Release 2.3.0

A share can now hold a private text (a password, a key, a short note)
with its files or on its own. The upload page's new "Private text" card
takes up to 100 KB; the browser encrypts the text and sends it through
the same chunk pipeline as a file, flagged is_text on share_files, so it
gets the share's password, expiry, download limit and cleanup.

The recipient sees the text only after pressing "Show text", which
counts as their download, so a messenger link preview cannot use up a
share limited to one download. The text is left out of the file list,
the ZIP and the file counts; the admin dashboard marks shares that hold
one with "Text".

The website gains a Private text feature card and a fifth phone
screenshot; every screenshot is retaken.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/Browser/ShareFlowTest.php

@@ -175,6 +175,28 @@ test('the settings Save button is end-aligned at less than the form\'s width', f
     ['/admin/settings', '[data-test="save-settings"]'],
 ]);
 
+test('a recipient reveals a share\'s private text on a phone, and the page has no popovers', function () {
+    $page = ready(visit('/upload'));
+
+    $page->type('[data-test="share-text"]', 'the wifi password is sunflower')
+        ->click('[data-test="create-share"]');
+    $page->wait(1);
+    $page->assertSee('Share Created!');
+
+    $shareUrl = $page->script('document.querySelector(\'[data-test="share-link"]\').value');
+
+    $page = ready(visit($shareUrl)->resize(393, 852));
+
+    $page->click('[data-test="show-text"]');
+    $page->wait(1);
+    $page->assertSeeIn('[data-test="shared-text"]', 'the wifi password is sunflower');
+
+    $page
+        ->assertScript("document.querySelectorAll('[popover]').length === 0")
+        ->assertScript('document.documentElement.scrollWidth <= window.innerWidth')
+        ->assertNoJavaScriptErrors();
+});
+
 test('the admin dashboard heads its shares list with an h2, both in one card', function () {
     $admin = User::factory()->admin()->create();
     Share::factory()->count(2)->create();

tests/Feature/Admin/AdminDashboardTest.php

@@ -139,6 +139,18 @@ test('without shares the dashboard shows an empty state instead of the list', fu
         ->assertDontSee('data-test="share-row"', false);
 });
 
+test('the shares list excludes the private text from its file count and shows it separately', function () {
+    $admin = User::query()->where('is_admin', true)->first();
+    $share = Share::factory()->create(['token' => 'textshare00000001']);
+    ShareFile::factory()->count(2)->for($share)->create();
+    ShareFile::factory()->for($share)->text()->create();
+
+    Livewire::actingAs($admin)
+        ->test(AdminDashboard::class)
+        ->assertSeeInOrder(['textshare00000001', '2 files', 'Text'])
+        ->assertDontSee('3 files');
+});
+
 test('shares whose files are still uploading are neither listed nor counted, but their bytes count as used space', function () {
     $admin = User::query()->where('is_admin', true)->first();
     $completed = Share::factory()->create(['token' => 'completedshare01', 'total_size' => 1000]);

tests/Feature/FileUploadTest.php

@@ -135,6 +135,70 @@ test('removing files takes them out of the pending share', function () {
     expect(Share::query()->sole()->total_size)->toBe(4);
 });
 
+test('registering the private text hands the browser its chunk target, like a file', function () {
+    Storage::fake('shares');
+    $component = Livewire::test(FileUploader::class);
+
+    $component->call('registerText', 20)
+        ->assertReturned(fn (?array $target): bool => $target !== null);
+
+    $file = ShareFile::query()->sole();
+    expect($file->is_text)->toBeTrue();
+    expect($file->file_size)->toBe(20);
+    expect(session('pending_shares'))->toBe([$file->share->token]);
+});
+
+test('registering the private text again replaces the earlier text row', function () {
+    Storage::fake('shares');
+    $component = Livewire::test(FileUploader::class)
+        ->call('registerText', 20);
+    $firstId = ShareFile::query()->sole()->id;
+
+    $component->call('registerText', 30);
+
+    $file = ShareFile::query()->sole();
+    expect($file->id)->not->toBe($firstId);
+    expect($file->file_size)->toBe(30);
+});
+
+test('registering the private text with 0 bytes removes it', function () {
+    Storage::fake('shares');
+    $component = Livewire::test(FileUploader::class)
+        ->call('registerText', 20);
+
+    $component->call('registerText', 0)
+        ->assertReturned(fn (?array $target): bool => $target === null);
+
+    expect(ShareFile::query()->count())->toBe(0);
+});
+
+test('a text-only pending share completes', function () {
+    Storage::fake('shares');
+    $component = Livewire::test(FileUploader::class)
+        ->call('registerText', 20);
+    $file = ShareFile::query()->sole();
+    app(ShareService::class)->storeChunk($file, 0, encryptedChunk($file, str_repeat('a', 20), 0, true));
+
+    $component->call('createShare')
+        ->assertRedirectContains('/share/');
+
+    $share = Share::query()->sole();
+    expect($share->isCompleted())->toBeTrue();
+    expect($share->files->first()->is_text)->toBeTrue();
+});
+
+test('the selected files list does not show the private text', function () {
+    Storage::fake('shares');
+    $component = Livewire::test(FileUploader::class);
+    uploadThroughPage($component, ['document.pdf' => 'the document']);
+
+    $component->call('registerText', 20);
+
+    $component->assertSeeHtml('data-test="selected-file"')
+        ->assertSee('document.pdf')
+        ->assertDontSee('text.txt');
+});
+
 test('a share cannot be created while a file is still uploading', function () {
     Storage::fake('shares');
     $component = Livewire::test(FileUploader::class)
@@ -297,7 +361,7 @@ test('file upload requires at least one file', function () {
     $component = Livewire::test(FileUploader::class)
         ->call('createShare');
 
-    expect($component->errors()->first('files'))->toBe('Please select at least one file to upload.');
+    expect($component->errors()->first('files'))->toBe('Add files or a text to share.');
     expect(Share::query()->count())->toBe(0);
 });
 

tests/Feature/ShareCreatedTest.php

@@ -2,7 +2,10 @@
 
 use App\Models\Share;
 use App\Services\QrCodeService;
+use App\Services\ShareService;
+use Illuminate\Http\UploadedFile;
 use Illuminate\Support\Facades\Crypt;
+use Illuminate\Support\Facades\Storage;
 
 test('the share created page offers the link as a QR code and through the share sheet', function () {
     $share = Share::factory()->create();
@@ -60,3 +63,20 @@ test('the password is not shown without a flash for this share', function (?stri
     'no flash (a reload or another visitor)' => [null],
     'a flash for another share' => ['another-share-token'],
 ]);
+
+test('the Private text stat shows for a share with text, and the Files stat excludes it', function () {
+    Storage::fake('shares');
+    $share = app(ShareService::class)->createShare(
+        [
+            ['file' => UploadedFile::fake()->createWithContent('one.txt', 'one'), 'relativePath' => null],
+            ['file' => UploadedFile::fake()->createWithContent('two.txt', 'two'), 'relativePath' => null],
+        ],
+        [],
+        'the secret note',
+    );
+
+    $response = $this->get(route('share.created', $share));
+
+    $response->assertOk()
+        ->assertSeeInOrder(['Files', '2', 'Private text']);
+});

tests/Feature/ShareDownloadTest.php

@@ -290,6 +290,104 @@ test('a password share created before key wrapping still unlocks and downloads',
     expect($this->get(route('share.download.file', [$share, $file]))->streamedContent())->toBe('old content');
 });
 
+test('a text-only share page shows Show text and keeps the plaintext out of the response', function () {
+    Storage::fake('shares');
+    $share = app(ShareService::class)->createShare([], [], 'the secret note');
+
+    $response = $this->get(route('share.download', $share));
+
+    $response->assertOk()
+        ->assertSeeHtml('data-test="show-text"')
+        ->assertDontSee('the secret note');
+});
+
+test('revealText returns the private text and counts one download', function () {
+    Storage::fake('shares');
+    $share = app(ShareService::class)->createShare([], [], 'the secret note');
+
+    Livewire::test(ShareDownload::class, ['share' => $share])
+        ->call('revealText')
+        ->assertReturned('the secret note');
+
+    expect($share->fresh()->download_count)->toBe(1);
+});
+
+test('a second reveal in the same window is not counted again', function () {
+    Storage::fake('shares');
+    $share = app(ShareService::class)->createShare([], [], 'the secret note');
+    $component = Livewire::test(ShareDownload::class, ['share' => $share]);
+    $component->call('revealText');
+
+    $component->call('revealText')
+        ->assertReturned('the secret note');
+
+    expect($share->fresh()->download_count)->toBe(1);
+});
+
+test('another session cannot open a text-only share whose one download was taken', function () {
+    Storage::fake('shares');
+    $share = app(ShareService::class)->createShare([], ['max_downloads' => 1], 'the secret note');
+    Livewire::test(ShareDownload::class, ['share' => $share])->call('revealText');
+    $this->flushSession();
+
+    $response = $this->get(route('share.download', $share));
+
+    $response->assertNotFound();
+});
+
+test('a password share\'s revealText returns null before unlocking and counts nothing', function () {
+    Storage::fake('shares');
+    $share = app(ShareService::class)->createShare([], ['password' => 'let-me-in'], 'the secret note');
+
+    Livewire::test(ShareDownload::class, ['share' => $share])
+        ->call('revealText')
+        ->assertReturned(null);
+
+    expect($share->fresh()->download_count)->toBe(0);
+});
+
+test('share.download.file for the text row returns 404', function () {
+    Storage::fake('shares');
+    $share = app(ShareService::class)->createShare(
+        [['file' => UploadedFile::fake()->createWithContent('notes.txt', 'file content'), 'relativePath' => null]],
+        [],
+        'the secret note',
+    );
+
+    $response = $this->get(route('share.download.file', [$share, $share->textFile]));
+
+    $response->assertNotFound();
+});
+
+test('the zip of a mixed share has only the files, not the private text', function () {
+    Storage::fake('shares');
+    $share = app(ShareService::class)->createShare(
+        [['file' => UploadedFile::fake()->createWithContent('notes.txt', 'file content'), 'relativePath' => null]],
+        [],
+        'the secret note',
+    );
+    $zipPath = tempnam(sys_get_temp_dir(), 'zip');
+
+    file_put_contents($zipPath, $this->get(route('share.download.all', $share))->streamedContent());
+
+    $zip = new ZipArchive;
+    expect($zip->open($zipPath))->toBeTrue();
+    expect($zip->numFiles)->toBe(1);
+    expect($zip->getFromName('notes.txt'))->toBe('file content');
+    expect($zip->locateName('text.txt'))->toBeFalse();
+    $zip->close();
+    unlink($zipPath);
+});
+
+test('share.download.all on a text-only share returns 404', function () {
+    Storage::fake('shares');
+    $share = app(ShareService::class)->createShare([], [], 'the secret note');
+
+    $response = $this->get(route('share.download.all', $share));
+
+    $response->assertNotFound();
+});
+
 /**
  * Helper to create a share with an actual encrypted file.
  */

tests/Feature/WebsiteTest.php

@@ -74,7 +74,7 @@ test('every file the pages, their stylesheets and the README refer to exists', f
 test('the screenshots are all there, for both themes and both widths', function () {
     $expected = collect([
         'desktop' => ['01-upload', '02-share-created', '03-qr-code', '04-download', '05-admin-dashboard', '06-admin-settings'],
-        'phone' => ['01-upload', '02-password', '03-download', '04-qr-code'],
+        'phone' => ['01-upload', '02-password', '03-download', '04-qr-code', '05-private-text'],
     ])->flatMap(fn (array $names, string $device): array => collect(['light', 'dark'])
         ->crossJoin($names, $device === 'desktop' ? [1600, 800] : [1080, 540])
         ->map(fn (array $shot): string => "{$device}/{$shot[0]}/{$shot[1]}-{$shot[2]}.webp")

tests/Screenshots/DemoData.php

@@ -27,6 +27,9 @@ final class DemoData
     /** The share the desktop upload creates, so its link and QR code read the same on every run. */
     public const CREATED_TOKEN = 'Tf8gH2jK4mN6pQ3r';
 
+    /** The share holding only a private text, shown on the phone once the recipient asks for it. */
+    public const TEXT_TOKEN = 'Vx9bN4mQ7kR2tW5s';
+
     public static function admin(): User
     {
         return User::factory()->admin()->create([
@@ -36,8 +39,8 @@ final class DemoData
     }
 
     /**
-     * Eight shares of different ages, sizes and states: one expired, two password-protected, some
-     * with a download limit, some never expiring.
+     * Nine shares of different ages, sizes and states: one expired, two password-protected, some
+     * with a download limit, some never expiring, and one holding only a private text.
      */
     public static function shares(): void
     {
@@ -58,6 +61,8 @@ final class DemoData
                 'files' => ['Onboarding/Welcome.pdf' => 520, 'Onboarding/Handbook.pdf' => 2900, 'Onboarding/IT checklist.docx' => 130]],
             ['token' => 'Ae6fG7hJ8kL9mN1p', 'daysAgo' => 40, 'expiresAfterDays' => 10, 'downloads' => 12, 'options' => [],
                 'files' => ['Event photos.zip' => 15700]],
+            ['token' => self::TEXT_TOKEN, 'daysAgo' => 3, 'expiresAfterDays' => 7, 'downloads' => 0, 'options' => ['max_downloads' => 1],
+                'files' => [], 'text' => "Guest Wi-Fi for the workshop\n\nNetwork: Harbour-Guest\nPassword: maple-lantern-8127\n\nIt works in meeting rooms 2 and 3."],
         ];
 
         foreach ($shares as $share) {
@@ -69,7 +74,7 @@ final class DemoData
      * @param  array{password?: string, max_downloads?: int}  $options
      * @param  array<string, int>  $files  relative path => size in kilobytes
      */
-    private static function share(string $token, int $daysAgo, ?int $expiresAfterDays, int $downloads, array $options, array $files): void
+    private static function share(string $token, int $daysAgo, ?int $expiresAfterDays, int $downloads, array $options, array $files, ?string $text = null): void
     {
         $createdAt = Carbon::now()->subDays($daysAgo)->subHours(2);
 
@@ -82,6 +87,7 @@ final class DemoData
                     'relativePath' => str_contains($path, '/') ? $path : null,
                 ])->values()->all(),
                 [...$options, 'expires_at' => $expiresAfterDays === null ? null : $createdAt->copy()->addDays($expiresAfterDays)],
+                $text,
             );
         } finally {
             Str::createRandomStringsNormally();

tests/Screenshots/ScreenshotsTest.php

@@ -115,13 +115,15 @@ test('desktop', function (string $theme) use ($files) {
     $upload = visit('/upload');
     $page = shotPage($upload, 'desktop', $theme);
     selectFiles($page, $files);
+    // Creating the share sends this text through the page's own upload before the share is created.
+    $page->type('[data-test="share-text"]', 'The signed contract is in the folder. Call me on +41 44 555 01 23 if anything is missing.');
     $page->click('label:has-text("Password protect")')
         ->click('[data-test="generate-password"]')
         ->wait(1)
         ->assertScript("document.querySelector('input[autocomplete=\"new-password\"]').value.length > 0");
     $page->type('input[wire\:model="maxDownloads"]', '5');
-    // The drop zone, the files and the options fill the window; typing left the page wherever it scrolled.
-    $page->script("document.activeElement?.blur(); window.scrollTo(0, document.querySelector('[data-test=drop-zone]').getBoundingClientRect().top + window.scrollY - 24)");
+    // The foot of the drop zone, the files, the text and the password fill the window; typing left the page wherever it scrolled.
+    $page->script("document.activeElement?.blur(); window.scrollTo(0, document.querySelector('[data-test=drop-zone]').getBoundingClientRect().bottom + window.scrollY - 80)");
     shoot($page, 'desktop', $theme, '01-upload');
 
     // Creating the share is what offers the password once more beside the link.
@@ -135,7 +137,7 @@ test('desktop', function (string $theme) use ($files) {
         ->assertScript("document.querySelector('[data-test=\"qr-code-dialog\"]').open");
     shoot($page, 'desktop', $theme, '03-qr-code', DemoData::CREATED_TOKEN);
 
-    // The dashboard shows the eight demo shares, as before.
+    // The dashboard shows the nine demo shares, as before.
     app(ShareService::class)->deleteShare(Share::query()->where('token', DemoData::CREATED_TOKEN)->firstOrFail());
 
     $download = visit(route('share.download', DemoData::DELIVERY_TOKEN, false));
@@ -172,4 +174,12 @@ test('phone', function (string $theme) use ($files) {
     $page->click('[data-test="show-qr-code"]')
         ->assertScript("document.querySelector('[data-test=\"qr-code-dialog\"]').open");
     shoot($page, 'phone', $theme, '04-qr-code');
+
+    // The text is fetched only when the recipient asks for it.
+    $text = visit(route('share.download', DemoData::TEXT_TOKEN, false));
+    $page = shotPage($text, 'phone', $theme);
+    $page->click('[data-test="show-text"]')
+        ->waitForText('maple-lantern-8127')
+        ->assertVisible('[data-test="shared-text"]');
+    shoot($page, 'phone', $theme, '05-private-text', DemoData::TEXT_TOKEN);
 })->with(['light', 'dark']);

tests/Unit/ShareServiceTest.php

@@ -332,7 +332,7 @@ test('completing a share without files is rejected', function () {
     $share = Share::factory()->pending()->create();
 
     expect(fn () => $this->service->completeShare($share))
-        ->toThrow(ValidationException::class, 'Please select at least one file to upload.');
+        ->toThrow(ValidationException::class, 'Add files or a text to share.');
 });
 
 test('completing a share with a password wraps its data key instead of storing it', function () {
@@ -355,3 +355,47 @@ test('create share stores an empty file', function () {
     expect($share->files->first()->completed_at)->not->toBeNull();
     expect(filesize($this->service->storedFilePath($share->files->first())))->toBe(FileEncryptionService::HEADER_LENGTH + FileEncryptionService::TAG_LENGTH);
 });
+
+test('a private text over the maximum length is rejected', function () {
+    $text = str_repeat('a', ShareFile::MAX_TEXT_BYTES + 1);
+
+    expect(fn () => $this->service->registerFile(null, 'text.txt', strlen($text), null, isText: true))
+        ->toThrow(ValidationException::class, 'The text is too long (maximum 100 KB).');
+    expect(Share::query()->count())->toBe(0);
+});
+
+test('a private text does not count against the admin limit of files per share', function () {
+    Setting::set('max_files_per_share', 1);
+    $file = $this->service->registerFile(null, 'one.txt', 10, null);
+
+    $text = $this->service->registerFile($file->share, 'text.txt', 20, null, isText: true);
+
+    expect($text->share_id)->toBe($file->share_id);
+    expect(ShareFile::query()->count())->toBe(2);
+});
+
+test('create share with no files and a text completes a text-only share', function () {
+    $share = $this->service->createShare([], [], 'hi');
+
+    expect($share->isCompleted())->toBeTrue();
+    expect($share->files)->toHaveCount(1);
+    expect($share->files->first()->is_text)->toBeTrue();
+    expect($share->total_size)->toBe(2);
+});
+
+test('readText decrypts a share\'s private text without a password', function () {
+    $share = $this->service->createShare([], [], 'the secret note');
+
+    $text = $this->service->readText($share, $share->encryption_key);
+
+    expect($text)->toBe('the secret note');
+});
+
+test('readText decrypts a share\'s private text with the unwrapped key of a password share', function () {
+    $share = $this->service->createShare([], ['password' => 'a-long-password'], 'the secret note');
+    $key = $this->service->getDecryptionKey($share, 'a-long-password');
+
+    $text = $this->service->readText($share, $key);
+
+    expect($text)->toBe('the secret note');
+});