ad2a78a989
Sharing certificates now creates a Share: a public page behind an
unguessable token where the recipient views and downloads the selected
certificates individually or as a ZIP, instead of receiving links or
attachments by email.
- Share model + certificate_share pivot; expiration (1/7/30 days),
optional password (encrypted so the owner can re-view it), revocation,
and open tracking
- Public routes under shared/{token}: password unlock gate (throttled,
session-scoped), per-certificate download, on-the-fly ZIP that is
AES-256 encrypted when the share has a password, friendly 410 page
for expired/revoked links
- Share modal on the certificates index now creates the page and
reveals a copyable link + password; optional transactional email
(ShareCreatedMail) still sends the link to a recipient
- New Shares page in the sidebar to copy links, look up passwords,
revoke, and delete shares
- Old signed-URL controller and both attachment/link mailables removed;
Dutch translations updated; Pest coverage for the full lifecycle
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
97 lines
3 KiB
PHP
97 lines
3 KiB
PHP
<?php
|
|
|
|
namespace App\Http\Controllers;
|
|
|
|
use App\Models\Certificate;
|
|
use App\Models\Share;
|
|
use App\Services\CertificateZipper;
|
|
use Illuminate\Contracts\View\View;
|
|
use Illuminate\Http\RedirectResponse;
|
|
use Illuminate\Http\Request;
|
|
use Illuminate\Http\Response;
|
|
use Illuminate\Support\Facades\Storage;
|
|
use Symfony\Component\HttpFoundation\BinaryFileResponse;
|
|
use Symfony\Component\HttpFoundation\StreamedResponse;
|
|
|
|
/**
|
|
* Public page where external recipients view a share and download its
|
|
* certificates. Authorization is the unguessable token in the URL (plus the
|
|
* optional share password); this runs unauthenticated, so the owner scope
|
|
* on Share/Certificate no-ops.
|
|
*/
|
|
class SharePageController extends Controller
|
|
{
|
|
public function show(Share $share): View|Response
|
|
{
|
|
if (! $share->isActive()) {
|
|
return response()->view('shared.expired', status: 410);
|
|
}
|
|
|
|
if (! $this->isUnlocked($share)) {
|
|
return view('shared.unlock', ['share' => $share]);
|
|
}
|
|
|
|
$share->recordAccess();
|
|
|
|
return view('shared.show', [
|
|
'share' => $share,
|
|
'certificates' => $share->certificates()->whereNotNull('file_path')->orderBy('title')->get(),
|
|
]);
|
|
}
|
|
|
|
public function unlock(Request $request, Share $share): RedirectResponse
|
|
{
|
|
abort_unless($share->isActive(), 410);
|
|
|
|
$validated = $request->validate(['password' => ['required', 'string']]);
|
|
|
|
if ($share->password === null || ! hash_equals($share->password, $validated['password'])) {
|
|
return back()->withErrors(['password' => __('The password is incorrect.')]);
|
|
}
|
|
|
|
$request->session()->put($this->sessionKey($share), true);
|
|
|
|
return redirect()->route('shared.show', $share->token);
|
|
}
|
|
|
|
public function download(Share $share, Certificate $certificate): StreamedResponse
|
|
{
|
|
$this->authorizeDownload($share);
|
|
|
|
abort_unless(filled($certificate->file_path) && Storage::disk('local')->exists($certificate->file_path), 404);
|
|
|
|
return Storage::disk('local')->download(
|
|
$certificate->file_path,
|
|
$certificate->title.'.'.pathinfo($certificate->file_path, PATHINFO_EXTENSION),
|
|
);
|
|
}
|
|
|
|
public function zip(Share $share): BinaryFileResponse
|
|
{
|
|
$this->authorizeDownload($share);
|
|
|
|
$certificates = $share->certificates()->whereNotNull('file_path')->get();
|
|
|
|
abort_if($certificates->isEmpty(), 404);
|
|
|
|
$zipPath = app(CertificateZipper::class)->create($certificates, $share->password);
|
|
|
|
return response()->download($zipPath, 'certificates.zip')->deleteFileAfterSend();
|
|
}
|
|
|
|
private function authorizeDownload(Share $share): void
|
|
{
|
|
abort_unless($share->isActive(), 410);
|
|
abort_unless($this->isUnlocked($share), 403);
|
|
}
|
|
|
|
private function isUnlocked(Share $share): bool
|
|
{
|
|
return $share->password === null || session()->get($this->sessionKey($share)) === true;
|
|
}
|
|
|
|
private function sessionKey(Share $share): string
|
|
{
|
|
return 'share-unlocked:'.$share->id;
|
|
}
|
|
}
|