Send new artwork uploads through a trust-based review policy.

Require review for untrusted accounts, add admin artwork review APIs, and keep queued or auto-trusted publishes from counting as established history.
2026-09-20 14:49:06 +02:00
parent 5437f84c4c
commit 366dbf1de8
14 changed files with 1175 additions and 70 deletions
@@ -0,0 +1,138 @@
+<?php
+
+use App\Jobs\IndexArtworkJob;
+use App\Models\Artwork;
+use App\Models\Category;
+use App\Models\ContentType;
+use App\Models\Notification;
+use App\Models\Tag;
+use App\Models\User;
+use App\Services\ThumbnailService;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Queue;
+
+uses(RefreshDatabase::class);
+
+it('lists pending artworks with title, description, tags and preview', function () {
+    $admin = User::factory()->create(['role' => 'admin']);
+    $owner = User::factory()->create(['username' => 'mira']);
+    $hash = 'aabbccddeeff1122';
+
+    $artwork = Artwork::factory()->for($owner)->unapproved()->unpublished()->create([
+        'title' => 'Forest Spirit',
+        'description' => 'A mossy guardian in fog.',
+        'hash' => $hash,
+        'thumb_ext' => 'webp',
+        'artwork_status' => 'review',
+        'is_public' => false,
+        'moderation_note' => 'new_account, low_level',
+    ]);
+
+    $contentType = ContentType::query()->create([
+        'name' => 'Illustration',
+        'slug' => 'illustration-moderation-type',
+        'description' => '',
+    ]);
+    $category = Category::query()->create([
+        'content_type_id' => $contentType->id,
+        'parent_id' => null,
+        'name' => 'Illustration',
+        'slug' => 'illustration-moderation',
+        'description' => null,
+        'image' => null,
+        'is_active' => true,
+        'sort_order' => 0,
+    ]);
+    $artwork->categories()->attach($category->id);
+
+    $tag = Tag::query()->create(['name' => 'forest', 'slug' => 'forest', 'is_active' => true]);
+    $artwork->tags()->attach($tag->id, ['source' => 'user', 'confidence' => 1.0]);
+
+    $response = $this->actingAs($admin)->getJson('/api/admin/artwork-review/pending');
+
+    $response->assertOk()
+        ->assertJsonPath('data.0.id', $artwork->id)
+        ->assertJsonPath('data.0.title', 'Forest Spirit')
+        ->assertJsonPath('data.0.description', 'A mossy guardian in fog.')
+        ->assertJsonPath('data.0.tags.0', 'forest')
+        ->assertJsonPath('data.0.categories.0', 'Illustration')
+        ->assertJsonPath('data.0.user.username', 'mira')
+        ->assertJsonPath('data.0.preview_url', ThumbnailService::fromHash($hash, 'webp', 'md'))
+        ->assertJsonPath('data.0.preview_lg_url', ThumbnailService::fromHash($hash, 'webp', 'lg'));
+});
+
+it('approves a pending artwork', function () {
+    Queue::fake();
+
+    $admin = User::factory()->create(['role' => 'moderator']);
+    $artwork = Artwork::factory()->unapproved()->unpublished()->create([
+        'artwork_status' => 'review',
+        'is_public' => false,
+        'visibility' => Artwork::VISIBILITY_PUBLIC,
+    ]);
+
+    $response = $this->actingAs($admin)->postJson("/api/admin/artwork-review/{$artwork->id}/approve", [
+        'note' => 'Looks good.',
+    ]);
+
+    $response->assertOk()->assertJsonPath('status', 'published');
+
+    $artwork->refresh();
+    expect($artwork->artwork_status)->toBe('published');
+    expect($artwork->is_approved)->toBeTrue();
+    expect($artwork->is_public)->toBeTrue();
+    expect($artwork->moderation_note)->toBe('Looks good.');
+    expect((int) $artwork->moderated_by)->toBe((int) $admin->id);
+
+    $notice = Notification::query()
+        ->where('user_id', $artwork->user_id)
+        ->where('type', 'artwork_approved')
+        ->first();
+
+    expect($notice)->not->toBeNull()
+        ->and($notice->data['message'] ?? null)->toContain('was approved and is now live')
+        ->and($notice->data['artwork_id'] ?? null)->toBe($artwork->id);
+
+    Queue::assertPushed(IndexArtworkJob::class);
+});
+
+it('rejects a pending artwork', function () {
+    Queue::fake();
+
+    $admin = User::factory()->create(['role' => 'admin']);
+    $artwork = Artwork::factory()->unapproved()->unpublished()->create([
+        'artwork_status' => 'review',
+        'is_public' => false,
+    ]);
+
+    $response = $this->actingAs($admin)->postJson("/api/admin/artwork-review/{$artwork->id}/reject", [
+        'note' => 'Low quality.',
+    ]);
+
+    $response->assertOk()->assertJsonPath('status', 'rejected');
+
+    $artwork->refresh();
+    expect($artwork->artwork_status)->toBe('rejected');
+    expect($artwork->is_approved)->toBeFalse();
+    expect($artwork->is_public)->toBeFalse();
+    expect($artwork->moderation_note)->toBe('Low quality.');
+
+    $notice = Notification::query()
+        ->where('user_id', $artwork->user_id)
+        ->where('type', 'artwork_rejected')
+        ->first();
+
+    expect($notice)->not->toBeNull()
+        ->and($notice->data['message'] ?? null)->toContain('was not approved')
+        ->and($notice->data['message'] ?? null)->toContain('Low quality.');
+
+    Queue::assertPushed(IndexArtworkJob::class);
+});
+
+it('denies artwork review access to regular users', function () {
+    $user = User::factory()->create(['role' => 'user']);
+
+    $this->actingAs($user)
+        ->getJson('/api/admin/artwork-review/pending')
+        ->assertStatus(403);
+});
@@ -76,13 +76,41 @@ it('admin sees pending uploads', function () {
    $owner = User::factory()->create();
    $categoryId = createModerationCategory();

-    createModerationDraft($owner->id, $categoryId, ['title' => 'First Pending']);
+    createModerationDraft($owner->id, $categoryId, [
+        'title' => 'First Pending',
+        'description' => 'A spring garden scene.',
+        'tags' => json_encode(['tulip', 'garden']),
+    ]);
    createModerationDraft($owner->id, $categoryId, ['title' => 'Second Pending']);

    $response = $this->actingAs($admin)->getJson('/api/admin/uploads/pending');

    $response->assertOk();
    $response->assertJsonCount(2, 'data');
+    $response->assertJsonPath('data.0.title', 'First Pending');
+    $response->assertJsonPath('data.0.description', 'A spring garden scene.');
+    $response->assertJsonPath('data.0.tags.0', 'tulip');
+    expect($response->json('data.0.preview_url'))->toContain('/api/admin/uploads/');
+});
+
+it('streams a signed preview for a pending upload', function () {
+    Storage::fake('local');
+
+    $admin = User::factory()->create(['role' => 'admin']);
+    $owner = User::factory()->create();
+    $categoryId = createModerationCategory();
+    $uploadId = createModerationDraft($owner->id, $categoryId);
+    Storage::disk('local')->put("tmp/drafts/{$uploadId}/preview.webp", 'preview-bytes');
+
+    $pending = $this->actingAs($admin)->getJson('/api/admin/uploads/pending');
+    $pending->assertOk();
+    $previewUrl = (string) $pending->json('data.0.preview_url');
+
+    $response = $this->actingAs($admin)->get($previewUrl);
+
+    $response->assertOk();
+    expect($response->headers->get('content-type'))->toStartWith('image/webp');
+    expect($response->streamedContent())->toBe('preview-bytes');
 });

 it('non-admin is denied moderation API access', function () {
@@ -0,0 +1,144 @@
+<?php
+
+use App\Models\Artwork;
+use App\Models\User;
+use App\Services\Moderation\ArtworkUploadPolicy;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Tests\TestCase;
+
+uses(TestCase::class, RefreshDatabase::class);
+
+function policyPendingArtwork(User $user, array $overrides = []): Artwork
+{
+    return Artwork::factory()->for($user)->unapproved()->unpublished()->create(array_merge([
+        'artwork_status' => 'draft',
+        'title' => 'Fresh upload',
+    ], $overrides));
+}
+
+function policyApprovedArtworks(User $user, int $count, array $overrides = []): void
+{
+    Artwork::factory()->for($user)->count($count)->create(array_merge([
+        'is_approved' => true,
+        'is_public' => true,
+        'artwork_status' => 'published',
+        'published_at' => now()->subDay(),
+        'approval_source' => null,
+    ], $overrides));
+}
+
+it('sends new users without five approved artworks to review', function () {
+    $user = User::factory()->create([
+        'role' => 'user',
+        'created_at' => now()->subYear(),
+        'level' => 8,
+    ]);
+    policyApprovedArtworks($user, 4);
+    $pending = policyPendingArtwork($user);
+
+    $policy = app(ArtworkUploadPolicy::class)->assess($user, $pending);
+
+    expect($policy['requires_review'])->toBeTrue()
+        ->and($policy['approved_uploads'])->toBe(4)
+        ->and($policy['reasons'])->toContain('insufficient_approved_uploads');
+});
+
+it('auto-publishes established creators with five approved artworks even without moderator source', function () {
+    $user = User::factory()->create([
+        'role' => 'user',
+        'created_at' => now()->subYear(),
+        'level' => 1,
+    ]);
+    policyApprovedArtworks($user, 5);
+    $pending = policyPendingArtwork($user);
+
+    $policy = app(ArtworkUploadPolicy::class)->assess($user, $pending);
+
+    expect($policy['requires_review'])->toBeFalse()
+        ->and($policy['approved_uploads'])->toBe(5)
+        ->and($policy['reasons'])->toBe([]);
+});
+
+it('does not auto-publish the sixth upload when a new user only has five queued or auto-trusted works', function () {
+    $user = User::factory()->create([
+        'role' => 'user',
+        'created_at' => now()->subYear(),
+        'level' => 8,
+    ]);
+    Artwork::factory()->for($user)->count(5)->unapproved()->unpublished()->create([
+        'artwork_status' => 'review',
+        'is_public' => false,
+        'approval_source' => null,
+    ]);
+    policyApprovedArtworks($user, 5, ['approval_source' => 'trusted_auto']);
+    $sixth = policyPendingArtwork($user);
+
+    $policy = app(ArtworkUploadPolicy::class)->assess($user, $sixth);
+
+    expect($policy['requires_review'])->toBeTrue()
+        ->and($policy['approved_uploads'])->toBe(0)
+        ->and($policy['reasons'])->toContain('insufficient_approved_uploads');
+});
+
+it('auto-publishes only after five moderator-approved or legacy published artworks', function () {
+    $user = User::factory()->create([
+        'role' => 'user',
+        'created_at' => now()->subYear(),
+        'level' => 4,
+    ]);
+    policyApprovedArtworks($user, 3, ['approval_source' => 'trusted_auto']);
+    policyApprovedArtworks($user, 5, ['approval_source' => 'moderator']);
+    $pending = policyPendingArtwork($user);
+
+    $policy = app(ArtworkUploadPolicy::class)->assess($user, $pending);
+
+    expect($policy['requires_review'])->toBeFalse()
+        ->and($policy['approved_uploads'])->toBe(5);
+});
+
+it('does not count the artwork currently being published', function () {
+    $user = User::factory()->create([
+        'role' => 'user',
+        'created_at' => now()->subYear(),
+        'level' => 4,
+    ]);
+    policyApprovedArtworks($user, 4);
+    $pending = policyPendingArtwork($user, [
+        'is_approved' => true,
+        'artwork_status' => 'published',
+        'published_at' => now(),
+    ]);
+
+    $policy = app(ArtworkUploadPolicy::class)->assess($user, $pending);
+
+    expect($policy['approved_uploads'])->toBe(4)
+        ->and($policy['requires_review'])->toBeTrue();
+});
+
+it('still reviews promotional uploads from trusted creators', function () {
+    $user = User::factory()->create([
+        'role' => 'user',
+        'created_at' => now()->subYear(),
+        'level' => 6,
+    ]);
+    policyApprovedArtworks($user, 5);
+    $pending = policyPendingArtwork($user, [
+        'title' => 'Buy now cheap backlinks',
+        'description' => 'Visit https://spam.example.com for a promo code',
+    ]);
+
+    $policy = app(ArtworkUploadPolicy::class)->assess($user, $pending);
+
+    expect($policy['requires_review'])->toBeTrue()
+        ->and($policy['reasons'])->toContain('promotional_content');
+});
+
+it('lets admins publish without review', function () {
+    $admin = User::factory()->create(['role' => 'admin']);
+    $pending = policyPendingArtwork($admin);
+
+    $policy = app(ArtworkUploadPolicy::class)->assess($admin, $pending);
+
+    expect($policy['requires_review'])->toBeFalse()
+        ->and($policy['reasons'])->toBe([]);
+});