dba6346226
EnsureAccountReady bundled a subscription gate (redirects to onboarding, SaaS only) with a workspace gate (redirects to workspace creation). The connect routes can't sit behind it because connecting/disconnecting happens during onboarding, before a subscription exists. Split the workspace gate into a standalone EnsureHasWorkspace middleware: - EnsureAccountReady is now subscription-only. - EnsureHasWorkspace redirects to workspace creation when there is no current workspace, in both SaaS and self-hosted modes. - The social connect group gains EnsureHasWorkspace; the main app group gains it alongside EnsureAccountReady (listed after it, so the subscription gate still runs first — no custom middleware priority). - The repeated `if (! $workspace) redirect()` guard is removed from the connect/store/authorize/disconnect/index/toggle handlers, and their return types are tightened (no more dangling RedirectResponse). LinkedIn connect's no-workspace path changes from a popup callback to the same redirect as the other platforms.
97 lines
3.3 KiB
PHP
97 lines
3.3 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace App\Http\Controllers\Auth;
|
|
|
|
use App\Enums\SocialAccount\Platform as SocialPlatform;
|
|
use App\Enums\SocialAccount\Status;
|
|
use App\Models\Workspace;
|
|
use Illuminate\Http\Request;
|
|
use Illuminate\Support\Facades\Log;
|
|
use Inertia\Response as InertiaResponse;
|
|
use Laravel\Socialite\Facades\Socialite;
|
|
use Symfony\Component\HttpFoundation\Response;
|
|
|
|
class TikTokController extends SocialController
|
|
{
|
|
protected string $driver = 'tiktok';
|
|
|
|
protected SocialPlatform $platform = SocialPlatform::TikTok;
|
|
|
|
protected array $scopes = [
|
|
'user.info.basic',
|
|
'user.info.profile',
|
|
'user.info.stats',
|
|
'video.publish',
|
|
'video.upload',
|
|
'video.list',
|
|
];
|
|
|
|
public function connect(Request $request): Response
|
|
{
|
|
$this->ensurePlatformEnabled();
|
|
|
|
$workspace = $request->user()->currentWorkspace;
|
|
|
|
$this->authorize('manageAccounts', $workspace);
|
|
|
|
session(['social_reconnect_id' => null]);
|
|
|
|
return $this->redirectToProvider($request, $this->driver, $this->scopes);
|
|
}
|
|
|
|
public function callback(Request $request): InertiaResponse
|
|
{
|
|
$workspaceId = session('social_connect_workspace');
|
|
|
|
if (! $workspaceId) {
|
|
return $this->popupCallback(false, __('accounts.popup_callback.session_expired'), $this->platform->value);
|
|
}
|
|
|
|
$workspace = Workspace::find($workspaceId);
|
|
|
|
if (! $workspace || ! $request->user()->can('manageAccounts', $workspace)) {
|
|
return $this->popupCallback(false, __('accounts.popup_callback.workspace_not_found'), $this->platform->value);
|
|
}
|
|
|
|
try {
|
|
$socialUser = Socialite::driver($this->driver)
|
|
->scopes($this->scopes)
|
|
->user();
|
|
|
|
// TikTok returns username via getNickname() when user.info.profile scope is included
|
|
$username = $socialUser->getNickname();
|
|
$avatarPath = uploadFromUrl($socialUser->getAvatar());
|
|
|
|
$workspace->socialAccounts()->updateOrCreate(
|
|
[
|
|
'platform' => $this->platform->value,
|
|
'platform_user_id' => $socialUser->getId(),
|
|
],
|
|
[
|
|
'username' => $username,
|
|
'display_name' => $socialUser->getName(),
|
|
'avatar_url' => $avatarPath,
|
|
'access_token' => $socialUser->token,
|
|
'refresh_token' => $socialUser->refreshToken,
|
|
'token_expires_at' => $socialUser->expiresIn ? now()->addSeconds($socialUser->expiresIn) : null,
|
|
'scopes' => $socialUser->approvedScopes ?? null,
|
|
'status' => Status::Connected,
|
|
'error_message' => null,
|
|
'disconnected_at' => null,
|
|
],
|
|
);
|
|
|
|
session()->forget('social_reconnect_id');
|
|
|
|
return $this->popupCallback(true, __('accounts.popup_callback.connected'), $this->platform->value);
|
|
} catch (\Exception $e) {
|
|
Log::error('TikTok OAuth Error', [
|
|
'error' => $e->getMessage(),
|
|
]);
|
|
|
|
return $this->popupCallback(false, __('accounts.popup_callback.error_connecting'), $this->platform->value);
|
|
}
|
|
}
|
|
}
|