create-nevela 0.7.1 → 0.8.0

package/template/laravel/src/Http/PublicController.php

@@ -0,0 +1,210 @@
+<?php
+
+namespace Nevela\Laravel\Http;
+
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+use Illuminate\Http\Response;
+use Illuminate\Support\Facades\DB;
+use Nevela\Laravel\Media\Uploads;
+use Nevela\Laravel\Models\Upload;
+use Nevela\Laravel\Nevela;
+use Nevela\Laravel\Support\Descriptor;
+use Nevela\Laravel\Support\PublicAccess;
+use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
+
+/**
+ * What anyone can call, signed in or not: a resource's "public" section.
+ *
+ *   GET  {prefix}/public/{slug}          the list, of the records the model says are public
+ *   GET  {prefix}/public/{slug}/{id}     one of them, by id or by the field the section names
+ *   POST {prefix}/public/{slug}          create one, from the fields the section lists
+ *   PUT  {prefix}/public/_nevela/uploads/{Resource}/{field}   a file for such a create
+ *
+ * The routes are generated (routes/nevela-public.php), one set per resource that has a
+ * section and only for what it opens, so a resource without one has nothing here to call.
+ *
+ * Nobody is asked who they are, so nothing here trusts what it is sent beyond what the
+ * section allows: fields that aren't listed are never sent out and never taken in, and
+ * the rules are the generated request's own.
+ */
+final class PublicController
+{
+    /** How long a file uploaded for a create waits for that create, in seconds. */
+    public const CLAIM_SECONDS = 3600;
+
+    public function index(Request $request): JsonResponse
+    {
+        [$descriptor, $public] = $this->open($request, 'read');
+        $resourceClass = $this->resourceClass($descriptor);
+
+        // Sorting, filtering and search are the signed-in list's, over the listed fields only.
+        $response = Nevela::listFor($this->readable($descriptor), $descriptor->only($public->read), $request, $resourceClass);
+        if ($response->getStatusCode() !== 200) {
+            return $response;
+        }
+        $body = $response->getData(true);
+        $body['data'] = array_map(fn (array $row) => $this->visible($descriptor, $public, $row), $body['data']);
+
+        return response()->json($body);
+    }
+
+    public function show(Request $request): JsonResponse
+    {
+        [$descriptor, $public] = $this->open($request, 'read');
+        $id = (string) $request->route('id');
+        $query = $this->readable($descriptor);
+        if ($public->by !== null) {
+            $query->where($descriptor->fields[$public->by]->column(), $id);
+        } elseif ($descriptor->idType === 'int' ? ! preg_match('/^[0-9]{1,18}$/', $id) : ! \Illuminate\Support\Str::isUuid($id)) {
+            throw new NotFoundHttpException;
+        } else {
+            $query->whereKey($id);
+        }
+        $record = $query->first() ?? throw new NotFoundHttpException;
+        $resourceClass = $this->resourceClass($descriptor);
+
+        return response()->json($this->visible($descriptor, $public, (new $resourceClass($record))->resolve($request)));
+    }
+
+    public function store(Request $request): JsonResponse|Response
+    {
+        [$descriptor, $public] = $this->open($request, 'create');
+        $requestClass = "App\\Http\\Requests\\Nevela\\{$descriptor->name}Request";
+        $model = $this->model($descriptor);
+        $input = $request->json()->all() ?: $request->request->all();
+
+        $checked = (new $requestClass)->forFields($public->create, is_array($input) ? $input : []);
+        // A file has to be one a visitor uploaded for this, a moment ago, and not yet used.
+        foreach ($public->create as $field) {
+            $key = $checked['values'][$descriptor->fields[$field]->column()] ?? null;
+            if ($descriptor->fields[$field]->kind === 'file' && is_string($key) && $key !== '' && ! $this->claimable($descriptor, $field, $key)) {
+                $checked['issues'][] = ['path' => $field, 'message' => 'Upload the file again: this one has been used, or was uploaded too long ago.'];
+            }
+        }
+        if ($checked['issues'] !== []) {
+            return response()->json(['error' => 'Validation failed.', 'issues' => $checked['issues']], 422);
+        }
+
+        $record = DB::transaction(function () use ($model, $checked, $descriptor, $public) {
+            $record = $model::create($checked['values']);
+            // Claimed: the nightly clear-out of uploads nobody used leaves it alone from here on.
+            foreach ($public->create as $field) {
+                $key = $descriptor->fields[$field]->kind === 'file' ? $record->getAttribute($descriptor->fields[$field]->column()) : null;
+                if (is_string($key) && $key !== '') {
+                    Upload::query()->where('key', $key)->update(['uploaded_by' => Uploads::CLAIMED]);
+                }
+            }
+
+            return $record;
+        });
+
+        // What they may read of what they made, or nothing where nothing may be read.
+        if ($public->read === null) {
+            return response()->noContent(201);
+        }
+        $resourceClass = $this->resourceClass($descriptor);
+
+        return response()->json($this->visible($descriptor, $public, (new $resourceClass($record->refresh()))->resolve($request)), 201);
+    }
+
+    /** A file for a public create: the field's own types and size limit, and no sign-in. */
+    public function upload(Request $request): JsonResponse
+    {
+        [$descriptor, $public] = $this->open($request, 'create');
+        $field = (string) $request->route('field');
+        $definition = $descriptor->fields[$field] ?? null;
+        if ($definition === null || $definition->kind !== 'file' || ! in_array($field, $public->create, true)) {
+            throw new NotFoundHttpException;
+        }
+        $upload = UploadController::receive($request, $descriptor, $definition);
+        if ($upload instanceof JsonResponse) {
+            return $upload;
+        }
+        // Marked as a visitor's, waiting to be used: see claimable() and Uploads::purgeUnclaimed().
+        $upload->update(['uploaded_by' => Uploads::UNCLAIMED]);
+
+        return response()->json(Uploads::ref($upload->key), 201);
+    }
+
+    /**
+     * The resource a route is for, if this part of it is open. The route is only there when
+     * it is, so this failing means a route file older than the descriptor.
+     *
+     * Which resource is a default set on the route. Laravel hands route parameters to a
+     * controller in order and not by name, with defaults after what the address holds, so
+     * it is asked for by its name here.
+     *
+     * @return array{Descriptor, PublicAccess}
+     */
+    private function open(Request $request, string $what): array
+    {
+        try {
+            $descriptor = Nevela::resource((string) $request->route('resource'));
+        } catch (\InvalidArgumentException) {
+            throw new NotFoundHttpException;
+        }
+        if ($descriptor->public?->{$what} === null || ! class_exists($this->model($descriptor))) {
+            throw new NotFoundHttpException;
+        }
+
+        return [$descriptor, $descriptor->public];
+    }
+
+    /** @return class-string<Model> */
+    private function model(Descriptor $descriptor): string
+    {
+        return "App\\Models\\{$descriptor->name}";
+    }
+
+    /** @return class-string<\Illuminate\Http\Resources\Json\JsonResource> */
+    private function resourceClass(Descriptor $descriptor): string
+    {
+        return "App\\Http\\Resources\\Nevela\\{$descriptor->name}Resource";
+    }
+
+    /**
+     * The records anyone may read: what the model's publicQuery scope lets through. A model
+     * without the scope has said nothing, and nothing is what is public.
+     */
+    private function readable(Descriptor $descriptor): Builder
+    {
+        $model = $this->model($descriptor);
+        $query = $model::query();
+
+        return method_exists($model, 'scopePublicQuery') ? $query->publicQuery() : $query->whereRaw('1 = 0');
+    }
+
+    /**
+     * A record as anyone may see it: its id and the listed fields, and for a file the
+     * details that go with its key. Nothing else, whatever the API resource holds.
+     *
+     * @param  array<string, mixed>  $row
+     * @return array<string, mixed>
+     */
+    private function visible(Descriptor $descriptor, PublicAccess $public, array $row): array
+    {
+        $seen = ['id' => $row['id'] ?? null];
+        foreach ($public->read ?? [] as $field) {
+            $seen[$field] = $row[$field] ?? null;
+            if ($descriptor->fields[$field]->kind === 'file') {
+                $seen[$field.'File'] = $row[$field.'File'] ?? null;
+            }
+        }
+
+        return $seen;
+    }
+
+    /** Whether a key is a file a visitor uploaded to this field within the hour, that no record has yet. */
+    private function claimable(Descriptor $descriptor, string $field, string $key): bool
+    {
+        $upload = Upload::query()->where('key', $key)->where('resource', $descriptor->name)->where('field', $field)->first();
+
+        return $upload !== null
+            && $upload->getAttribute('uploaded_by') === Uploads::UNCLAIMED
+            && $upload->created_at !== null && $upload->created_at->gt(now()->subSeconds(self::CLAIM_SECONDS))
+            && ! DB::table($descriptor->table)->where($descriptor->fields[$field]->column(), $key)->exists();
+    }
+}

package/template/laravel/src/Http/PublicThrottle.php

@@ -0,0 +1,48 @@
+<?php
+
+namespace Nevela\Laravel\Http;
+
+use Closure;
+use Illuminate\Routing\Middleware\ThrottleRequests;
+use Nevela\Laravel\Auth\Account;
+
+/**
+ * The throttle on a resource's public routes: Laravel's own, counting the right thing.
+ *
+ * A public page or form is usually reached through the web app, whose server makes the
+ * call. Counted as they arrive, every visitor would be that one server: ten enquiries a
+ * minute for the whole world, and a busy page would lock itself out. So, for a request
+ * that proves it comes from the web app (the secret the two share, as for the list of
+ * signed-in devices):
+ *
+ * - one made for a visitor is counted against that visitor's address, which the web app
+ *   passes on as X-Nevela-Client. It is the address the proxy in front of the web app saw,
+ *   not the one the request claimed for itself: a visitor who could choose it could have
+ *   a fresh allowance with every request. Where the web app can't tell (it says
+ *   "unknown"), visitors are counted together, from the web app's own address;
+ * - one made for nobody in particular, such as a page being built to be cached and
+ *   shown to many, is the site reading its own data and is not counted. Such a request
+ *   carries the secret and names no visitor at all.
+ *
+ * Anything else is counted against the address it came from, as ever.
+ */
+final class PublicThrottle extends ThrottleRequests
+{
+    public function handle($request, Closure $next, $maxAttempts = 60, $decayMinutes = 1, $prefix = '')
+    {
+        if (Account::fromDashboard($request)) {
+            $visitor = $request->header('X-Nevela-Client');
+            if ($visitor === null) {
+                // Only on the strength of the secret: "from this machine, in development" is
+                // enough to believe an address, and not enough to stop counting.
+                if ((string) config('nevela.auth.proxy_secret', '') !== '') {
+                    return $next($request);
+                }
+            } elseif (filter_var($visitor, FILTER_VALIDATE_IP)) {
+                $request->server->set('REMOTE_ADDR', $visitor);
+            }
+        }
+
+        return parent::handle($request, $next, $maxAttempts, $decayMinutes, $prefix);
+    }
+}

package/template/laravel/src/Http/ResourceRequest.php

@@ -6,8 +6,10 @@ use Illuminate\Foundation\Http\FormRequest;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Schema;
 use Illuminate\Support\Facades\Validator as Validation;
+use Illuminate\Validation\Rules\Exists;
 use Illuminate\Validation\Rules\Unique;
 use Illuminate\Validation\Validator;
+use Nevela\Laravel\Support\Html;
 
 /**
  * Base for generated resource requests.
@@ -31,9 +33,102 @@ abstract class ResourceRequest extends FormRequest
     /** @return array<string, string> field => column */
     abstract protected function columns(): array;
 
+    /**
+     * Fields that hold rich text. A generated request with any says which.
+     *
+     * @return list<string>
+     */
+    protected function rich(): array
+    {
+        return [];
+    }
+
+    /**
+     * What a field is when a create leaves it out. A generated request with any says which.
+     *
+     * @return array<string, mixed> field => value
+     */
+    protected function defaults(): array
+    {
+        return [];
+    }
+
+    /**
+     * A create from some of the fields only: a public form's, where nobody is asked who
+     * they are and so only what the descriptor lists is taken.
+     *
+     * The rules are this request's own. A key that isn't listed is refused the way an
+     * unknown one is, and a field left out takes its default, or is left to the column.
+     *
+     * @param  list<string>  $fields  The fields that may be sent
+     * @param  array<string, mixed>  $input
+     * @return array{values: array<string, mixed>, issues: list<array{path: string, message: string}>}
+     */
+    public function forFields(array $fields, array $input): array
+    {
+        $input = self::cleaned($this->rich(), $input) + $input;
+        $issues = [];
+        foreach (array_keys($input) as $key) {
+            if (! in_array($key, $fields, true)) {
+                $issues[] = ['path' => (string) $key, 'message' => 'Unknown field.'];
+            }
+        }
+        $validator = Validation::make($input, array_intersect_key(self::withoutTrashed($this->rules()), array_flip($fields)));
+        if ($validator->fails()) {
+            self::explainTrashed($validator, $input);
+            array_push($issues, ...FlareErrors::issues($validator->errors()->toArray()));
+        }
+        if ($issues !== []) {
+            return ['values' => [], 'issues' => $issues];
+        }
+
+        $validated = $validator->validated();
+        $defaults = $this->defaults();
+        $values = [];
+        foreach ($this->columns() as $field => $column) {
+            if (array_key_exists($field, $validated)) {
+                $values[$column] = $validated[$field];
+            } elseif (array_key_exists($field, $defaults)) {
+                $values[$column] = $defaults[$field];
+            }
+        }
+
+        return ['values' => $values, 'issues' => []];
+    }
+
+    /**
+     * Rich text is cleaned before anything looks at it: what is checked for being there,
+     * and for being short enough, is the HTML that would be stored.
+     */
+    protected function prepareForValidation(): void
+    {
+        $this->merge(self::cleaned($this->rich(), $this->all()));
+    }
+
+    /**
+     * @param  list<string>  $fields
+     * @param  array<string, mixed>  $input
+     * @return array<string, mixed> The fields that were sent as text, cleaned. One with nothing left to read is empty.
+     */
+    private static function cleaned(array $fields, array $input): array
+    {
+        $clean = [];
+        foreach ($fields as $field) {
+            if (is_string($input[$field] ?? null)) {
+                $html = Html::clean($input[$field]);
+                $clean[$field] = $html === '' ? null : $html;
+            }
+        }
+
+        return $clean;
+    }
+
+    /** Tables known to have a trash. Only "yes" is remembered: the column can arrive with a migration. */
+    private static array $trashes = [];
+
     protected function validationRules()
     {
-        $rules = parent::validationRules();
+        $rules = self::withoutTrashed(parent::validationRules());
         if (! $this->isMethod('PATCH')) {
             return $rules;
         }
@@ -57,9 +152,36 @@ abstract class ResourceRequest extends FormRequest
         });
     }
 
+    /**
+     * A relation points at a record that is there, and one in the trash is not: nothing
+     * lists it and its own page answers 404. Laravel's exists rule looks at the table,
+     * where a deleted record still is, so it is told to leave those out.
+     *
+     * @param  array<string, mixed>  $rules
+     * @return array<string, mixed>
+     */
+    private static function withoutTrashed(array $rules): array
+    {
+        foreach ($rules as $set) {
+            foreach (is_array($set) ? $set : [] as $rule) {
+                if (! $rule instanceof Exists) {
+                    continue;
+                }
+                // "exists:categories,id": the rule keeps its table to itself.
+                $table = (string) strtok(substr((string) $rule, strlen('exists:')), ',');
+                if (self::$trashes[$table] ?? (Schema::hasColumn($table, 'deleted_at') && (self::$trashes[$table] = true))) {
+                    $rule->withoutTrashed();
+                }
+            }
+        }
+
+        return $rules;
+    }
+
     /**
      * A unique value can be held by a record nobody can see: one in the trash. "Already
      * taken" would send someone looking through a list it isn't in, so say where it is.
+     * The same goes for a relation to a record that is in the trash.
      *
      * @param  array<string, mixed>  $data
      * @return list<array{path: string, message: string}> The messages that were replaced
@@ -82,6 +204,25 @@ abstract class ResourceRequest extends FormRequest
             $validator->errors()->add($field, $message);
             $replaced[] = ['path' => (string) $field, 'message' => $message];
         }
+        foreach ($validator->failed() as $field => $rules) {
+            // And for a failed exists rule: the table and the column, then what else it asked.
+            [$table, $column] = array_pad($rules['Exists'] ?? [], 2, null);
+            $value = $data[$field] ?? null;
+            if (! is_string($table) || ! is_string($column) || ! is_scalar($value) || ! (self::$trashes[$table] ?? false)) {
+                continue;
+            }
+            try {
+                $trashed = DB::table($table)->where($column, $value)->whereNotNull('deleted_at')->exists();
+            } catch (\Throwable) {
+                continue; // not something that could be an id at all
+            }
+            if ($trashed) {
+                $message = 'This one is in the trash. Restore it, or choose another.';
+                $validator->errors()->forget($field);
+                $validator->errors()->add($field, $message);
+                $replaced[] = ['path' => (string) $field, 'message' => $message];
+            }
+        }
 
         return $replaced;
     }
@@ -101,8 +242,9 @@ abstract class ResourceRequest extends FormRequest
      */
     public function many(array $rows): array
     {
-        $rules = $this->rules();
+        $rules = self::withoutTrashed($this->rules());
         $columns = $this->columns();
+        $defaults = $this->defaults();
         $known = array_keys($columns);
         $computed = array_map(fn (string $field) => $field.'File', $known);
         $unique = array_keys(array_filter($rules, fn ($rule) => is_array($rule) && array_filter($rule, fn ($one) => $one instanceof Unique) !== []));
@@ -124,6 +266,7 @@ abstract class ResourceRequest extends FormRequest
                     $issues[] = ['path' => (string) $key, 'message' => 'Unknown field.'];
                 }
             }
+            $row = self::cleaned($this->rich(), $row) + $row;
             $validator = Validation::make($row, $rules);
             if ($validator->fails()) {
                 self::explainTrashed($validator, $row);
@@ -152,6 +295,8 @@ abstract class ResourceRequest extends FormRequest
             foreach ($columns as $field => $column) {
                 if (array_key_exists($field, $validated)) {
                     $mapped[$column] = $validated[$field];
+                } elseif (array_key_exists($field, $defaults)) {
+                    $mapped[$column] = $defaults[$field];
                 }
             }
             $values[] = $mapped;
@@ -164,10 +309,14 @@ abstract class ResourceRequest extends FormRequest
     public function values(): array
     {
         $validated = $this->validated();
+        $defaults = $this->defaults();
         $values = [];
         foreach ($this->columns() as $field => $column) {
             if (array_key_exists($field, $validated)) {
                 $values[$column] = $validated[$field];
+            } elseif (array_key_exists($field, $defaults) && ! $this->isMethod('PATCH')) {
+                // Left out of a create, or of a replace, it is what it usually is.
+                $values[$column] = $defaults[$field];
             } elseif ($this->isMethod('PUT')) {
                 $values[$column] = null;
             }

package/template/laravel/src/Http/TrashController.php

@@ -92,7 +92,7 @@ final class TrashController
     public function restore(string $slug, string $id): JsonResponse
     {
         ['descriptor' => $descriptor, 'model' => $model] = $this->resource($slug);
-        $record = $model::onlyTrashed()->find($id) ?? throw new NotFoundHttpException("No deleted {$this->noun($descriptor)} with that id.");
+        $record = $this->deleted($model, $id) ?? throw new NotFoundHttpException("No deleted {$this->noun($descriptor)} with that id.");
         if (! Trash::may('restore', $record)) {
             throw new AccessDeniedHttpException("You don't have access to this.");
         }
@@ -119,7 +119,7 @@ final class TrashController
     public function destroy(string $slug, string $id): JsonResponse|Response
     {
         ['descriptor' => $descriptor, 'model' => $model] = $this->resource($slug);
-        $record = $model::onlyTrashed()->find($id) ?? throw new NotFoundHttpException("No deleted {$this->noun($descriptor)} with that id.");
+        $record = $this->deleted($model, $id) ?? throw new NotFoundHttpException("No deleted {$this->noun($descriptor)} with that id.");
         if (! Trash::may('forceDelete', $record)) {
             throw new AccessDeniedHttpException("You don't have access to this.");
         }
@@ -167,6 +167,22 @@ final class TrashController
         return $resource;
     }
 
+    /**
+     * The deleted record with this id, if there is one.
+     *
+     * @param  class-string<\Illuminate\Database\Eloquent\Model>  $model
+     */
+    private function deleted(string $model, string $id): ?\Illuminate\Database\Eloquent\Model
+    {
+        // Where ids are integers, something that isn't one is nobody's id. Asked anyway,
+        // some databases answer with an error instead of with nothing.
+        if ((new $model)->getKeyType() === 'int' && ! preg_match('/^[0-9]{1,18}$/', $id)) {
+            return null;
+        }
+
+        return $model::onlyTrashed()->find($id);
+    }
+
     private function noun(Descriptor $descriptor): string
     {
         return strtolower($descriptor->label);

package/template/laravel/src/Http/UploadController.php

@@ -110,7 +110,8 @@ final class UploadController
     public function show(string $path): Response
     {
         // A key is letters, digits, dashes, dots and slashes. Anything else was never one.
-        if ($path === '' || str_contains($path, '..') || ! preg_match('#^[A-Za-z0-9][A-Za-z0-9._/-]*$#', $path)) {
+        // And a private file's key is not an address, whoever has it.
+        if ($path === '' || str_contains($path, '..') || ! preg_match('#^[A-Za-z0-9][A-Za-z0-9._/-]*$#', $path) || Uploads::isPrivate($path)) {
             abort(404);
         }
         $cache ='public, max-age=31536000, immutable';
@@ -152,6 +153,46 @@ final class UploadController
         ]);
     }
 
+    /**
+     * A private file, to someone who may view the record it belongs to.
+     *
+     *   GET {prefix}/_nevela/private/{slug}/{id}/{field}
+     *
+     * The address names the record and the field, and the file is found from them: there
+     * is no key in it to pass around. It is never to be kept by a cache on the way.
+     */
+    public function download(string $slug, string $id, string $field): Response
+    {
+        $descriptor = null;
+        foreach (Nevela::all() as $candidate) {
+            if ($candidate->slug === $slug) {
+                $descriptor = $candidate;
+            }
+        }
+        $definition = $descriptor?->fields[$field] ?? null;
+        $model = 'App\\Models\\'.($descriptor?->name ?? '');
+        if ($descriptor === null || $definition === null || $definition->kind !== 'file' || ! $definition->private || ! class_exists($model)
+            || ($descriptor->idType === 'int' && ! preg_match('/^[0-9]{1,18}$/', $id))) {
+            abort(404);
+        }
+        // A record in the trash is found by nobody here: trashing it exposes nothing.
+        $record = $model::query()->find($id) ?? abort(404);
+        Gate::authorize('view', $record);
+
+        $key = $record->getAttribute($definition->column());
+        $upload = Uploads::isPrivate($key) ? Upload::query()->where('key', $key)->first() : null;
+        $disk = $upload === null ? null : Storage::disk($upload->disk);
+        if ($upload === null || $disk === null || ! $disk->exists(Uploads::privatePath($key))) {
+            abort(404);
+        }
+
+        return $disk->response(Uploads::privatePath($key), $upload->name, [
+            'Content-Type' => $upload->mime,
+            'Cache-Control' => 'private, no-store',
+            'X-Content-Type-Options' => 'nosniff',
+        ], 'attachment');
+    }
+
     private static function refuse(int $status, string $message): JsonResponse
     {
         return response()->json(['error' => $message], $status);