Add SealShare file sharing application with encryption, branding, auth, Docker, and Octane support

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

app/Http/Controllers/DownloadController.php

@@ -0,0 +1,97 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Models\Share;
+use App\Models\ShareFile;
+use App\Services\FileEncryptionService;
+use App\Services\ShareService;
+use Illuminate\Support\Facades\Storage;
+use Symfony\Component\HttpFoundation\StreamedResponse;
+use ZipStream\ZipStream;
+
+class DownloadController extends Controller
+{
+    public function __construct(
+        private FileEncryptionService $encryptionService,
+        private ShareService $shareService,
+    ) {}
+
+    /**
+     * Download all files as a ZIP archive.
+     */
+    public function download(Share $share): StreamedResponse
+    {
+        abort_if($share->isExpired() || $share->hasReachedDownloadLimit(), 404);
+
+        $share->load('files');
+        $key = $this->resolveDecryptionKey($share);
+
+        $this->shareService->recordDownload($share);
+
+        return new StreamedResponse(function () use ($share, $key): void {
+            $zip = new ZipStream(
+                outputName: 'share-'.$share->token.'.zip',
+                sendHttpHeaders: false,
+            );
+
+            foreach ($share->files as $file) {
+                $encryptedPath = Storage::disk('shares')->path($share->token.'/'.basename($file->stored_path));
+                $callback = $this->encryptionService->decryptFileToCallback($encryptedPath, $key);
+
+                $filename = $file->relative_path ?: $file->original_name;
+                $filename = str_replace('\\', '/', $filename);
+
+                if (str_starts_with($filename, '/') || str_contains($filename, '..')) {
+                    $filename = basename($filename);
+                }
+
+                $zip->addFileFromCallback(fileName: $filename, callback: $callback, exactSize: $file->file_size);
+            }
+
+            $zip->finish();
+        }, 200, [
+            'Content-Type' => 'application/zip',
+            'Content-Disposition' => 'attachment; filename="share-'.$share->token.'.zip"',
+        ]);
+    }
+
+    /**
+     * Download a single file.
+     */
+    public function downloadFile(Share $share, ShareFile $shareFile): StreamedResponse
+    {
+        abort_if($share->isExpired() || $share->hasReachedDownloadLimit(), 404);
+        abort_if($shareFile->share_id !== $share->id, 404);
+
+        $key = $this->resolveDecryptionKey($share);
+
+        $this->shareService->recordDownload($share);
+
+        $encryptedPath = Storage::disk('shares')->path($share->token.'/'.basename($shareFile->stored_path));
+
+        return $this->encryptionService->decryptFileStream(
+            $encryptedPath,
+            $key,
+            $shareFile->original_name,
+            $shareFile->mime_type ?? 'application/octet-stream',
+            $shareFile->file_size,
+        );
+    }
+
+    /**
+     * Resolve the decryption key from session or share.
+     */
+    private function resolveDecryptionKey(Share $share): string
+    {
+        if ($share->isPasswordProtected()) {
+            $key = session('share_key_'.$share->token);
+
+            abort_if(! $key, 403, 'Password required');
+
+            return $key;
+        }
+
+        return $this->shareService->getDecryptionKey($share);
+    }
+}

app/Http/Middleware/EnsureAdmin.php

@@ -0,0 +1,19 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpFoundation\Response;
+
+class EnsureAdmin
+{
+    public function handle(Request $request, Closure $next): Response
+    {
+        if (! $request->user() || ! $request->user()->is_admin) {
+            abort(403);
+        }
+
+        return $next($request);
+    }
+}

app/Http/Middleware/EnsureSetupComplete.php

@@ -0,0 +1,20 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use App\Models\User;
+use Closure;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpFoundation\Response;
+
+class EnsureSetupComplete
+{
+    public function handle(Request $request, Closure $next): Response
+    {
+        if (! User::query()->where('is_admin', true)->exists() && ! $request->is('setup', 'setup/*', 'livewire*')) {
+            return redirect()->route('setup');
+        }
+
+        return $next($request);
+    }
+}

app/Http/Middleware/SecurityHeaders.php

@@ -0,0 +1,27 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpFoundation\Response;
+
+class SecurityHeaders
+{
+    /**
+     * Handle an incoming request.
+     *
+     * @param  \Closure(\Illuminate\Http\Request): (\Symfony\Component\HttpFoundation\Response)  $next
+     */
+    public function handle(Request $request, Closure $next): Response
+    {
+        $response = $next($request);
+
+        $response->headers->set('X-Content-Type-Options', 'nosniff');
+        $response->headers->set('X-Frame-Options', 'DENY');
+        $response->headers->set('Referrer-Policy', 'strict-origin-when-cross-origin');
+        $response->headers->set('Permissions-Policy', 'camera=(), microphone=(), geolocation=()');
+
+        return $response;
+    }
+}

app/Http/Middleware/SystemPasswordGate.php

@@ -0,0 +1,26 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use App\Models\Setting;
+use Closure;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpFoundation\Response;
+
+class SystemPasswordGate
+{
+    public function handle(Request $request, Closure $next): Response
+    {
+        $systemPassword = Setting::get('system_password');
+
+        if (! $systemPassword) {
+            return $next($request);
+        }
+
+        if ($request->session()->get('system_password_verified') === true) {
+            return $next($request);
+        }
+
+        return redirect()->route('system-password');
+    }
+}