Release 2.3.0

A share can now hold a private text (a password, a key, a short note)
with its files or on its own. The upload page's new "Private text" card
takes up to 100 KB; the browser encrypts the text and sends it through
the same chunk pipeline as a file, flagged is_text on share_files, so it
gets the share's password, expiry, download limit and cleanup.

The recipient sees the text only after pressing "Show text", which
counts as their download, so a messenger link preview cannot use up a
share limited to one download. The text is left out of the file list,
the ZIP and the file counts; the admin dashboard marks shares that hold
one with "Text".

The website gains a Private text feature card and a fifth phone
screenshot; every screenshot is retaken.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/Feature/Admin/AdminDashboardTest.php

@@ -139,6 +139,18 @@ test('without shares the dashboard shows an empty state instead of the list', fu
         ->assertDontSee('data-test="share-row"', false);
 });
 
+test('the shares list excludes the private text from its file count and shows it separately', function () {
+    $admin = User::query()->where('is_admin', true)->first();
+    $share = Share::factory()->create(['token' => 'textshare00000001']);
+    ShareFile::factory()->count(2)->for($share)->create();
+    ShareFile::factory()->for($share)->text()->create();
+
+    Livewire::actingAs($admin)
+        ->test(AdminDashboard::class)
+        ->assertSeeInOrder(['textshare00000001', '2 files', 'Text'])
+        ->assertDontSee('3 files');
+});
+
 test('shares whose files are still uploading are neither listed nor counted, but their bytes count as used space', function () {
     $admin = User::query()->where('is_admin', true)->first();
     $completed = Share::factory()->create(['token' => 'completedshare01', 'total_size' => 1000]);

tests/Feature/FileUploadTest.php

@@ -135,6 +135,70 @@ test('removing files takes them out of the pending share', function () {
     expect(Share::query()->sole()->total_size)->toBe(4);
 });
 
+test('registering the private text hands the browser its chunk target, like a file', function () {
+    Storage::fake('shares');
+    $component = Livewire::test(FileUploader::class);
+
+    $component->call('registerText', 20)
+        ->assertReturned(fn (?array $target): bool => $target !== null);
+
+    $file = ShareFile::query()->sole();
+    expect($file->is_text)->toBeTrue();
+    expect($file->file_size)->toBe(20);
+    expect(session('pending_shares'))->toBe([$file->share->token]);
+});
+
+test('registering the private text again replaces the earlier text row', function () {
+    Storage::fake('shares');
+    $component = Livewire::test(FileUploader::class)
+        ->call('registerText', 20);
+    $firstId = ShareFile::query()->sole()->id;
+
+    $component->call('registerText', 30);
+
+    $file = ShareFile::query()->sole();
+    expect($file->id)->not->toBe($firstId);
+    expect($file->file_size)->toBe(30);
+});
+
+test('registering the private text with 0 bytes removes it', function () {
+    Storage::fake('shares');
+    $component = Livewire::test(FileUploader::class)
+        ->call('registerText', 20);
+
+    $component->call('registerText', 0)
+        ->assertReturned(fn (?array $target): bool => $target === null);
+
+    expect(ShareFile::query()->count())->toBe(0);
+});
+
+test('a text-only pending share completes', function () {
+    Storage::fake('shares');
+    $component = Livewire::test(FileUploader::class)
+        ->call('registerText', 20);
+    $file = ShareFile::query()->sole();
+    app(ShareService::class)->storeChunk($file, 0, encryptedChunk($file, str_repeat('a', 20), 0, true));
+
+    $component->call('createShare')
+        ->assertRedirectContains('/share/');
+
+    $share = Share::query()->sole();
+    expect($share->isCompleted())->toBeTrue();
+    expect($share->files->first()->is_text)->toBeTrue();
+});
+
+test('the selected files list does not show the private text', function () {
+    Storage::fake('shares');
+    $component = Livewire::test(FileUploader::class);
+    uploadThroughPage($component, ['document.pdf' => 'the document']);
+
+    $component->call('registerText', 20);
+
+    $component->assertSeeHtml('data-test="selected-file"')
+        ->assertSee('document.pdf')
+        ->assertDontSee('text.txt');
+});
+
 test('a share cannot be created while a file is still uploading', function () {
     Storage::fake('shares');
     $component = Livewire::test(FileUploader::class)
@@ -297,7 +361,7 @@ test('file upload requires at least one file', function () {
     $component = Livewire::test(FileUploader::class)
         ->call('createShare');
 
-    expect($component->errors()->first('files'))->toBe('Please select at least one file to upload.');
+    expect($component->errors()->first('files'))->toBe('Add files or a text to share.');
     expect(Share::query()->count())->toBe(0);
 });
 

tests/Feature/ShareCreatedTest.php

@@ -2,7 +2,10 @@
 
 use App\Models\Share;
 use App\Services\QrCodeService;
+use App\Services\ShareService;
+use Illuminate\Http\UploadedFile;
 use Illuminate\Support\Facades\Crypt;
+use Illuminate\Support\Facades\Storage;
 
 test('the share created page offers the link as a QR code and through the share sheet', function () {
     $share = Share::factory()->create();
@@ -60,3 +63,20 @@ test('the password is not shown without a flash for this share', function (?stri
     'no flash (a reload or another visitor)' => [null],
     'a flash for another share' => ['another-share-token'],
 ]);
+
+test('the Private text stat shows for a share with text, and the Files stat excludes it', function () {
+    Storage::fake('shares');
+    $share = app(ShareService::class)->createShare(
+        [
+            ['file' => UploadedFile::fake()->createWithContent('one.txt', 'one'), 'relativePath' => null],
+            ['file' => UploadedFile::fake()->createWithContent('two.txt', 'two'), 'relativePath' => null],
+        ],
+        [],
+        'the secret note',
+    );
+
+    $response = $this->get(route('share.created', $share));
+
+    $response->assertOk()
+        ->assertSeeInOrder(['Files', '2', 'Private text']);
+});

tests/Feature/ShareDownloadTest.php

@@ -290,6 +290,104 @@ test('a password share created before key wrapping still unlocks and downloads',
     expect($this->get(route('share.download.file', [$share, $file]))->streamedContent())->toBe('old content');
 });
 
+test('a text-only share page shows Show text and keeps the plaintext out of the response', function () {
+    Storage::fake('shares');
+    $share = app(ShareService::class)->createShare([], [], 'the secret note');
+
+    $response = $this->get(route('share.download', $share));
+
+    $response->assertOk()
+        ->assertSeeHtml('data-test="show-text"')
+        ->assertDontSee('the secret note');
+});
+
+test('revealText returns the private text and counts one download', function () {
+    Storage::fake('shares');
+    $share = app(ShareService::class)->createShare([], [], 'the secret note');
+
+    Livewire::test(ShareDownload::class, ['share' => $share])
+        ->call('revealText')
+        ->assertReturned('the secret note');
+
+    expect($share->fresh()->download_count)->toBe(1);
+});
+
+test('a second reveal in the same window is not counted again', function () {
+    Storage::fake('shares');
+    $share = app(ShareService::class)->createShare([], [], 'the secret note');
+    $component = Livewire::test(ShareDownload::class, ['share' => $share]);
+    $component->call('revealText');
+
+    $component->call('revealText')
+        ->assertReturned('the secret note');
+
+    expect($share->fresh()->download_count)->toBe(1);
+});
+
+test('another session cannot open a text-only share whose one download was taken', function () {
+    Storage::fake('shares');
+    $share = app(ShareService::class)->createShare([], ['max_downloads' => 1], 'the secret note');
+    Livewire::test(ShareDownload::class, ['share' => $share])->call('revealText');
+    $this->flushSession();
+
+    $response = $this->get(route('share.download', $share));
+
+    $response->assertNotFound();
+});
+
+test('a password share\'s revealText returns null before unlocking and counts nothing', function () {
+    Storage::fake('shares');
+    $share = app(ShareService::class)->createShare([], ['password' => 'let-me-in'], 'the secret note');
+
+    Livewire::test(ShareDownload::class, ['share' => $share])
+        ->call('revealText')
+        ->assertReturned(null);
+
+    expect($share->fresh()->download_count)->toBe(0);
+});
+
+test('share.download.file for the text row returns 404', function () {
+    Storage::fake('shares');
+    $share = app(ShareService::class)->createShare(
+        [['file' => UploadedFile::fake()->createWithContent('notes.txt', 'file content'), 'relativePath' => null]],
+        [],
+        'the secret note',
+    );
+
+    $response = $this->get(route('share.download.file', [$share, $share->textFile]));
+
+    $response->assertNotFound();
+});
+
+test('the zip of a mixed share has only the files, not the private text', function () {
+    Storage::fake('shares');
+    $share = app(ShareService::class)->createShare(
+        [['file' => UploadedFile::fake()->createWithContent('notes.txt', 'file content'), 'relativePath' => null]],
+        [],
+        'the secret note',
+    );
+    $zipPath = tempnam(sys_get_temp_dir(), 'zip');
+
+    file_put_contents($zipPath, $this->get(route('share.download.all', $share))->streamedContent());
+
+    $zip = new ZipArchive;
+    expect($zip->open($zipPath))->toBeTrue();
+    expect($zip->numFiles)->toBe(1);
+    expect($zip->getFromName('notes.txt'))->toBe('file content');
+    expect($zip->locateName('text.txt'))->toBeFalse();
+    $zip->close();
+    unlink($zipPath);
+});
+
+test('share.download.all on a text-only share returns 404', function () {
+    Storage::fake('shares');
+    $share = app(ShareService::class)->createShare([], [], 'the secret note');
+
+    $response = $this->get(route('share.download.all', $share));
+
+    $response->assertNotFound();
+});
+
 /**
  * Helper to create a share with an actual encrypted file.
  */

tests/Feature/WebsiteTest.php

@@ -74,7 +74,7 @@ test('every file the pages, their stylesheets and the README refer to exists', f
 test('the screenshots are all there, for both themes and both widths', function () {
     $expected = collect([
         'desktop' => ['01-upload', '02-share-created', '03-qr-code', '04-download', '05-admin-dashboard', '06-admin-settings'],
-        'phone' => ['01-upload', '02-password', '03-download', '04-qr-code'],
+        'phone' => ['01-upload', '02-password', '03-download', '04-qr-code', '05-private-text'],
     ])->flatMap(fn (array $names, string $device): array => collect(['light', 'dark'])
         ->crossJoin($names, $device === 'desktop' ? [1600, 800] : [1080, 540])
         ->map(fn (array $shot): string => "{$device}/{$shot[0]}/{$shot[1]}-{$shot[2]}.webp")