trypost/app/Enums/Post/Status.php
Paulo Castellano 06e01797d1 fix: security audit - IDOR, open redirect, authorization, session fixes
Critical:
- Fix EnsureUserSetupIsComplete middleware route name prefixes and
  redirect Subscription step to subscribe page (not onboarding)
- Fix MCP session pollution: Auth::setUser() instead of Auth::login()
- Remove dead BillingController::addWorkspace/removeWorkspace methods
- Remove broken Workspace::pendingInvites() method

Security (IDOR):
- MediaController: add workspace ownership verification on all endpoints
- UpdatePostRequest: scope label_ids validation to current workspace
- UpdatePostRequest: scope platform IDs validation to current post

Security (other):
- Fix open redirect in login and registration (validate internal URLs)
- Add validation to API PostController store/update (was $request->all())
- Prevent Owner role assignment via updateRole endpoint
- Fix API post author attribution to use workspace owner

Authorization:
- PostController: use createPost policy instead of view for store/update/destroy

Logic:
- Post Status enum labels now use translation system instead of hardcoded Portuguese
- Workspace deletion cleans up current_workspace_id for all affected members
- StoreWorkspaceInviteRequest: replace Portuguese validation messages with __()

Rename onboarding:
- Step1.vue -> Role.vue, Step2.vue -> Connect.vue
- Controller methods: step1->role, storeStep1->storeRole, step2->connect, storeStep2->storeConnect

All 728 tests passing.
2026-03-30 14:58:25 -03:00

39 lines
1.1 KiB
PHP

<?php
declare(strict_types=1);
namespace App\Enums\Post;
enum Status: string
{
case Draft = 'draft';
case Scheduled = 'scheduled';
case Publishing = 'publishing';
case Published = 'published';
case PartiallyPublished = 'partially_published';
case Failed = 'failed';
public function label(): string
{
return match ($this) {
self::Draft => __('posts.status.draft'),
self::Scheduled => __('posts.status.scheduled'),
self::Publishing => __('posts.status.publishing'),
self::Published => __('posts.status.published'),
self::PartiallyPublished => __('posts.status.partially_published'),
self::Failed => __('posts.status.failed'),
};
}
public function color(): string
{
return match ($this) {
self::Draft => 'gray',
self::Scheduled => 'blue',
self::Publishing => 'yellow',
self::Published => 'green',
self::PartiallyPublished => 'orange',
self::Failed => 'red',
};
}
}