No description
676afb15ba
* fix: give each chunked upload attempt a unique server-side identifier
The upload session identifier was derived only from user+filename+size
(ChunkedAssetReceiver::receive), with no per-attempt nonce. Two genuinely
concurrent attempts of the same file (e.g. closing and reopening the media
picker mid-upload, then re-uploading the same file) collided on the same
Redis cache key / temp file, producing RuntimeException("Chunked cloud
upload session expired or missing.") on the multipart/cloud path and
silent byte corruption on the local-assemble path.
The frontend now mints a UUID per upload attempt (X-Upload-Id header) that
gets folded into the identifier. Falls back to the old formula when the
header is absent, so any already-loaded frontend bundle keeps working.
Also guards the media picker's dropzone against re-triggering an upload
while one is in flight, and aborts the in-flight fetch when the dialog
unmounts mid-upload.
Fixes Nightwatch issue #23.
* fix: explicitly type upload_id when passing to receive()
Matches the existing explicit (int) casts on the sibling validated()
calls in the same method — validated() returns mixed, so this keeps
the nullable-string contract explicit instead of relying on an
implicit runtime type.
* style: inline the upload_id null-safe cast
Drop the intermediate variable so all receive() arguments read as a
single expression each, matching the sibling validated() casts.
* fix: require X-Upload-Id instead of falling back to the legacy identifier
Nullable upload_id only preserved the old (collision-prone) formula for
clients that omit the header — it didn't actually protect them. Making it
required closes that gap outright: a request without the header now fails
loud (422) instead of silently falling back to the vulnerable identifier.
ChunkedAssetReceiver::receive() now takes a required $attemptId. Updated
every existing test hitting app.assets.store-chunked (ChunkedCloudUploadTest,
ChunkedAssetReceiverTest, ChunkedUploadFilenameEncodingTest, AssetControllerTest)
to send a real upload id, and added a regression test asserting the endpoint
rejects a request with no X-Upload-Id header.
* fix: localize hardcoded workspace name validation messages
StoreWorkspaceRequest had its custom messages() hardcoded in pt-BR
regardless of the user's locale; UpdateWorkspaceRequest had the same
bug hardcoded in English. Both now go through __('validation.required'
/ 'validation.max.string') with the already-localized
workspaces.create.name attribute label (present in all 16 lang/
directories), matching the pattern already used by
StoreWorkspaceInviteRequest.
Unrelated to the chunked upload fix, but caught while reviewing this
file's messages() convention.
* simplify: drop messages() override on workspace name validation
Laravel already localizes the generic required/max messages from
lang/{locale}/validation.php automatically — no need to hand-roll
messages() for standard rules with no custom copy.
* fix: localize StoreChunkedAssetRequest validation messages
Drop the hardcoded English messages for required/ends_with rules —
Laravel's own localized validation.php messages already cover them
adequately (ends_with's generic message is actually more useful, since
it lists the accepted extensions). total_size.max still needs a custom
message (the rule is in raw bytes, unreadable without MB conversion),
so it now goes through __('assets.upload.file_too_large') with the key
added to all 16 lang/ locales.
Also fixed test flakiness discovered while touching this file:
ChunkedCloudUploadTest used random_bytes() for the first mp4 chunk,
which occasionally collides with an unrelated magic number (MZ/PE,
SIMH tape, ...) and makes finfo misdetect the mime type. Replaced with
real mp4 header bytes padded with nulls, so detection is deterministic.
* fix: address final code review findings
- ChunkedAssetReceiver: use double-quoted interpolation instead of
concatenation for the identifier hash, per project convention.
- AssetControllerTest: two chunked-upload rejection tests didn't send
X-Upload-Id, so their 422 assertions could pass for the wrong reason
(upload_id.required) instead of the field they claim to cover. Added
the header and asserted the specific validation error field.
- GalleryBrowser: centralize the upload-in-progress guard as a single
check at the top of uploadFiles() instead of three separate checks
at each entry point (click/select/drop) — matches the single-source-
of-truth pattern already used in PhotoUpload.vue.
- GalleryBrowser: show a toast when an in-flight upload is aborted
(dialog closed mid-upload) instead of silently discarding it with no
feedback. New assets.upload.cancelled key added to all 16 lang/
locales.
|
||
|---|---|---|
| .agents/skills | ||
| .claude | ||
| .codex | ||
| .cursor | ||
| .github | ||
| app | ||
| bootstrap | ||
| config | ||
| database | ||
| docker | ||
| lang | ||
| maizzle | ||
| public | ||
| releases | ||
| resources | ||
| routes | ||
| storage | ||
| stubs | ||
| templates | ||
| tests | ||
| .dockerignore | ||
| .editorconfig | ||
| .env.ci | ||
| .env.example | ||
| .env.testing | ||
| .gitattributes | ||
| .gitignore | ||
| .mcp.json | ||
| .prettierignore | ||
| .prettierrc | ||
| AGENTS.md | ||
| artisan | ||
| boost.json | ||
| Caddyfile | ||
| CLAUDE.md | ||
| components.json | ||
| compose.override.yaml.example | ||
| compose.prod.yaml | ||
| compose.yaml | ||
| composer.json | ||
| composer.lock | ||
| eslint.config.js | ||
| GEMINI.md | ||
| LICENSE.md | ||
| package-lock.json | ||
| package.json | ||
| phpunit.xml | ||
| pint.json | ||
| README.md | ||
| tsconfig.json | ||
| vite.config.ts | ||
Run your whole social presence from one calendar
An open-source social media scheduler with an AI copilot, native publishing to 12 networks,
and an MCP server so your AI assistant can post for you. Self-host it, or skip the setup on cloud.
Try on Cloud • Documentation • Community
What you get
| 📅 One calendar, every network | Plan a month at a glance, drag any post to a new slot, and publish natively to 12 platforms. No redirects, no "finish in the mobile app." |
| ✨ An AI copilot that knows your brand | Captions, hooks, full drafts, and multi-slide carousels in your tone, voice, and colors. It reads your brand profile on every generation. |
| 🤖 Built for AI agents | A first-class MCP server and REST API. Claude, Cursor, ChatGPT, or your own scripts can draft, schedule, and publish for you. |
| ⚙️ Automations that run themselves | A visual workflow builder: triggers, conditions, RSS, webhooks, and AI generation, all server-side. Set it once, let it post. |
| 🗂️ Made for many clients | Workspaces, roles, and approval flows so an agency or freelancer can run a roster of brands without the spreadsheets. |
Features
| Visual calendar | Month, week, and day views. Drag and drop to reschedule across networks. |
| Multi-platform composer | Write once, then tailor the preview per network in parallel. |
| AI generate & review | Draft from a prompt, get inline feedback before you publish. |
| AI carousel builder | Prompt to a multi-slide carousel with images, on-brand. |
| Brand profile | Tone, voice, language, and colors applied to every AI call. |
| Automations | Schedule / RSS triggers, conditions, publish steps, and webhooks. |
| Asset library | Reusable workspace media, plus Unsplash and Giphy search built in. |
| Signatures & labels | Reusable hashtag and CTA blocks, color-coded post tags. |
| Team collaboration | Owner / Admin / Member roles, comments with @mentions on drafts. |
| Workspaces | Isolate each brand, client, or project in its own space. |
| REST API + MCP | Full programmatic control; AI assistants integrate natively. |
| Native analytics | Per-account reach and engagement across every connected platform. |
| Multi-language | English, Ukrainian, Spanish, Portuguese, French, German, Italian, Dutch, Polish, Greek, Japanese, Korean, Chinese, Russian, Turkish, and Arabic. |
Supported platforms
Posts publish natively through each platform's official API.
 |
 |
 |
 X (Twitter) |
 TikTok |
 YouTube |
 |
 Threads |
 Bluesky |
 Mastodon |
 Telegram |
 Discord |
Get started
| ☁️ Cloud | The fastest way in. We host, update, and scale it for you. Start at trypost.it → |
| 🛠️ Self-host | Free forever, your servers, your data. Installation guide → |
| 🤖 Drive it with AI | Connect Claude, Cursor, or ChatGPT over MCP. MCP setup → |
Own your stack
TryPost is open source on purpose. Self-host it and your posts, drafts, and metrics stay on your infrastructure, under a license that is yours to keep. No seat tax, no feature gates, no vendor deciding when to lock you out. Read every line, fork it, and ship it. When you would rather not run servers, the same product is one click away on cloud.
Contributing
Contributions of any size are welcome. Pick an issue, say hi in Discussions, or open a PR with what you would like to see.
Short on time? A star is the most valuable thing you can give. It helps more people find the project.
License
GNU Affero General Public License v3.0. Use, modify, fork, self-host, and redistribute, including commercially. If you run a modified version as a network service, make your changes available to its users (AGPL §13).
Built in the open. Star TryPost on GitHub and tell a friend.