Enforce can-post role check on POST /api/v2/media

app/Http/Controllers/Api/ApiV2Controller.php

@@ -225,6 +225,7 @@ class ApiV2Controller extends Controller
         ]);
 
         $user = $request->user();
+        abort_if($user->has_roles && ! UserRoleService::can('can-post', $user->id), 403, 'Invalid permissions for this action');
 
         if ($user->last_active_at == null) {
             return [];

tests/Feature/Api/V2MediaRoleCheckTest.php

@@ -0,0 +1,74 @@
+<?php
+
+use App\Models\User;
+use App\Models\UserRoles;
+use Illuminate\Foundation\Testing\LazilyRefreshDatabase;
+use Illuminate\Http\UploadedFile;
+use Illuminate\Support\Facades\Storage;
+use Laravel\Passport\Passport;
+
+uses(LazilyRefreshDatabase::class);
+
+/*
+|--------------------------------------------------------------------------
+| POST /api/v2/media can-post role enforcement
+|--------------------------------------------------------------------------
+|
+| The Mastodon-compatible v2 media endpoint must enforce the same can-post
+| role check as POST /api/v1/media. A restricted user (has_roles = true with
+| can-post = false, e.g. via Parental Controls) could previously upload media
+| via v2 despite being blocked on v1.
+|
+*/
+
+function restrictedRoleUser(array $roles): User
+{
+    $user = User::factory()->create([
+        'has_roles' => true,
+        'last_active_at' => now(),
+    ]);
+    $user->refresh();
+
+    UserRoles::create([
+        'profile_id' => $user->profile_id,
+        'user_id' => $user->id,
+        'roles' => $roles,
+    ]);
+
+    return $user;
+}
+
+beforeEach(function () {
+    Storage::fake(config('filesystems.default'));
+    config(['pixelfed.enforce_account_limit' => false]);
+});
+
+it('rejects a can-post=false user on POST /api/v1/media with 403', function () {
+    $user = restrictedRoleUser(['can-post' => false]);
+    Passport::actingAs($user, ['write']);
+
+    $this->postJson('/api/v1/media', [
+        'file' => UploadedFile::fake()->image('test.jpg', 100, 100),
+    ])->assertStatus(403);
+});
+
+it('rejects a can-post=false user on POST /api/v2/media with 403', function () {
+    $user = restrictedRoleUser(['can-post' => false]);
+    Passport::actingAs($user, ['write']);
+
+    $this->postJson('/api/v2/media', [
+        'file' => UploadedFile::fake()->image('test.jpg', 100, 100),
+    ])->assertStatus(403);
+});
+
+it('allows a can-post=true user on POST /api/v2/media', function () {
+    $user = restrictedRoleUser(['can-post' => true]);
+    Passport::actingAs($user, ['write']);
+
+    $this->postJson('/api/v2/media', [
+        'file' => UploadedFile::fake()->image('test.jpg', 100, 100),
+        'description' => 'test image',
+    ])
+        ->assertAccepted()
+        ->assertJsonStructure(['id', 'type', 'url', 'preview_url']);
+});