Add SealShare file sharing application with encryption, branding, auth, Docker, and Octane support
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
surtic86
co-authored by
Claude Opus 4.6
Claude Opus 4.6
parent
4790be8142
commit
e37b322dde
@@ -0,0 +1,70 @@
|
||||
<?php
|
||||
|
||||
use App\Models\Share;
|
||||
use App\Models\ShareFile;
|
||||
use App\Models\User;
|
||||
use Illuminate\Support\Facades\Storage;
|
||||
use Livewire\Livewire;
|
||||
|
||||
test('admin dashboard requires authentication', function () {
|
||||
$response = $this->get(route('admin.dashboard'));
|
||||
|
||||
$response->assertRedirect(route('login'));
|
||||
});
|
||||
|
||||
test('non-admin user cannot access admin dashboard', function () {
|
||||
$user = User::factory()->create(['is_admin' => false]);
|
||||
|
||||
$response = $this->actingAs($user)->get(route('admin.dashboard'));
|
||||
|
||||
$response->assertForbidden();
|
||||
});
|
||||
|
||||
test('admin can access dashboard', function () {
|
||||
$admin = User::query()->where('is_admin', true)->first();
|
||||
|
||||
$response = $this->actingAs($admin)->get(route('admin.dashboard'));
|
||||
|
||||
$response->assertOk();
|
||||
});
|
||||
|
||||
test('admin dashboard shows stats', function () {
|
||||
$admin = User::query()->where('is_admin', true)->first();
|
||||
|
||||
$share = Share::factory()->create(['total_size' => 1024]);
|
||||
ShareFile::factory()->create(['share_id' => $share->id]);
|
||||
|
||||
$response = $this->actingAs($admin)->get(route('admin.dashboard'));
|
||||
|
||||
$response->assertOk();
|
||||
$response->assertSee('Total Shares');
|
||||
$response->assertSee('Active Shares');
|
||||
$response->assertSee('Total Files');
|
||||
$response->assertSee('Disk Usage');
|
||||
});
|
||||
|
||||
test('admin can delete share', function () {
|
||||
Storage::fake('shares');
|
||||
|
||||
$admin = User::query()->where('is_admin', true)->first();
|
||||
|
||||
$share = Share::factory()->create();
|
||||
$shareId = $share->id;
|
||||
|
||||
Livewire::actingAs($admin)
|
||||
->test(\App\Livewire\Admin\AdminDashboard::class)
|
||||
->call('deleteShare', $shareId);
|
||||
|
||||
expect(Share::query()->find($shareId))->toBeNull();
|
||||
});
|
||||
|
||||
test('admin dashboard shows shares table', function () {
|
||||
$admin = User::query()->where('is_admin', true)->first();
|
||||
|
||||
$share = Share::factory()->create(['token' => 'testtoken12345678']);
|
||||
|
||||
$response = $this->actingAs($admin)->get(route('admin.dashboard'));
|
||||
|
||||
$response->assertOk();
|
||||
$response->assertSee('testtoken12345678');
|
||||
});
|
||||
@@ -0,0 +1,103 @@
|
||||
<?php
|
||||
|
||||
use App\Models\Setting;
|
||||
use App\Models\User;
|
||||
use Livewire\Livewire;
|
||||
|
||||
test('admin settings requires authentication', function () {
|
||||
$response = $this->get(route('admin.settings'));
|
||||
|
||||
$response->assertRedirect(route('login'));
|
||||
});
|
||||
|
||||
test('non-admin user cannot access settings', function () {
|
||||
$user = User::factory()->create(['is_admin' => false]);
|
||||
|
||||
$response = $this->actingAs($user)->get(route('admin.settings'));
|
||||
|
||||
$response->assertForbidden();
|
||||
});
|
||||
|
||||
test('admin can access settings page', function () {
|
||||
$admin = User::query()->where('is_admin', true)->first();
|
||||
|
||||
$response = $this->actingAs($admin)->get(route('admin.settings'));
|
||||
|
||||
$response->assertOk();
|
||||
});
|
||||
|
||||
test('admin can save settings', function () {
|
||||
$admin = User::query()->where('is_admin', true)->first();
|
||||
|
||||
$phpMaxMb = \App\Livewire\Admin\AdminSettings::phpMaxUploadMb();
|
||||
|
||||
Livewire::actingAs($admin)
|
||||
->test(\App\Livewire\Admin\AdminSettings::class)
|
||||
->set('maxFileSize', min(200, $phpMaxMb))
|
||||
->set('maxStorageQuota', 50)
|
||||
->set('maxFilesPerShare', 100)
|
||||
->set('maxSizePerShare', 5)
|
||||
->set('defaultExpiration', '7d')
|
||||
->call('saveSettings')
|
||||
->assertHasNoErrors();
|
||||
|
||||
expect(Setting::get('max_file_size'))->toBe((string) (min(200, $phpMaxMb) * 1024 * 1024));
|
||||
expect(Setting::get('max_storage_quota'))->toBe((string) (50 * 1024 * 1024 * 1024));
|
||||
expect(Setting::get('max_files_per_share'))->toBe('100');
|
||||
expect(Setting::get('max_size_per_share'))->toBe((string) (5 * 1024 * 1024 * 1024));
|
||||
expect(Setting::get('default_expiration'))->toBe('7d');
|
||||
});
|
||||
|
||||
test('admin can set system password', function () {
|
||||
$admin = User::query()->where('is_admin', true)->first();
|
||||
$phpMaxMb = \App\Livewire\Admin\AdminSettings::phpMaxUploadMb();
|
||||
|
||||
Livewire::actingAs($admin)
|
||||
->test(\App\Livewire\Admin\AdminSettings::class)
|
||||
->set('maxFileSize', $phpMaxMb)
|
||||
->set('systemPassword', 'new-system-password')
|
||||
->call('saveSettings')
|
||||
->assertHasNoErrors();
|
||||
|
||||
$storedPassword = Setting::get('system_password');
|
||||
expect($storedPassword)->not->toBeNull();
|
||||
expect(\Illuminate\Support\Facades\Hash::check('new-system-password', $storedPassword))->toBeTrue();
|
||||
});
|
||||
|
||||
test('admin can clear system password', function () {
|
||||
$admin = User::query()->where('is_admin', true)->first();
|
||||
|
||||
Setting::set('system_password', bcrypt('existing-password'));
|
||||
|
||||
Livewire::actingAs($admin)
|
||||
->test(\App\Livewire\Admin\AdminSettings::class)
|
||||
->call('clearSystemPassword')
|
||||
->assertHasNoErrors();
|
||||
|
||||
expect(Setting::get('system_password'))->toBeNull();
|
||||
});
|
||||
|
||||
test('settings page loads existing values', function () {
|
||||
$admin = User::query()->where('is_admin', true)->first();
|
||||
$phpMaxMb = \App\Livewire\Admin\AdminSettings::phpMaxUploadMb();
|
||||
$testSize = min(40, $phpMaxMb);
|
||||
|
||||
Setting::set('max_file_size', $testSize * 1024 * 1024);
|
||||
Setting::set('max_files_per_share', 75);
|
||||
|
||||
Livewire::actingAs($admin)
|
||||
->test(\App\Livewire\Admin\AdminSettings::class)
|
||||
->assertSet('maxFileSize', $testSize)
|
||||
->assertSet('maxFilesPerShare', 75);
|
||||
});
|
||||
|
||||
test('settings validation rejects invalid values', function () {
|
||||
$admin = User::query()->where('is_admin', true)->first();
|
||||
|
||||
Livewire::actingAs($admin)
|
||||
->test(\App\Livewire\Admin\AdminSettings::class)
|
||||
->set('maxFileSize', 0)
|
||||
->set('maxStorageQuota', 0)
|
||||
->call('saveSettings')
|
||||
->assertHasErrors(['maxFileSize', 'maxStorageQuota']);
|
||||
});
|
||||
@@ -1,21 +1,7 @@
|
||||
<?php
|
||||
|
||||
test('registration screen can be rendered', function () {
|
||||
$response = $this->get(route('register'));
|
||||
test('registration is disabled', function () {
|
||||
$response = $this->get('/register');
|
||||
|
||||
$response->assertOk();
|
||||
$response->assertNotFound();
|
||||
});
|
||||
|
||||
test('new users can register', function () {
|
||||
$response = $this->post(route('register.store'), [
|
||||
'name' => 'John Doe',
|
||||
'email' => 'test@example.com',
|
||||
'password' => 'password',
|
||||
'password_confirmation' => 'password',
|
||||
]);
|
||||
|
||||
$response->assertSessionHasNoErrors()
|
||||
->assertRedirect(route('dashboard', absolute: false));
|
||||
|
||||
$this->assertAuthenticated();
|
||||
});
|
||||
@@ -0,0 +1,60 @@
|
||||
<?php
|
||||
|
||||
use App\Models\Share;
|
||||
use Illuminate\Support\Facades\Storage;
|
||||
|
||||
test('cleanup removes expired shares', function () {
|
||||
Storage::fake('shares');
|
||||
|
||||
$expired = Share::factory()->expired()->create();
|
||||
$active = Share::factory()->expiresInHours(24)->create();
|
||||
$noExpiry = Share::factory()->create(['expires_at' => null]);
|
||||
|
||||
$this->artisan('shares:cleanup')
|
||||
->expectsOutputToContain('Cleaned up 1 expired share(s)')
|
||||
->assertExitCode(0);
|
||||
|
||||
expect(Share::query()->find($expired->id))->toBeNull();
|
||||
expect(Share::query()->find($active->id))->not->toBeNull();
|
||||
expect(Share::query()->find($noExpiry->id))->not->toBeNull();
|
||||
});
|
||||
|
||||
test('cleanup removes shares that reached download limit', function () {
|
||||
Storage::fake('shares');
|
||||
|
||||
$reachedLimit = Share::factory()->withMaxDownloads(5)->create(['download_count' => 5]);
|
||||
$underLimit = Share::factory()->withMaxDownloads(5)->create(['download_count' => 3]);
|
||||
|
||||
$this->artisan('shares:cleanup')
|
||||
->expectsOutputToContain('Cleaned up 1 expired share(s)')
|
||||
->assertExitCode(0);
|
||||
|
||||
expect(Share::query()->find($reachedLimit->id))->toBeNull();
|
||||
expect(Share::query()->find($underLimit->id))->not->toBeNull();
|
||||
});
|
||||
|
||||
test('cleanup handles no expired shares', function () {
|
||||
Storage::fake('shares');
|
||||
|
||||
Share::factory()->create(['expires_at' => null]);
|
||||
|
||||
$this->artisan('shares:cleanup')
|
||||
->expectsOutputToContain('Cleaned up 0 expired share(s)')
|
||||
->assertExitCode(0);
|
||||
});
|
||||
|
||||
test('cleanup removes both expired and download-limited shares', function () {
|
||||
Storage::fake('shares');
|
||||
|
||||
$expired = Share::factory()->expired()->create();
|
||||
$limitReached = Share::factory()->withMaxDownloads(1)->create(['download_count' => 1]);
|
||||
$active = Share::factory()->create(['expires_at' => null]);
|
||||
|
||||
$this->artisan('shares:cleanup')
|
||||
->expectsOutputToContain('Cleaned up 2 expired share(s)')
|
||||
->assertExitCode(0);
|
||||
|
||||
expect(Share::query()->find($expired->id))->toBeNull();
|
||||
expect(Share::query()->find($limitReached->id))->toBeNull();
|
||||
expect(Share::query()->find($active->id))->not->toBeNull();
|
||||
});
|
||||
@@ -0,0 +1,15 @@
|
||||
<?php
|
||||
|
||||
use App\Models\Setting;
|
||||
|
||||
test('database seeder sets default site title', function () {
|
||||
$this->seed();
|
||||
|
||||
expect(Setting::get('site_title'))->toBe('SealShare');
|
||||
});
|
||||
|
||||
test('database seeder sets default site description', function () {
|
||||
$this->seed();
|
||||
|
||||
expect(Setting::get('site_description'))->toBe('Simple, secure file sharing');
|
||||
});
|
||||
@@ -1,7 +1,7 @@
|
||||
<?php
|
||||
|
||||
test('returns a successful response', function () {
|
||||
test('home redirects to upload', function () {
|
||||
$response = $this->get(route('home'));
|
||||
|
||||
$response->assertOk();
|
||||
});
|
||||
$response->assertRedirect(route('upload'));
|
||||
});
|
||||
|
||||
@@ -0,0 +1,131 @@
|
||||
<?php
|
||||
|
||||
use App\Models\Setting;
|
||||
use App\Models\Share;
|
||||
use Illuminate\Http\UploadedFile;
|
||||
use Illuminate\Support\Facades\Storage;
|
||||
use Livewire\Livewire;
|
||||
|
||||
test('upload page can be rendered', function () {
|
||||
$response = $this->get(route('upload'));
|
||||
|
||||
$response->assertOk();
|
||||
});
|
||||
|
||||
test('upload page requires system password when configured', function () {
|
||||
Setting::set('system_password', bcrypt('system-secret'));
|
||||
|
||||
$response = $this->get(route('upload'));
|
||||
|
||||
$response->assertRedirect(route('system-password'));
|
||||
});
|
||||
|
||||
test('upload page accessible after system password verified', function () {
|
||||
Setting::set('system_password', bcrypt('system-secret'));
|
||||
|
||||
$response = $this->withSession(['system_password_verified' => true])
|
||||
->get(route('upload'));
|
||||
|
||||
$response->assertOk();
|
||||
});
|
||||
|
||||
test('file upload creates share', function () {
|
||||
Storage::fake('shares');
|
||||
|
||||
$file = UploadedFile::fake()->create('document.pdf', 1024);
|
||||
|
||||
Livewire::test(\App\Livewire\FileUploader::class)
|
||||
->set('files', [$file])
|
||||
->call('createShare')
|
||||
->assertRedirectContains('/share/');
|
||||
|
||||
expect(Share::query()->count())->toBe(1);
|
||||
|
||||
$share = Share::query()->first();
|
||||
expect($share->files)->toHaveCount(1);
|
||||
expect($share->files->first()->original_name)->toBe('document.pdf');
|
||||
});
|
||||
|
||||
test('file upload with password creates password-protected share', function () {
|
||||
Storage::fake('shares');
|
||||
|
||||
$file = UploadedFile::fake()->create('secret.txt', 512);
|
||||
|
||||
Livewire::test(\App\Livewire\FileUploader::class)
|
||||
->set('files', [$file])
|
||||
->set('usePassword', true)
|
||||
->set('password', 'my-password')
|
||||
->call('createShare')
|
||||
->assertRedirectContains('/share/');
|
||||
|
||||
$share = Share::query()->first();
|
||||
expect($share->isPasswordProtected())->toBeTrue();
|
||||
});
|
||||
|
||||
test('file upload with expiration sets expires_at', function () {
|
||||
Storage::fake('shares');
|
||||
|
||||
$file = UploadedFile::fake()->create('file.txt', 256);
|
||||
|
||||
Livewire::test(\App\Livewire\FileUploader::class)
|
||||
->set('files', [$file])
|
||||
->set('expiration', '24h')
|
||||
->call('createShare')
|
||||
->assertRedirectContains('/share/');
|
||||
|
||||
$share = Share::query()->first();
|
||||
expect($share->expires_at)->not->toBeNull();
|
||||
});
|
||||
|
||||
test('file upload with max downloads sets limit', function () {
|
||||
Storage::fake('shares');
|
||||
|
||||
$file = UploadedFile::fake()->create('file.txt', 256);
|
||||
|
||||
Livewire::test(\App\Livewire\FileUploader::class)
|
||||
->set('files', [$file])
|
||||
->set('maxDownloads', 5)
|
||||
->call('createShare')
|
||||
->assertRedirectContains('/share/');
|
||||
|
||||
$share = Share::query()->first();
|
||||
expect($share->max_downloads)->toBe(5);
|
||||
});
|
||||
|
||||
test('file upload requires at least one file', function () {
|
||||
Livewire::test(\App\Livewire\FileUploader::class)
|
||||
->set('files', [])
|
||||
->call('createShare')
|
||||
->assertHasErrors(['files']);
|
||||
});
|
||||
|
||||
test('file upload blocks when storage is full', function () {
|
||||
Storage::fake('shares');
|
||||
Setting::set('max_storage_quota', 100);
|
||||
Share::factory()->create(['total_size' => 100]);
|
||||
|
||||
$file = UploadedFile::fake()->create('file.txt', 1);
|
||||
|
||||
Livewire::test(\App\Livewire\FileUploader::class)
|
||||
->set('files', [$file])
|
||||
->call('createShare')
|
||||
->assertHasErrors(['files']);
|
||||
});
|
||||
|
||||
test('system password prompt verifies correct password', function () {
|
||||
Setting::set('system_password', bcrypt('system-secret'));
|
||||
|
||||
Livewire::test(\App\Livewire\SystemPasswordPrompt::class)
|
||||
->set('password', 'system-secret')
|
||||
->call('verify')
|
||||
->assertRedirect(route('upload'));
|
||||
});
|
||||
|
||||
test('system password prompt rejects incorrect password', function () {
|
||||
Setting::set('system_password', bcrypt('system-secret'));
|
||||
|
||||
Livewire::test(\App\Livewire\SystemPasswordPrompt::class)
|
||||
->set('password', 'wrong')
|
||||
->call('verify')
|
||||
->assertHasErrors(['password']);
|
||||
});
|
||||
@@ -0,0 +1,284 @@
|
||||
<?php
|
||||
|
||||
use App\Livewire\FileUploader;
|
||||
use App\Livewire\ShareDownload;
|
||||
use App\Models\Share;
|
||||
use App\Models\User;
|
||||
use App\Services\FileEncryptionService;
|
||||
use App\Services\ShareService;
|
||||
use Illuminate\Http\UploadedFile;
|
||||
use Illuminate\Support\Facades\RateLimiter;
|
||||
use Illuminate\Support\Facades\Storage;
|
||||
use Livewire\Livewire;
|
||||
|
||||
// --- Session stores derived key, not plaintext password ---
|
||||
|
||||
test('session stores derived encryption key instead of plaintext password', function () {
|
||||
Storage::fake('shares');
|
||||
|
||||
$service = app(ShareService::class);
|
||||
$file = UploadedFile::fake()->create('file.txt', 100);
|
||||
|
||||
$share = $service->createShare([
|
||||
['file' => $file, 'relativePath' => null],
|
||||
], [
|
||||
'password' => 'test-password-secure',
|
||||
]);
|
||||
|
||||
Livewire::test(ShareDownload::class, ['share' => $share])
|
||||
->set('password', 'test-password-secure')
|
||||
->call('verifyPassword');
|
||||
|
||||
expect(session('share_key_'.$share->token))->not->toBeNull();
|
||||
expect(session('share_key_'.$share->token))->not->toBe('test-password-secure');
|
||||
expect(strlen(session('share_key_'.$share->token)))->toBe(64);
|
||||
});
|
||||
|
||||
// --- Rate limiting on password verification ---
|
||||
|
||||
test('rate limiting blocks after 5 failed password attempts', function () {
|
||||
Storage::fake('shares');
|
||||
|
||||
$service = app(ShareService::class);
|
||||
$file = UploadedFile::fake()->create('file.txt', 100);
|
||||
|
||||
$share = $service->createShare([
|
||||
['file' => $file, 'relativePath' => null],
|
||||
], [
|
||||
'password' => 'correct-password',
|
||||
]);
|
||||
|
||||
$component = Livewire::test(ShareDownload::class, ['share' => $share]);
|
||||
|
||||
for ($i = 0; $i < 5; $i++) {
|
||||
$component->set('password', 'wrong-password')
|
||||
->call('verifyPassword')
|
||||
->assertHasErrors(['password']);
|
||||
}
|
||||
|
||||
$component->set('password', 'correct-password')
|
||||
->call('verifyPassword')
|
||||
->assertHasErrors(['password'])
|
||||
->assertSet('authenticated', false);
|
||||
});
|
||||
|
||||
test('rate limiter clears after successful password verification', function () {
|
||||
Storage::fake('shares');
|
||||
|
||||
$service = app(ShareService::class);
|
||||
$file = UploadedFile::fake()->create('file.txt', 100);
|
||||
|
||||
$share = $service->createShare([
|
||||
['file' => $file, 'relativePath' => null],
|
||||
], [
|
||||
'password' => 'correct-password',
|
||||
]);
|
||||
|
||||
$component = Livewire::test(ShareDownload::class, ['share' => $share]);
|
||||
|
||||
$component->set('password', 'wrong-password')
|
||||
->call('verifyPassword')
|
||||
->assertHasErrors(['password']);
|
||||
|
||||
$component->set('password', 'correct-password')
|
||||
->call('verifyPassword')
|
||||
->assertSet('authenticated', true);
|
||||
|
||||
$rateLimitKey = 'share-password:'.$share->token.'|127.0.0.1';
|
||||
expect(RateLimiter::remaining($rateLimitKey, 5))->toBe(5);
|
||||
});
|
||||
|
||||
// --- Share password minimum length ---
|
||||
|
||||
test('share password must be at least 8 characters', function () {
|
||||
Storage::fake('shares');
|
||||
|
||||
$file = UploadedFile::fake()->create('file.txt', 100);
|
||||
|
||||
Livewire::test(FileUploader::class)
|
||||
->set('files', [$file])
|
||||
->set('usePassword', true)
|
||||
->set('password', 'short')
|
||||
->call('createShare')
|
||||
->assertHasErrors(['password']);
|
||||
});
|
||||
|
||||
test('share password of 8 characters is accepted', function () {
|
||||
Storage::fake('shares');
|
||||
|
||||
$file = UploadedFile::fake()->create('file.txt', 100);
|
||||
|
||||
Livewire::test(FileUploader::class)
|
||||
->set('files', [$file])
|
||||
->set('usePassword', true)
|
||||
->set('password', 'longenough')
|
||||
->call('createShare')
|
||||
->assertHasNoErrors(['password']);
|
||||
});
|
||||
|
||||
// --- is_admin not mass assignable ---
|
||||
|
||||
test('is_admin is not mass assignable on User model', function () {
|
||||
$user = User::query()->create([
|
||||
'name' => 'Test User',
|
||||
'email' => 'mass-assign-test@example.com',
|
||||
'password' => bcrypt('password'),
|
||||
'is_admin' => true,
|
||||
]);
|
||||
|
||||
expect($user->is_admin)->toBeFalsy();
|
||||
});
|
||||
|
||||
// --- Setup wizard guard prevents duplicate admins ---
|
||||
|
||||
test('setup wizard createAdmin is blocked when admin already exists', function () {
|
||||
$adminCountBefore = User::query()->where('is_admin', true)->count();
|
||||
|
||||
$this->post(route('setup'), [
|
||||
'name' => 'Second Admin',
|
||||
'email' => 'second-admin@example.com',
|
||||
'password' => 'password123',
|
||||
'password_confirmation' => 'password123',
|
||||
]);
|
||||
|
||||
expect(User::query()->where('email', 'second-admin@example.com')->exists())->toBeFalse();
|
||||
expect(User::query()->where('is_admin', true)->count())->toBe($adminCountBefore);
|
||||
});
|
||||
|
||||
// --- Content-Disposition sanitization ---
|
||||
|
||||
test('content disposition handles special characters in filename', function () {
|
||||
Storage::fake('shares');
|
||||
|
||||
$service = app(ShareService::class);
|
||||
$encryptionService = app(FileEncryptionService::class);
|
||||
|
||||
$file = UploadedFile::fake()->create('normal.txt', 100);
|
||||
|
||||
$share = $service->createShare([
|
||||
['file' => $file, 'relativePath' => null],
|
||||
]);
|
||||
|
||||
$share->load('files');
|
||||
$shareFile = $share->files->first();
|
||||
|
||||
$shareFile->original_name = 'file"with"quotes.txt';
|
||||
$shareFile->save();
|
||||
|
||||
$encryptedDir = Storage::disk('shares')->path($share->token);
|
||||
if (! is_dir($encryptedDir)) {
|
||||
mkdir($encryptedDir, 0755, true);
|
||||
}
|
||||
$encryptedPath = $encryptedDir.'/'.basename($shareFile->stored_path);
|
||||
$tempSource = tempnam(sys_get_temp_dir(), 'test');
|
||||
file_put_contents($tempSource, 'test content');
|
||||
$encryptionService->encryptFile($tempSource, $encryptedPath, $share->encryption_key);
|
||||
unlink($tempSource);
|
||||
|
||||
$response = $encryptionService->decryptFileStream(
|
||||
$encryptedPath,
|
||||
$share->encryption_key,
|
||||
'file"with"quotes.txt',
|
||||
'text/plain',
|
||||
12,
|
||||
);
|
||||
|
||||
$contentDisposition = $response->headers->get('Content-Disposition');
|
||||
expect($contentDisposition)->not->toContain('file"with"quotes.txt');
|
||||
expect($contentDisposition)->toContain('attachment');
|
||||
});
|
||||
|
||||
// --- SVG upload rejected ---
|
||||
|
||||
test('svg upload is rejected for site logo', function () {
|
||||
$admin = User::query()->where('is_admin', true)->first();
|
||||
|
||||
$phpMaxMb = \App\Livewire\Admin\AdminSettings::phpMaxUploadMb();
|
||||
|
||||
Livewire::actingAs($admin)
|
||||
->test(\App\Livewire\Admin\AdminSettings::class)
|
||||
->set('maxFileSize', $phpMaxMb)
|
||||
->set('siteLogo', UploadedFile::fake()->create('logo.svg', 100, 'image/svg+xml'))
|
||||
->call('saveSettings')
|
||||
->assertHasErrors(['siteLogo']);
|
||||
});
|
||||
|
||||
// --- Relative path validation (Zip Slip prevention) ---
|
||||
|
||||
test('relative paths with directory traversal are sanitized', function () {
|
||||
Storage::fake('shares');
|
||||
|
||||
$file = UploadedFile::fake()->create('file.txt', 100);
|
||||
|
||||
Livewire::test(FileUploader::class)
|
||||
->set('files', [$file])
|
||||
->set('relativePaths', ['../../etc/passwd'])
|
||||
->call('createShare')
|
||||
->assertRedirectContains('/share/');
|
||||
|
||||
$share = Share::query()->first();
|
||||
$shareFile = $share->files->first();
|
||||
expect($shareFile->relative_path)->toBeNull();
|
||||
});
|
||||
|
||||
test('relative paths with absolute paths are sanitized', function () {
|
||||
Storage::fake('shares');
|
||||
|
||||
$file = UploadedFile::fake()->create('file.txt', 100);
|
||||
|
||||
Livewire::test(FileUploader::class)
|
||||
->set('files', [$file])
|
||||
->set('relativePaths', ['/etc/passwd'])
|
||||
->call('createShare')
|
||||
->assertRedirectContains('/share/');
|
||||
|
||||
$share = Share::query()->first();
|
||||
$shareFile = $share->files->first();
|
||||
expect($shareFile->relative_path)->toBeNull();
|
||||
});
|
||||
|
||||
test('valid relative paths are preserved', function () {
|
||||
Storage::fake('shares');
|
||||
|
||||
$file = UploadedFile::fake()->create('file.txt', 100);
|
||||
|
||||
Livewire::test(FileUploader::class)
|
||||
->set('files', [$file])
|
||||
->set('relativePaths', ['folder/subfolder/file.txt'])
|
||||
->call('createShare')
|
||||
->assertRedirectContains('/share/');
|
||||
|
||||
$share = Share::query()->first();
|
||||
$shareFile = $share->files->first();
|
||||
expect($shareFile->relative_path)->toBe('folder/subfolder/file.txt');
|
||||
});
|
||||
|
||||
// --- Security headers ---
|
||||
|
||||
test('security headers are present on responses', function () {
|
||||
$response = $this->get(route('upload'));
|
||||
|
||||
$response->assertHeader('X-Content-Type-Options', 'nosniff');
|
||||
$response->assertHeader('X-Frame-Options', 'DENY');
|
||||
$response->assertHeader('Referrer-Policy', 'strict-origin-when-cross-origin');
|
||||
$response->assertHeader('Permissions-Policy', 'camera=(), microphone=(), geolocation=()');
|
||||
});
|
||||
|
||||
// --- Token collision retry ---
|
||||
|
||||
test('share service generates unique tokens', function () {
|
||||
Storage::fake('shares');
|
||||
|
||||
$service = app(ShareService::class);
|
||||
|
||||
$shares = [];
|
||||
for ($i = 0; $i < 5; $i++) {
|
||||
$file = UploadedFile::fake()->create("file{$i}.txt", 100);
|
||||
$shares[] = $service->createShare([
|
||||
['file' => $file, 'relativePath' => null],
|
||||
]);
|
||||
}
|
||||
|
||||
$tokens = array_map(fn ($s) => $s->token, $shares);
|
||||
expect(array_unique($tokens))->toHaveCount(5);
|
||||
});
|
||||
@@ -0,0 +1,56 @@
|
||||
<?php
|
||||
|
||||
use App\Models\User;
|
||||
use Livewire\Livewire;
|
||||
|
||||
test('setup wizard renders when no admin exists', function () {
|
||||
User::query()->where('is_admin', true)->delete();
|
||||
|
||||
$response = $this->get(route('setup'));
|
||||
|
||||
$response->assertOk();
|
||||
});
|
||||
|
||||
test('setup wizard redirects to upload when admin already exists', function () {
|
||||
Livewire::test(\App\Livewire\SetupWizard::class)
|
||||
->assertRedirect(route('upload'));
|
||||
});
|
||||
|
||||
test('setup wizard creates admin user', function () {
|
||||
User::query()->where('is_admin', true)->delete();
|
||||
|
||||
Livewire::test(\App\Livewire\SetupWizard::class)
|
||||
->set('name', 'Admin User')
|
||||
->set('email', 'admin@example.com')
|
||||
->set('password', 'password123')
|
||||
->set('password_confirmation', 'password123')
|
||||
->call('createAdmin')
|
||||
->assertRedirect(route('admin.dashboard'));
|
||||
|
||||
$this->assertDatabaseHas('users', [
|
||||
'email' => 'admin@example.com',
|
||||
'is_admin' => true,
|
||||
]);
|
||||
|
||||
$admin = User::query()->where('email', 'admin@example.com')->first();
|
||||
expect($admin)->not->toBeNull();
|
||||
expect($admin->is_admin)->toBeTrue();
|
||||
});
|
||||
|
||||
test('setup wizard validates required fields', function () {
|
||||
User::query()->where('is_admin', true)->delete();
|
||||
|
||||
Livewire::test(\App\Livewire\SetupWizard::class)
|
||||
->set('name', '')
|
||||
->set('email', '')
|
||||
->set('password', '')
|
||||
->call('createAdmin')
|
||||
->assertHasErrors(['name', 'email', 'password']);
|
||||
});
|
||||
|
||||
test('all routes redirect to setup when no admin exists', function () {
|
||||
User::query()->where('is_admin', true)->delete();
|
||||
|
||||
$this->get(route('home'))->assertRedirect(route('setup'));
|
||||
$this->get(route('login'))->assertRedirect(route('setup'));
|
||||
});
|
||||
@@ -0,0 +1,138 @@
|
||||
<?php
|
||||
|
||||
use App\Models\Share;
|
||||
use App\Services\FileEncryptionService;
|
||||
use App\Services\ShareService;
|
||||
use Illuminate\Http\UploadedFile;
|
||||
use Illuminate\Support\Facades\Storage;
|
||||
use Livewire\Livewire;
|
||||
|
||||
test('share download page renders for valid share', function () {
|
||||
Storage::fake('shares');
|
||||
|
||||
$share = createShareWithFile();
|
||||
|
||||
$response = $this->get(route('share.download', $share));
|
||||
|
||||
$response->assertOk();
|
||||
});
|
||||
|
||||
test('share download page returns 404 for expired share', function () {
|
||||
$share = Share::factory()->expired()->create();
|
||||
|
||||
$response = $this->get(route('share.download', $share));
|
||||
|
||||
$response->assertNotFound();
|
||||
});
|
||||
|
||||
test('share download page returns 404 when download limit reached', function () {
|
||||
$share = Share::factory()->withMaxDownloads(1)->create(['download_count' => 1]);
|
||||
|
||||
$response = $this->get(route('share.download', $share));
|
||||
|
||||
$response->assertNotFound();
|
||||
});
|
||||
|
||||
test('share download page shows password form for password-protected share', function () {
|
||||
Storage::fake('shares');
|
||||
|
||||
$share = createShareWithFile('secret-pass');
|
||||
|
||||
$response = $this->get(route('share.download', $share));
|
||||
|
||||
$response->assertOk();
|
||||
$response->assertSee('password');
|
||||
});
|
||||
|
||||
test('password verification works for protected share', function () {
|
||||
Storage::fake('shares');
|
||||
|
||||
$share = createShareWithFile('my-password');
|
||||
|
||||
Livewire::test(\App\Livewire\ShareDownload::class, ['share' => $share])
|
||||
->assertSet('authenticated', false)
|
||||
->set('password', 'my-password')
|
||||
->call('verifyPassword')
|
||||
->assertSet('authenticated', true)
|
||||
->assertHasNoErrors();
|
||||
});
|
||||
|
||||
test('wrong password is rejected', function () {
|
||||
Storage::fake('shares');
|
||||
|
||||
$share = createShareWithFile('my-password');
|
||||
|
||||
Livewire::test(\App\Livewire\ShareDownload::class, ['share' => $share])
|
||||
->set('password', 'wrong-password')
|
||||
->call('verifyPassword')
|
||||
->assertSet('authenticated', false)
|
||||
->assertHasErrors(['password']);
|
||||
});
|
||||
|
||||
test('non-password share shows files directly', function () {
|
||||
Storage::fake('shares');
|
||||
|
||||
$share = createShareWithFile();
|
||||
|
||||
Livewire::test(\App\Livewire\ShareDownload::class, ['share' => $share])
|
||||
->assertSet('authenticated', true);
|
||||
});
|
||||
|
||||
test('download counter increments on zip download', function () {
|
||||
Storage::fake('shares');
|
||||
|
||||
$share = createShareWithFile();
|
||||
$share->load('files');
|
||||
|
||||
$encryptionService = app(FileEncryptionService::class);
|
||||
$key = $share->encryption_key;
|
||||
|
||||
foreach ($share->files as $file) {
|
||||
$dir = Storage::disk('shares')->path($share->token);
|
||||
if (! is_dir($dir)) {
|
||||
mkdir($dir, 0755, true);
|
||||
}
|
||||
$encryptedPath = $dir.'/'.basename($file->stored_path);
|
||||
$tempSource = tempnam(sys_get_temp_dir(), 'test');
|
||||
file_put_contents($tempSource, 'test content');
|
||||
$encryptionService->encryptFile($tempSource, $encryptedPath, $key);
|
||||
unlink($tempSource);
|
||||
}
|
||||
|
||||
$this->withSession(['share_password_'.$share->token => null])
|
||||
->get(route('share.download.all', $share));
|
||||
|
||||
expect($share->fresh()->download_count)->toBe(1);
|
||||
});
|
||||
|
||||
test('share auto-deletes after reaching download limit', function () {
|
||||
Storage::fake('shares');
|
||||
|
||||
$service = app(ShareService::class);
|
||||
$file = UploadedFile::fake()->create('file.txt', 100);
|
||||
|
||||
$share = $service->createShare([
|
||||
['file' => $file, 'relativePath' => null],
|
||||
], [
|
||||
'max_downloads' => 1,
|
||||
]);
|
||||
|
||||
$service->recordDownload($share);
|
||||
|
||||
expect(Share::query()->find($share->id))->toBeNull();
|
||||
});
|
||||
|
||||
/**
|
||||
* Helper to create a share with an actual encrypted file.
|
||||
*/
|
||||
function createShareWithFile(?string $password = null): Share
|
||||
{
|
||||
$service = app(ShareService::class);
|
||||
$file = UploadedFile::fake()->create('testfile.txt', 100);
|
||||
|
||||
return $service->createShare([
|
||||
['file' => $file, 'relativePath' => null],
|
||||
], [
|
||||
'password' => $password,
|
||||
]);
|
||||
}
|
||||
Reference in New Issue
Block a user