Generate share passwords and offer them again beside the new link

Uploaders no longer have to make up a share password. With "Password
protect" on, the upload page has Generate and Copy under the field, and
the page the upload leads to offers the password once more beside the
link: masked, with the same copy button at the end of the field as the
link's. The password also derives the share's encryption key and only
its hash is stored, so a lost one means files nobody can open.

- PasswordGeneratorService draws from Random\Randomizer's secure engine.
  Characters are drawn uniformly and redrawn until every chosen set
  appears; passphrases come from EFF's large word list (CC BY 3.0 US,
  credited in the README), without its four hyphenated words.
- Admin settings gain a "Share Passwords" card: mode (off, on request,
  prefilled as protection is switched on), kind (characters: length
  12–64, the sets, look-alikes left out; passphrase: 4–10 words and a
  separator), and an example with its estimated entropy that follows the
  form before saving. Fields the chosen mode or kind hides are excluded
  from validation and keep their saved value. The default is on
  request, 20 letters and numbers without look-alikes.
- FileUploader flashes the password encrypted with the share's token;
  ShareCreated shows it only when the token matches, so a reload or any
  other visitor sees nothing. Crypt covers installs without
  SESSION_ENCRYPT, which the Docker setup does not set.
- The symbol set leaves out what chat apps turn into formatting and
  what breaks inside quotes, so a pasted password arrives unchanged.
- app.css imports group.css for <x-group>; .ai/rules/views.md records
  that <x-group> drops data-test and other attributes.
- Tests cover the generator, the admin card's saving, validation and
  example, prefill and generate on the upload page, the flash, and in
  Chromium Generate and Copy on the upload page and the masked copy on
  the share page. The admin settings page now has six headed sections.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

tests/Feature/Admin/AdminSettingsTest.php

@@ -157,3 +157,107 @@ test('a colour profile that was not generated is refused', function () {
 
     expect(Setting::get('color_profile'))->toBeNull();
 });
+
+test('admin saves a character password generator, starting from the saved settings', function () {
+    $admin = User::query()->where('is_admin', true)->first();
+
+    Livewire::actingAs($admin)
+        ->test(AdminSettings::class)
+        ->assertSet('passwordGeneratorMode', 'button')
+        ->set('passwordGeneratorMode', 'prefill')
+        ->set('passwordGeneratorType', 'characters')
+        ->set('passwordLength', 24)
+        ->set('passwordCharacterSets', ['numbers', 'symbols'])
+        ->set('passwordAvoidAmbiguous', false)
+        ->call('saveSettings')
+        ->assertHasNoErrors();
+
+    expect(Setting::get('password_generator_mode'))->toBe('prefill');
+    expect(Setting::get('password_generator_type'))->toBe('characters');
+    expect(Setting::get('password_generator_length'))->toBe('24');
+    expect(Setting::get('password_generator_character_sets'))->toBe('numbers,symbols');
+    expect(Setting::get('password_generator_avoid_ambiguous'))->toBe('0');
+
+    Livewire::actingAs($admin)
+        ->test(AdminSettings::class)
+        ->assertSet('passwordGeneratorMode', 'prefill')
+        ->assertSet('passwordLength', 24)
+        ->assertSet('passwordCharacterSets', ['numbers', 'symbols'])
+        ->assertSet('passwordAvoidAmbiguous', false);
+});
+
+test('a passphrase generator saves its words and separator and ignores the hidden character fields', function () {
+    $admin = User::query()->where('is_admin', true)->first();
+
+    Livewire::actingAs($admin)
+        ->test(AdminSettings::class)
+        ->set('passwordGeneratorType', 'passphrase')
+        ->set('passphraseWords', 8)
+        ->set('passphraseSeparator', 'space')
+        ->set('passwordLength', 3)
+        ->set('passwordCharacterSets', [])
+        ->call('saveSettings')
+        ->assertHasNoErrors();
+
+    expect(Setting::get('password_generator_type'))->toBe('passphrase');
+    expect(Setting::get('password_generator_words'))->toBe('8');
+    expect(Setting::get('password_generator_separator'))->toBe('space');
+    expect(Setting::get('password_generator_length'))->toBeNull();
+    expect(Setting::get('password_generator_character_sets'))->toBeNull();
+});
+
+test('a password generator without any kind of character is refused', function () {
+    $admin = User::query()->where('is_admin', true)->first();
+
+    Livewire::actingAs($admin)
+        ->test(AdminSettings::class)
+        ->set('passwordCharacterSets', [])
+        ->call('saveSettings')
+        ->assertHasErrors(['passwordCharacterSets' => 'Choose at least one kind of character.']);
+
+    expect(Setting::get('password_generator_character_sets'))->toBeNull();
+});
+
+test('password generator settings out of range are refused', function (string $property, mixed $value, string $rule) {
+    $admin = User::query()->where('is_admin', true)->first();
+
+    Livewire::actingAs($admin)
+        ->test(AdminSettings::class)
+        ->set('passwordGeneratorType', $property === 'passphraseWords' ? 'passphrase' : 'characters')
+        ->set($property, $value)
+        ->call('saveSettings')
+        ->assertHasErrors([$property => $rule]);
+
+    expect(Setting::get('password_generator_mode'))->toBeNull();
+})->with([
+    'an unknown mode' => ['passwordGeneratorMode', 'sometimes', 'in'],
+    'a length below 12' => ['passwordLength', 8, 'min'],
+    'a length above 64' => ['passwordLength', 65, 'max'],
+    'fewer than 4 words' => ['passphraseWords', 3, 'min'],
+]);
+
+test('the password example follows the unsaved form and disappears while the form is invalid', function () {
+    $admin = User::query()->where('is_admin', true)->first();
+
+    Livewire::actingAs($admin)
+        ->test(AdminSettings::class)
+        ->set('passwordGeneratorType', 'passphrase')
+        ->set('passphraseWords', 5)
+        ->set('passphraseSeparator', 'dot')
+        ->assertViewHas('passwordExample', fn (string $example): bool => count(explode('.', $example)) === 5)
+        ->assertViewHas('passwordEntropy', 64)
+        ->set('passphraseWords', 2)
+        ->assertViewHas('passwordExample', null)
+        ->assertDontSeeHtml('data-test="password-example"');
+});
+
+test('switching the password generator off hides its options', function () {
+    $admin = User::query()->where('is_admin', true)->first();
+
+    Livewire::actingAs($admin)
+        ->test(AdminSettings::class)
+        ->assertSeeHtml('wire:model.live="passwordGeneratorType"')
+        ->set('passwordGeneratorMode', 'off')
+        ->assertDontSeeHtml('wire:model.live="passwordGeneratorType"')
+        ->assertDontSeeHtml('data-test="password-example"');
+});

tests/Feature/FileUploadTest.php

@@ -4,7 +4,9 @@ use App\Livewire\FileUploader;
 use App\Livewire\SystemPasswordPrompt;
 use App\Models\Setting;
 use App\Models\Share;
+use App\Services\ShareService;
 use Illuminate\Http\UploadedFile;
+use Illuminate\Support\Facades\Crypt;
 use Illuminate\Support\Facades\Log;
 use Illuminate\Support\Facades\Storage;
 use Livewire\Livewire;
@@ -65,6 +67,72 @@ test('file upload with password creates password-protected share', function () {
     expect($share->isPasswordProtected())->toBeTrue();
 });
 
+test('switching password protection on leaves the field empty and offers a Generate button by default', function () {
+    $component = Livewire::test(FileUploader::class)
+        ->set('usePassword', true);
+
+    $component->assertSet('password', '')
+        ->assertSeeHtml('data-test="generate-password"')
+        ->assertSeeHtml('data-test="copy-password"');
+});
+
+test('a generated password protects the share and is flashed, encrypted, for the page the upload leads to', function () {
+    Storage::fake('shares');
+
+    $component = Livewire::test(FileUploader::class)
+        ->set('files', [UploadedFile::fake()->create('secret.txt', 512)])
+        ->set('usePassword', true)
+        ->call('generatePassword');
+    $password = $component->get('password');
+    $component->call('createShare');
+
+    $share = Share::query()->first();
+    expect($password)->toMatch('/^[A-Za-z0-9]{20}$/');
+    expect(app(ShareService::class)->verifyPassword($share, $password))->toBeTrue();
+    expect(session('share_password.token'))->toBe($share->token);
+    expect(Crypt::decryptString(session('share_password.password')))->toBe($password);
+});
+
+test('a share without a password flashes no password', function () {
+    Storage::fake('shares');
+
+    Livewire::test(FileUploader::class)
+        ->set('files', [UploadedFile::fake()->create('document.pdf', 100)])
+        ->call('createShare')
+        ->assertRedirectContains('/share/');
+
+    expect(session()->has('share_password'))->toBeFalse();
+});
+
+test('a prefilling generator fills in a password as protection is switched on', function () {
+    Setting::set('password_generator_mode', 'prefill');
+
+    $component = Livewire::test(FileUploader::class)
+        ->set('usePassword', true);
+
+    expect($component->get('password'))->toMatch('/^[A-Za-z0-9]{20}$/');
+});
+
+test('a prefilling generator keeps a password the uploader already typed', function () {
+    Setting::set('password_generator_mode', 'prefill');
+
+    Livewire::test(FileUploader::class)
+        ->set('password', 'my-own-password')
+        ->set('usePassword', true)
+        ->assertSet('password', 'my-own-password');
+});
+
+test('a generator switched off offers no Generate button and generates nothing', function () {
+    Setting::set('password_generator_mode', 'off');
+
+    Livewire::test(FileUploader::class)
+        ->set('usePassword', true)
+        ->assertDontSeeHtml('data-test="generate-password"')
+        ->assertSeeHtml('data-test="copy-password"')
+        ->call('generatePassword')
+        ->assertSet('password', '');
+});
+
 test('file upload with expiration sets expires_at', function () {
     Storage::fake('shares');
 

tests/Feature/ShareCreatedTest.php

@@ -2,6 +2,7 @@
 
 use App\Models\Share;
 use App\Services\QrCodeService;
+use Illuminate\Support\Facades\Crypt;
 
 test('the share created page offers the link as a QR code and through the share sheet', function () {
     $share = Share::factory()->create();
@@ -30,3 +31,32 @@ test('the QR code dialog reminds that a protected share also needs its password'
         ->assertOk()
         ->assertSee('Recipients also need the password.');
 });
+
+test('the uploader who just set the password can copy it beside the link, without it being on screen', function () {
+    $share = Share::factory()->withPassword()->create();
+
+    $response = $this->withSession(['share_password' => ['token' => $share->token, 'password' => Crypt::encryptString('violet-orbit-canyon')]])
+        ->get(route('share.created', $share));
+
+    $response->assertSee('data-test="share-password"', false)
+        ->assertSee('Available only this once. Send it separately from the link.');
+
+    // A masked field holding the password, with the field's copy button at its end.
+    expect($response->getContent())
+        ->toMatch('#<input(?=[^>]*value="violet-orbit-canyon")(?=[^>]*type="password")(?=[^>]*data-test="share-password")[^>]*>#')
+        ->toMatch('#data-test="share-password".*?data-md-field-copy#s');
+});
+
+test('the password is not shown without a flash for this share', function (?string $flashedFor) {
+    $share = Share::factory()->withPassword()->create();
+    $session = $flashedFor === null ? [] : ['share_password' => ['token' => $flashedFor, 'password' => Crypt::encryptString('violet-orbit-canyon')]];
+
+    $response = $this->withSession($session)->get(route('share.created', $share));
+
+    $response->assertOk()
+        ->assertDontSee('data-test="share-password"', false)
+        ->assertDontSee('violet-orbit-canyon');
+})->with([
+    'no flash (a reload or another visitor)' => [null],
+    'a flash for another share' => ['another-share-token'],
+]);