SealShare/app/Livewire/ShareDownload.php

<?php

namespace App\Livewire;

use App\Models\Share;
use App\Services\ShareService;
use Carbon\CarbonInterval;
use Illuminate\Support\Facades\RateLimiter;
use Livewire\Attributes\Layout;
use Livewire\Attributes\Locked;
use Livewire\Attributes\Renderless;
use Livewire\Attributes\Validate;
use Livewire\Component;

#[Layout('layouts.app')]
class ShareDownload extends Component
{
    public Share $share;

    /** Set only by mount() and verifyPassword(): the browser must never unlock the file list. */
    #[Locked]
    public bool $authenticated = false;

    #[Validate('required|string')]
    public string $password = '';

    public function mount(Share $share, ShareService $shareService): void
    {
        $this->share = $share->load('files');

        // A share at its download limit stays open for the recipient who took its last download.
        if (! $share->isCompleted() || $share->isExpired()
            || ($share->hasReachedDownloadLimit() && $shareService->downloadWindowEndsAt($share, session()->driver()) === null)) {
            abort(404);
        }

        $this->authenticated = ! $share->isPasswordProtected() || (bool) session('share_key_'.$share->token);
    }

    public function verifyPassword(ShareService $shareService): void
    {
        $ipKey = 'share-password:'.$this->share->token.'|'.request()->ip();
        $shareKey = 'share-password:'.$this->share->token;

        // Count before the slow hash check, so parallel requests cannot all pass a read-only check.
        $ipHits = RateLimiter::hit($ipKey, 60);
        $shareHits = RateLimiter::hit($shareKey, 60);

        if ($ipHits > 5 || $shareHits > 20) {
            $seconds = max(
                $ipHits > 5 ? RateLimiter::availableIn($ipKey) : 0,
                $shareHits > 20 ? RateLimiter::availableIn($shareKey) : 0,
            );
            $this->addError('password', __('Too many attempts. Please try again in :seconds seconds.', ['seconds' => $seconds]));

            return;
        }

        $this->validate();

        if (! $shareService->verifyPassword($this->share, $this->password)) {
            $this->addError('password', __('The password is incorrect.'));

            return;
        }

        RateLimiter::clear($ipKey);
        RateLimiter::clear($shareKey);

        $encryptionKey = $shareService->getDecryptionKey($this->share, $this->password);
        session(['share_key_'.$this->share->token => $encryptionKey]);
        $this->authenticated = true;
    }

    /**
     * The share's private text, for the recipient who pressed "Show text": counted as their
     * download, as a file would be. Returned to the browser only, never kept in a property, so it
     * is not in the component's snapshot. Null when the text is no longer available; no abort(),
     * which would open Livewire's error modal. Renderless: a re-render would morph the download
     * note Alpine just switched back into the one it hid.
     */
    #[Renderless]
    public function revealText(ShareService $shareService): ?string
    {
        $share = $this->share;

        if (! $share->isCompleted() || $share->isExpired() || ! $share->hasText()
            || ($share->isPasswordProtected() && ! session('share_key_'.$share->token))
            || ! $shareService->claimDownload($share, session()->driver())) {
            return null;
        }

        return $shareService->readText($share, $shareService->sessionDecryptionKey($share, session()->driver()));
    }

    public function render(): mixed
    {
        $shareService = app(ShareService::class);
        $files = $this->share->files->where('is_text', false)->values();

        return view('livewire.share-download', [
            'files' => $files,
            'downloads' => $files->map(fn ($file): array => [
                'id' => $file->id,
                'path' => $file->relative_path ?: $file->original_name,
                'size' => $file->file_size,
                'url' => route('share.download.file', [$this->share, $file]),
            ]),
            'hasText' => $this->share->files->contains('is_text', true),
            'downloadWindowEndsAt' => $shareService->downloadWindowEndsAt($this->share, session()->driver()),
            'remainingDownloads' => $this->share->max_downloads ? max($this->share->max_downloads - $this->share->download_count, 0) : null,
            'downloadWindow' => CarbonInterval::minutes(ShareService::DOWNLOAD_WINDOW_MINUTES)->cascade()->forHumans(),
        ]);
    }
}