Upload beautify

2026-02-14 15:14:12 +01:00
parent e129618910
commit 79192345e3
249 changed files with 24436 additions and 1021 deletions
--- a/app/Http/Requests/Uploads/UploadChunkRequest.php
+++ b/app/Http/Requests/Uploads/UploadChunkRequest.php
@@ -0,0 +1,91 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Requests\Uploads;
+
+use App\Repositories\Uploads\UploadSessionRepository;
+use App\Services\Uploads\UploadTokenService;
+use Illuminate\Foundation\Http\FormRequest;
+use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
+
+final class UploadChunkRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        $user = $this->user();
+        if (! $user) {
+            $this->logUnauthorized('missing_user');
+            $this->denyAsNotFound();
+        }
+
+        $sessionId = (string) $this->input('session_id');
+        if ($sessionId === '') {
+            $this->logUnauthorized('missing_session_id');
+            $this->denyAsNotFound();
+        }
+
+        $token = $this->header('X-Upload-Token') ?: $this->input('upload_token');
+        if (! $token) {
+            $this->logUnauthorized('missing_token');
+            $this->denyAsNotFound();
+        }
+
+        $sessions = $this->container->make(UploadSessionRepository::class);
+        $session = $sessions->get($sessionId);
+        if (! $session || $session->userId !== $user->id) {
+            $this->logUnauthorized('not_owned_or_missing');
+            $this->denyAsNotFound();
+        }
+
+        $tokens = $this->container->make(UploadTokenService::class);
+        $payload = $tokens->get((string) $token);
+        if (! $payload) {
+            $this->logUnauthorized('invalid_token');
+            $this->denyAsNotFound();
+        }
+
+        if (($payload['session_id'] ?? null) !== $sessionId) {
+            $this->logUnauthorized('token_session_mismatch');
+            $this->denyAsNotFound();
+        }
+
+        if ((int) ($payload['user_id'] ?? 0) !== (int) $user->id) {
+            $this->logUnauthorized('token_user_mismatch');
+            $this->denyAsNotFound();
+        }
+
+        return true;
+    }
+
+    public function rules(): array
+    {
+        $maxBytes = (int) config('uploads.chunk.max_bytes', 0);
+        $maxKb = $maxBytes > 0 ? (int) ceil($maxBytes / 1024) : 5120;
+        $chunkSizeRule = $maxBytes > 0 ? 'required|integer|min:1|max:' . $maxBytes : 'required|integer|min:1';
+
+        return [
+            'session_id' => 'required|uuid',
+            'offset' => 'required|integer|min:0',
+            'total_size' => 'required|integer|min:1',
+            'chunk_size' => $chunkSizeRule,
+            'chunk' => 'required|file|max:' . $maxKb,
+            'upload_token' => 'nullable|string|min:40|max:200',
+        ];
+    }
+
+    private function denyAsNotFound(): void
+    {
+        throw new NotFoundHttpException();
+    }
+
+    private function logUnauthorized(string $reason): void
+    {
+        logger()->warning('Upload chunk unauthorized access', [
+            'reason' => $reason,
+            'session_id' => (string) $this->input('session_id'),
+            'user_id' => $this->user()?->id,
+            'ip' => $this->ip(),
+        ]);
+    }
+}