Code-review surfaced two correctness bugs and a security gap that
needed to land before merging.
- UpdatePost::execute disabled every platform when called without
a `platforms` key. PublishPostTool relied on that path, so every
publish-via-MCP queued a job whose handler then found nothing
enabled to publish to. Wrap the platform toggle in
`Arr::has($data, 'platforms')` (matches the existing label_ids
guard a few lines up). Add a regression assertion to
`PostPublishToolTest::publish post immediate dispatches PublishPost
job` that the previously-enabled platform stays enabled.
- StorePostRequest declared rules for only `platforms`,
`scheduled_at`, and `status`. `validated()` then stripped
`content`, `media`, and `label_ids`, so REST `POST /api/posts`
silently created empty drafts. Added rules for content / media /
label_ids (with workspace-scoped `Rule::exists` for labels) and
dropped the unused `status` field — REST callers transition state
via `PUT /posts/{id}`. Removed the dead `platforms.*.content`
rule. Added a feature test that asserts content + media + labels
roundtrip on create, plus a regression that an `is_active=false`
social_account is rejected at validation.
- CreatePost::execute now syncs label_ids itself so REST and MCP
share the behavior. Removed the duplicate sync from CreatePostTool.
- MCP UpdatePostTool didn't scope `platforms.*.id` to the post being
updated, drifting from the REST UpdatePostRequest which adds
`Rule::exists('post_platforms','id')->where('post_id', ...)`. Now
it loads the post first (failing fast with `Post not found.` if
the workspace check rejects), then uses the same Rule::exists.
- MediaAttacher fetched any URL the caller passed, including
loopback / link-local / private targets — classic SSRF pivot.
Now `isPublicHttpUrl` rejects non-http(s) schemes, restricted IP
ranges, and DNS hostnames whose A/AAAA records resolve into those
ranges (covers DNS rebinding). Bypassed under
`app()->runningUnitTests()` so `Http::fake()` keeps working.
Streaming the response body lets us abort early once we exceed
MAX_BYTES instead of buffering the full payload first; redirects
are disabled so a 200→302 trick can't bypass the host check.
- The `media[]` JSON column had a lost-update race in
`attachFromUrls`: read `$post->media`, mutate in PHP, write back.
Two concurrent calls clobbered each other. Now wrapped in a
transaction with `lockForUpdate()`.
- ESLint: `resources/js/actions/**` and `resources/js/routes/**`
are auto-generated by Wayfinder on every build. Their import
order matches PHP scan order, not alphabetical, so import/order
fought eslint-fix forever. Added them to ignores.
207 lines
6.6 KiB
PHP
207 lines
6.6 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
use App\Enums\Post\Status as PostStatus;
|
|
use App\Enums\PostPlatform\ContentType;
|
|
use App\Enums\SocialAccount\Platform;
|
|
use App\Enums\UserWorkspace\Role;
|
|
use App\Jobs\PublishPost;
|
|
use App\Mcp\Servers\TryPostServer;
|
|
use App\Mcp\Tools\Post\PublishPostTool;
|
|
use App\Mcp\Tools\Post\UpdatePostTool;
|
|
use App\Models\Post;
|
|
use App\Models\PostPlatform;
|
|
use App\Models\SocialAccount;
|
|
use App\Models\User;
|
|
use App\Models\Workspace;
|
|
use App\Models\WorkspaceLabel;
|
|
use Illuminate\Support\Facades\Queue;
|
|
use Illuminate\Testing\Fluent\AssertableJson;
|
|
|
|
beforeEach(function () {
|
|
$this->user = User::factory()->create();
|
|
$this->workspace = Workspace::factory()->create(['user_id' => $this->user->id]);
|
|
$this->workspace->members()->attach($this->user->id, ['role' => Role::Member->value]);
|
|
$this->user->update(['current_workspace_id' => $this->workspace->id]);
|
|
|
|
$this->socialAccount = SocialAccount::factory()->create([
|
|
'workspace_id' => $this->workspace->id,
|
|
'platform' => Platform::LinkedIn,
|
|
]);
|
|
});
|
|
|
|
// UpdatePostTool
|
|
|
|
test('update post can change content', function () {
|
|
$post = Post::factory()->create([
|
|
'workspace_id' => $this->workspace->id,
|
|
'user_id' => $this->user->id,
|
|
'content' => 'old',
|
|
]);
|
|
|
|
$response = TryPostServer::actingAs($this->user)
|
|
->tool(UpdatePostTool::class, [
|
|
'post_id' => $post->id,
|
|
'content' => 'new content',
|
|
]);
|
|
|
|
$response->assertOk()
|
|
->assertStructuredContent(function (AssertableJson $json) {
|
|
$json->where('content', 'new content')->etc();
|
|
});
|
|
|
|
expect($post->fresh()->content)->toBe('new content');
|
|
});
|
|
|
|
test('update post enables platforms', function () {
|
|
$post = Post::factory()->create([
|
|
'workspace_id' => $this->workspace->id,
|
|
'user_id' => $this->user->id,
|
|
]);
|
|
|
|
$platform = PostPlatform::factory()->linkedin()->create([
|
|
'post_id' => $post->id,
|
|
'social_account_id' => $this->socialAccount->id,
|
|
'enabled' => false,
|
|
]);
|
|
|
|
$response = TryPostServer::actingAs($this->user)
|
|
->tool(UpdatePostTool::class, [
|
|
'post_id' => $post->id,
|
|
'platforms' => [
|
|
['id' => $platform->id, 'content_type' => ContentType::LinkedInPost->value],
|
|
],
|
|
]);
|
|
|
|
$response->assertOk();
|
|
|
|
expect($platform->fresh()->enabled)->toBeTrue();
|
|
});
|
|
|
|
test('update post can attach labels', function () {
|
|
$post = Post::factory()->create([
|
|
'workspace_id' => $this->workspace->id,
|
|
'user_id' => $this->user->id,
|
|
]);
|
|
$label = WorkspaceLabel::factory()->create(['workspace_id' => $this->workspace->id]);
|
|
|
|
$response = TryPostServer::actingAs($this->user)
|
|
->tool(UpdatePostTool::class, [
|
|
'post_id' => $post->id,
|
|
'label_ids' => [$label->id],
|
|
]);
|
|
|
|
$response->assertOk();
|
|
expect($post->fresh()->labels()->pluck('id')->all())->toBe([$label->id]);
|
|
});
|
|
|
|
test('update post 404 from another workspace', function () {
|
|
$other = Workspace::factory()->create();
|
|
$post = Post::factory()->create(['workspace_id' => $other->id, 'user_id' => $this->user->id]);
|
|
|
|
$response = TryPostServer::actingAs($this->user)
|
|
->tool(UpdatePostTool::class, ['post_id' => $post->id, 'content' => 'x']);
|
|
|
|
$response->assertHasErrors(['Post not found.']);
|
|
});
|
|
|
|
test('update post rejects already-published post', function () {
|
|
$post = Post::factory()->create([
|
|
'workspace_id' => $this->workspace->id,
|
|
'user_id' => $this->user->id,
|
|
'status' => PostStatus::Published,
|
|
]);
|
|
|
|
$response = TryPostServer::actingAs($this->user)
|
|
->tool(UpdatePostTool::class, ['post_id' => $post->id, 'content' => 'x']);
|
|
|
|
$response->assertHasErrors(['Cannot edit a published post.']);
|
|
});
|
|
|
|
// PublishPostTool
|
|
|
|
test('publish post immediate dispatches PublishPost job', function () {
|
|
Queue::fake();
|
|
|
|
$post = Post::factory()->create([
|
|
'workspace_id' => $this->workspace->id,
|
|
'user_id' => $this->user->id,
|
|
'status' => PostStatus::Draft,
|
|
]);
|
|
|
|
PostPlatform::factory()->linkedin()->create([
|
|
'post_id' => $post->id,
|
|
'social_account_id' => $this->socialAccount->id,
|
|
'enabled' => true,
|
|
]);
|
|
|
|
$response = TryPostServer::actingAs($this->user)
|
|
->tool(PublishPostTool::class, ['post_id' => $post->id]);
|
|
|
|
$response->assertOk();
|
|
|
|
Queue::assertPushed(PublishPost::class);
|
|
expect($post->fresh()->status)->toBe(PostStatus::Publishing);
|
|
|
|
// Regression: previously UpdatePost::execute disabled every platform when
|
|
// called without a `platforms` key, leaving the publish job with nothing
|
|
// to publish. The Arr::has guard keeps the existing toggle state intact.
|
|
expect(PostPlatform::where('post_id', $post->id)->where('enabled', true)->count())->toBe(1);
|
|
});
|
|
|
|
test('publish post scheduled does not dispatch immediately', function () {
|
|
Queue::fake();
|
|
|
|
$post = Post::factory()->create([
|
|
'workspace_id' => $this->workspace->id,
|
|
'user_id' => $this->user->id,
|
|
'status' => PostStatus::Draft,
|
|
]);
|
|
|
|
PostPlatform::factory()->linkedin()->create([
|
|
'post_id' => $post->id,
|
|
'social_account_id' => $this->socialAccount->id,
|
|
'enabled' => true,
|
|
]);
|
|
|
|
$response = TryPostServer::actingAs($this->user)
|
|
->tool(PublishPostTool::class, [
|
|
'post_id' => $post->id,
|
|
'scheduled_at' => '2099-12-31T15:30:00Z',
|
|
]);
|
|
|
|
$response->assertOk();
|
|
|
|
Queue::assertNotPushed(PublishPost::class);
|
|
expect($post->fresh()->status)->toBe(PostStatus::Scheduled);
|
|
});
|
|
|
|
test('publish post fails when no platforms enabled', function () {
|
|
$post = Post::factory()->create([
|
|
'workspace_id' => $this->workspace->id,
|
|
'user_id' => $this->user->id,
|
|
'status' => PostStatus::Draft,
|
|
]);
|
|
|
|
PostPlatform::factory()->linkedin()->create([
|
|
'post_id' => $post->id,
|
|
'social_account_id' => $this->socialAccount->id,
|
|
'enabled' => false,
|
|
]);
|
|
|
|
$response = TryPostServer::actingAs($this->user)
|
|
->tool(PublishPostTool::class, ['post_id' => $post->id]);
|
|
|
|
$response->assertHasErrors(['Post has no enabled platforms. Use update-post-tool to enable at least one platform first.']);
|
|
});
|
|
|
|
test('publish post 404 from another workspace', function () {
|
|
$other = Workspace::factory()->create();
|
|
$post = Post::factory()->create(['workspace_id' => $other->id, 'user_id' => $this->user->id]);
|
|
|
|
$response = TryPostServer::actingAs($this->user)
|
|
->tool(PublishPostTool::class, ['post_id' => $post->id]);
|
|
|
|
$response->assertHasErrors(['Post not found.']);
|
|
});
|