Fix the security audit's findings

Fixes the nine findings of security audit run 1 on 2.4.1 (T1-T11).

F1: Uploads that are not complete now count only the bytes the server
received, and a chunk that goes above the storage quota gets 422. An
anonymous uploader can no longer fill the quota with declared sizes.

F2: The share password and the admin login have a second limit without
the address (20 attempts per minute per share and per e-mail), because
a forged X-Forwarded-For changes the address.

F3: The system password gate and the admin check now also run on
Livewire updates, so an old uploader snapshot cannot register files.

F4: The session keeps a fingerprint of the system password's hash.
When the admin changes the system password, earlier verifications end.

F5: The page after the upload opens only in the session that created
the share, and only while recipients can still reach the share.

F6: The share password limit counts an attempt before the password is
checked, so parallel attempts cannot pass it.

F7: The system password has the same two limits (5 per address, 20 in
total per minute).

F8: A password change or reset signs the user's other sessions out.

F9: The only admin cannot delete the account, which would open /setup
to every visitor.

The setup wizard also holds the admin password to the password
defaults, and Livewire applies EnsureAdmin to updates.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/Feature/Settings/PasswordUpdateTest.php

@@ -1,9 +1,41 @@
 <?php
 
 use App\Models\User;
+use Illuminate\Support\Facades\Auth;
 use Illuminate\Support\Facades\Hash;
+use Illuminate\Support\Facades\Password;
 use Livewire\Livewire;
 
+/**
+ * Drop the guards and the session store, so the next request authenticates from its cookie only.
+ */
+function forgetRequestState(): void
+{
+    Auth::forgetGuards();
+    app('session')->forgetDrivers();
+    app()->forgetInstance('session.store');
+    test()->flushSession();
+}
+
+/**
+ * Sign the admin in on a database session, use it once as an admin would, and return its ID.
+ */
+function signedInAdminSessionId(User $admin): string
+{
+    config(['session.driver' => 'database']);
+
+    $sessionId = test()->post(route('login.store'), ['email' => $admin->email, 'password' => 'Old-Password-1!'])
+        ->assertRedirect()
+        ->getCookie(config('session.cookie'))
+        ->getValue();
+
+    forgetRequestState();
+    test()->withCookie(config('session.cookie'), $sessionId)->get(route('admin.dashboard'))->assertOk();
+    forgetRequestState();
+
+    return $sessionId;
+}
+
 test('password can be updated', function () {
     $user = User::factory()->create([
         'password' => Hash::make('password'),
@@ -38,3 +70,65 @@ test('correct password must be provided to update password', function () {
 
     $response->assertHasErrors(['current_password']);
 });
+
+test('changing the password signs the user\'s other sessions out', function () {
+    $admin = User::factory()->admin()->create(['password' => Hash::make('Old-Password-1!')]);
+    $sessionId = signedInAdminSessionId($admin);
+
+    Livewire::actingAs($admin)->test('pages::settings.password')
+        ->set('current_password', 'Old-Password-1!')
+        ->set('password', 'New-Password-2!xY')
+        ->set('password_confirmation', 'New-Password-2!xY')
+        ->call('updatePassword')
+        ->assertHasNoErrors();
+    forgetRequestState();
+
+    $this->withCookie(config('session.cookie'), $sessionId)
+        ->get(route('admin.dashboard'))
+        ->assertRedirect(route('login'));
+});
+
+test('resetting the password signs the user\'s sessions out', function () {
+    $admin = User::factory()->admin()->create(['password' => Hash::make('Old-Password-1!')]);
+    $sessionId = signedInAdminSessionId($admin);
+
+    // The reset comes from a browser that is not signed in, without the session's cookie.
+    $this->defaultCookies = [];
+    $this->post(route('password.update'), [
+        'token' => Password::broker()->createToken($admin),
+        'email' => $admin->email,
+        'password' => 'New-Password-3!xY',
+        'password_confirmation' => 'New-Password-3!xY',
+    ])->assertSessionHasNoErrors();
+    forgetRequestState();
+
+    $this->withCookie(config('session.cookie'), $sessionId)
+        ->get(route('admin.dashboard'))
+        ->assertRedirect(route('login'));
+});
+
+test('the session that changes the password stays signed in', function () {
+    $admin = User::factory()->admin()->create(['password' => Hash::make('Old-Password-1!')]);
+    $sessionId = signedInAdminSessionId($admin);
+
+    preg_match('/wire:snapshot="([^"]+)"/', $this->withCookie(config('session.cookie'), $sessionId)->get(route('user-password.edit'))->assertOk()->getContent(), $matches);
+    forgetRequestState();
+
+    $this->withCookie(config('session.cookie'), $sessionId)
+        ->withCredentials()
+        ->withHeaders(['X-Livewire' => '1'])
+        ->postJson(app('livewire')->getUpdateUri(), [
+            'components' => [[
+                'snapshot' => htmlspecialchars_decode($matches[1], ENT_QUOTES),
+                'updates' => ['current_password' => 'Old-Password-1!', 'password' => 'New-Password-2!xY', 'password_confirmation' => 'New-Password-2!xY'],
+                'calls' => [['method' => 'updatePassword', 'params' => [], 'path' => '']],
+            ]],
+        ])
+        ->assertOk();
+    expect(Hash::check('New-Password-2!xY', $admin->refresh()->password))->toBeTrue();
+    forgetRequestState();
+
+    $this->withCookie(config('session.cookie'), $sessionId)
+        ->get(route('admin.dashboard'))
+        ->assertOk();
+});

tests/Feature/Settings/ProfileUpdateTest.php

@@ -74,3 +74,40 @@ test('correct password must be provided to delete account', function () {
 
     expect($user->fresh())->not->toBeNull();
 });
+
+test('the only admin cannot delete their account', function () {
+    $admin = User::query()->where('is_admin', true)->sole();
+
+    $this->actingAs($admin);
+
+    Livewire::test('pages::settings.delete-user-form')
+        ->set('password', 'password')
+        ->call('deleteUser')
+        ->assertHasErrors(['password'])
+        ->assertNoRedirect();
+
+    expect($admin->fresh())->not->toBeNull();
+    expect(auth()->check())->toBeTrue();
+});
+
+test('an admin can delete their account while another admin remains', function () {
+    $admin = User::factory()->admin()->create();
+
+    $this->actingAs($admin);
+
+    Livewire::test('pages::settings.delete-user-form')
+        ->set('password', 'password')
+        ->call('deleteUser')
+        ->assertHasNoErrors()
+        ->assertRedirect('/');
+
+    expect($admin->fresh())->toBeNull();
+});
+
+test('the only admin\'s account card explains why it cannot be deleted instead of offering the button', function () {
+    $this->actingAs(User::query()->where('is_admin', true)->sole());
+
+    Livewire::test('pages::settings.delete-user-form')
+        ->assertSee('You are the only admin, so this account cannot be deleted.')
+        ->assertDontSee('data-test="delete-user-button"', false);
+});