Send new artwork uploads through a trust-based review policy.

Require review for untrusted accounts, add admin artwork review APIs, and keep queued or auto-trusted publishes from counting as established history.
2026-09-20 14:49:06 +02:00
parent 31c87e4977
commit 0f52803b05
14 changed files with 1175 additions and 70 deletions
@@ -0,0 +1,138 @@
+<?php
+
+use App\Jobs\IndexArtworkJob;
+use App\Models\Artwork;
+use App\Models\Category;
+use App\Models\ContentType;
+use App\Models\Notification;
+use App\Models\Tag;
+use App\Models\User;
+use App\Services\ThumbnailService;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Queue;
+
+uses(RefreshDatabase::class);
+
+it('lists pending artworks with title, description, tags and preview', function () {
+    $admin = User::factory()->create(['role' => 'admin']);
+    $owner = User::factory()->create(['username' => 'mira']);
+    $hash = 'aabbccddeeff1122';
+
+    $artwork = Artwork::factory()->for($owner)->unapproved()->unpublished()->create([
+        'title' => 'Forest Spirit',
+        'description' => 'A mossy guardian in fog.',
+        'hash' => $hash,
+        'thumb_ext' => 'webp',
+        'artwork_status' => 'review',
+        'is_public' => false,
+        'moderation_note' => 'new_account, low_level',
+    ]);
+
+    $contentType = ContentType::query()->create([
+        'name' => 'Illustration',
+        'slug' => 'illustration-moderation-type',
+        'description' => '',
+    ]);
+    $category = Category::query()->create([
+        'content_type_id' => $contentType->id,
+        'parent_id' => null,
+        'name' => 'Illustration',
+        'slug' => 'illustration-moderation',
+        'description' => null,
+        'image' => null,
+        'is_active' => true,
+        'sort_order' => 0,
+    ]);
+    $artwork->categories()->attach($category->id);
+
+    $tag = Tag::query()->create(['name' => 'forest', 'slug' => 'forest', 'is_active' => true]);
+    $artwork->tags()->attach($tag->id, ['source' => 'user', 'confidence' => 1.0]);
+
+    $response = $this->actingAs($admin)->getJson('/api/admin/artwork-review/pending');
+
+    $response->assertOk()
+        ->assertJsonPath('data.0.id', $artwork->id)
+        ->assertJsonPath('data.0.title', 'Forest Spirit')
+        ->assertJsonPath('data.0.description', 'A mossy guardian in fog.')
+        ->assertJsonPath('data.0.tags.0', 'forest')
+        ->assertJsonPath('data.0.categories.0', 'Illustration')
+        ->assertJsonPath('data.0.user.username', 'mira')
+        ->assertJsonPath('data.0.preview_url', ThumbnailService::fromHash($hash, 'webp', 'md'))
+        ->assertJsonPath('data.0.preview_lg_url', ThumbnailService::fromHash($hash, 'webp', 'lg'));
+});
+
+it('approves a pending artwork', function () {
+    Queue::fake();
+
+    $admin = User::factory()->create(['role' => 'moderator']);
+    $artwork = Artwork::factory()->unapproved()->unpublished()->create([
+        'artwork_status' => 'review',
+        'is_public' => false,
+        'visibility' => Artwork::VISIBILITY_PUBLIC,
+    ]);
+
+    $response = $this->actingAs($admin)->postJson("/api/admin/artwork-review/{$artwork->id}/approve", [
+        'note' => 'Looks good.',
+    ]);
+
+    $response->assertOk()->assertJsonPath('status', 'published');
+
+    $artwork->refresh();
+    expect($artwork->artwork_status)->toBe('published');
+    expect($artwork->is_approved)->toBeTrue();
+    expect($artwork->is_public)->toBeTrue();
+    expect($artwork->moderation_note)->toBe('Looks good.');
+    expect((int) $artwork->moderated_by)->toBe((int) $admin->id);
+
+    $notice = Notification::query()
+        ->where('user_id', $artwork->user_id)
+        ->where('type', 'artwork_approved')
+        ->first();
+
+    expect($notice)->not->toBeNull()
+        ->and($notice->data['message'] ?? null)->toContain('was approved and is now live')
+        ->and($notice->data['artwork_id'] ?? null)->toBe($artwork->id);
+
+    Queue::assertPushed(IndexArtworkJob::class);
+});
+
+it('rejects a pending artwork', function () {
+    Queue::fake();
+
+    $admin = User::factory()->create(['role' => 'admin']);
+    $artwork = Artwork::factory()->unapproved()->unpublished()->create([
+        'artwork_status' => 'review',
+        'is_public' => false,
+    ]);
+
+    $response = $this->actingAs($admin)->postJson("/api/admin/artwork-review/{$artwork->id}/reject", [
+        'note' => 'Low quality.',
+    ]);
+
+    $response->assertOk()->assertJsonPath('status', 'rejected');
+
+    $artwork->refresh();
+    expect($artwork->artwork_status)->toBe('rejected');
+    expect($artwork->is_approved)->toBeFalse();
+    expect($artwork->is_public)->toBeFalse();
+    expect($artwork->moderation_note)->toBe('Low quality.');
+
+    $notice = Notification::query()
+        ->where('user_id', $artwork->user_id)
+        ->where('type', 'artwork_rejected')
+        ->first();
+
+    expect($notice)->not->toBeNull()
+        ->and($notice->data['message'] ?? null)->toContain('was not approved')
+        ->and($notice->data['message'] ?? null)->toContain('Low quality.');
+
+    Queue::assertPushed(IndexArtworkJob::class);
+});
+
+it('denies artwork review access to regular users', function () {
+    $user = User::factory()->create(['role' => 'user']);
+
+    $this->actingAs($user)
+        ->getJson('/api/admin/artwork-review/pending')
+        ->assertStatus(403);
+});
@@ -76,13 +76,41 @@ it('admin sees pending uploads', function () {
    $owner = User::factory()->create();
    $categoryId = createModerationCategory();

-    createModerationDraft($owner->id, $categoryId, ['title' => 'First Pending']);
+    createModerationDraft($owner->id, $categoryId, [
+        'title' => 'First Pending',
+        'description' => 'A spring garden scene.',
+        'tags' => json_encode(['tulip', 'garden']),
+    ]);
    createModerationDraft($owner->id, $categoryId, ['title' => 'Second Pending']);

    $response = $this->actingAs($admin)->getJson('/api/admin/uploads/pending');

    $response->assertOk();
    $response->assertJsonCount(2, 'data');
+    $response->assertJsonPath('data.0.title', 'First Pending');
+    $response->assertJsonPath('data.0.description', 'A spring garden scene.');
+    $response->assertJsonPath('data.0.tags.0', 'tulip');
+    expect($response->json('data.0.preview_url'))->toContain('/api/admin/uploads/');
+});
+
+it('streams a signed preview for a pending upload', function () {
+    Storage::fake('local');
+
+    $admin = User::factory()->create(['role' => 'admin']);
+    $owner = User::factory()->create();
+    $categoryId = createModerationCategory();
+    $uploadId = createModerationDraft($owner->id, $categoryId);
+    Storage::disk('local')->put("tmp/drafts/{$uploadId}/preview.webp", 'preview-bytes');
+
+    $pending = $this->actingAs($admin)->getJson('/api/admin/uploads/pending');
+    $pending->assertOk();
+    $previewUrl = (string) $pending->json('data.0.preview_url');
+
+    $response = $this->actingAs($admin)->get($previewUrl);
+
+    $response->assertOk();
+    expect($response->headers->get('content-type'))->toStartWith('image/webp');
+    expect($response->streamedContent())->toBe('preview-bytes');
 });

 it('non-admin is denied moderation API access', function () {