the publishers, analytics and the Bluesky auth controller — meaning a self-hosted user setting BLUESKY_DEFAULT_SERVICE or MASTODON_DEFAULT_INSTANCE in env would get split behavior: refresh/verify honor the override, publish/analytics don't. Routes all 10 remaining call sites through the same config values so the overrides actually work end-to-end.	2026-05-19 08:34:35 -03:00
Paulo Castellano	074a66f1e2	fix(linkedin-page): persist OAuth scopes through the page-picker flow ... The LinkedIn Page connection has a two-step OAuth: first the `callback` stashes the Socialite user in `linkedin_page_pending` and redirects to the page picker, then `select` finalizes by writing the chosen organization to social_accounts. The pending payload was missing `approved_scopes`, and both finalize paths (`update` for reconnect, `updateOrCreate` for first connect) never wrote the `scopes` column. Result: every LinkedIn Page account had `scopes = NULL` in the DB, the publish-time scope check saw `w_organization_social` as missing and blocked every post with 'Missing permissions. Please reconnect your account.' Fix: stash `approved_scopes` in the session payload, then in both finalize paths persist it with the same comma-split treatment used by the LinkedIn personal controller (the LinkedIn-OpenID provider has the same separator quirk — granted scopes come CSV-joined inside a single Socialite array element). Test: `linkedin page select splits comma-separated approvedScopes before saving` covers the persist + split path.	2026-05-14 11:48:30 -03:00
Paulo Castellano	7d9302b064	refactor: remove debug logging from social OAuth controllers	2026-05-14 11:23:40 -03:00
Paulo Castellano	49ccfe851e	fix(linkedin,pinterest): split CSV/space-joined OAuth scopes before saving ... LinkedIn and Pinterest's OAuth providers return the granted scope list joined by comma (LinkedIn) or space-in-one-element (Pinterest), but Socialite's scope splitter doesn't match either, so 'approvedScopes' lands as a single-element array containing the whole list: LinkedIn: ['email,openid,profile,r_basicprofile,w_member_social'] Pinterest: ['boards:read boards:write pins:read pins:write user_accounts:read'] That breaks the publish-time scope check in PublishToSocialPlatform (array_diff does exact string compare), surfacing as 'Missing permissions: w_member_social. Please reconnect your account' even though the scopes were actually granted at the provider. Fix is inline at each callback — re-split before saving. Each provider has its own quirk (LinkedIn = comma, Pinterest = space), so each controller handles its own separator. Tests added: callback splits the joined approvedScopes into individual tokens for both providers.	2026-05-14 10:55:53 -03:00
Paulo Castellano	cbea8394fc	feat: localize OAuth popup callback messages across 12 controllers ... User reported the social-account OAuth callback popup ('Threads account connected!') stayed in English regardless of the active locale. The hardcoded message was wired through SocialController and 11 platform controllers (Bluesky, Facebook, Instagram, InstagramFacebook, LinkedIn, LinkedInPage, Mastodon, Pinterest, Threads, TikTok, YouTube), plus the Blade view that the popup renders. Adds an accounts.popup_callback i18n block (en/pt-BR/es) covering: - The popup chrome (title, closing/close-now status text). - Generic success/reconnect messages (one shared 'Account connected!' / 'Account reconnected!' line — the popup already shows a checkmark and lives for ~2s so platform-specific wording wasn't pulling weight). - Error variants (account/page/channel) and contextual edge cases (page not found, no Facebook pages, no YouTube channels, etc.). Updates every popupCallback() callsite to read from these keys, plus the Blade view's title and submessage. Regenerates the JSON locale bundle so laravel-vue-i18n stays in sync.	2026-05-07 14:03:52 -03:00
Paulo Castellano	d83ac0612f	feat: implement workspace management and update localization strings across multiple languages	2026-05-06 16:41:27 -03:00
Paulo Castellano	e3acd1bb4b	revert: keep one OAuth callback URL per provider ... Drops the dedicated /settings/authentication/providers/{provider}/callback route added in the previous refactor — registering a second callback URL in each OAuth app is more ops cost than the trade is worth. Back to one callback URL per provider, with a small `Auth::check()` branch in the auth controllers' callbacks. The check is safe because the redirects that initiate the round-trip enforce the right middleware (signup/login is `guest`-only, connect is `auth`-only), so the auth state at callback time matches the flow's intent.	2026-05-04 19:42:13 -03:00
Paulo Castellano	79f800f858	refactor: dedicated callback URL for connect-from-settings flow ... Splits the OAuth connect flow off entirely from signup/login so each route has a single responsibility. - routes/auth.php returns to its original state — redirect + callback both back inside the `guest` group. - routes/app.php gains a paired callback route at /settings/authentication/providers/{provider}/callback. - AuthenticationController::connectProvider / connectProviderCallback override Socialite's redirectUrl so the round-trip stays on the connect-flow URL. The Auth::check() branch in the auth controllers is gone. The OAuth apps in Google Cloud and GitHub Developer Settings need the new callback URL registered alongside the existing one — documented in .env.example.	2026-05-04 19:30:16 -03:00
Paulo Castellano	d89f6ceede	fix: let authenticated users connect Google/GitHub from Settings ... The Connect button on /settings/authentication pointed at the auth.{provider}.redirect routes that live behind `guest` middleware, so authenticated users were bounced to /app/home before reaching Socialite. The OAuth callback also needed to handle two flows (signup/login vs link to current user) but had no branch for the second case — meaning a different-email GitHub account would have been registered as a new user, logging the original session out. Splits the flows by intent: - New `app.authentication.connect-provider` route in the auth group, handled by the settings controller (where it sits next to disconnect-provider). Replaces the OAuth signup link as the Connect button's target. - Auth callbacks moved out of the guest group (still one URL per provider, since OAuth apps only register one) and gain a single Auth::check() branch that calls connectToCurrentUser(). - connectToCurrentUser() rejects if the provider id already belongs to a different user; otherwise sets it on the current user and redirects back to settings with a flash message.	2026-05-04 19:22:09 -03:00
Paulo Castellano	2e9e0f716b	feat: capture signup UTMs/IP and add GitHub OAuth login ... Persists marketing attribution and registration metadata for new users across the three signup paths (email, Google, GitHub): - 5 utm_* columns + registration_ip on the users table - PreservesUtmParameters trait stores incoming utm_* query params on the register/redirect GET, retrieves them on the POST/callback — surviving the OAuth round-trip via session - request()->ip() captured at the controller layer Adds GitHub as a second OAuth provider: - GitHubController mirroring the Google one (now renamed from SocialLoginController for symmetry) - Settings → Authentication can connect/disconnect GitHub like Google - Single SocialLogin.vue component replaces the per-provider buttons on Login/Register, rendering each enabled provider plus a single "or continue with" divider UserFactory gains defaults for the new nullable columns so model strict-mode access in tests doesn't trip.	2026-05-04 18:42:25 -03:00
Paulo Castellano	595510812c	refactor: implement lazy token refreshing and persist Mastodon scopes	2026-05-03 21:58:25 -03:00
Paulo Castellano	34272a573f	feat: implement consolidated authentication settings including session management and social provider integration	2026-05-03 17:42:44 -03:00
Paulo Castellano	17ca1f7b0e	feat: implement paginated social accounts table with search functionality and updated UI components	2026-05-02 14:15:41 -03:00