From 742c1a6bc82e0fcd8a44e01ea160cbd08bff4fc4 Mon Sep 17 00:00:00 2001
From: Your Name <you@example.com>
Date: Wed, 9 Sep 2026 22:31:08 +0930
Subject: [PATCH] Require dangerzone sudo mode on curated register, shadow
 filter and page admin controllers

---
 .../AdminCuratedRegisterController.php        |  2 +-
 .../AdminShadowFilterController.php           |  2 +-
 app/Http/Controllers/PageController.php       |  2 +-
 routes/web-admin.php                          |  1 -
 ...dminControllerDangerzoneMiddlewareTest.php | 37 +++++++++++++++++++
 5 files changed, 40 insertions(+), 4 deletions(-)
 create mode 100644 tests/Feature/Security/AdminControllerDangerzoneMiddlewareTest.php

diff --git a/app/Http/Controllers/AdminCuratedRegisterController.php b/app/Http/Controllers/AdminCuratedRegisterController.php
index 11690b7c2..71ce4c58e 100644
--- a/app/Http/Controllers/AdminCuratedRegisterController.php
+++ b/app/Http/Controllers/AdminCuratedRegisterController.php
@@ -21,7 +21,7 @@ class AdminCuratedRegisterController extends Controller
 {
     public function __construct()
     {
-        $this->middleware(['auth', 'admin']);
+        $this->middleware(['auth', 'admin', 'dangerzone']);
     }
 
     public function index(Request $request): View
diff --git a/app/Http/Controllers/AdminShadowFilterController.php b/app/Http/Controllers/AdminShadowFilterController.php
index 430973e19..e1bf81254 100644
--- a/app/Http/Controllers/AdminShadowFilterController.php
+++ b/app/Http/Controllers/AdminShadowFilterController.php
@@ -12,7 +12,7 @@ class AdminShadowFilterController extends Controller
 {
     public function __construct()
     {
-        $this->middleware(['auth', 'admin']);
+        $this->middleware(['auth', 'admin', 'dangerzone']);
     }
 
     public function home(Request $request)
diff --git a/app/Http/Controllers/PageController.php b/app/Http/Controllers/PageController.php
index 3aa80f411..eaf37bd84 100644
--- a/app/Http/Controllers/PageController.php
+++ b/app/Http/Controllers/PageController.php
@@ -15,7 +15,7 @@ class PageController extends Controller
 {
     public function __construct()
     {
-        $this->middleware(['auth', 'admin']);
+        $this->middleware(['auth', 'admin', 'dangerzone']);
     }
 
     protected function cacheKeys(): array
diff --git a/routes/web-admin.php b/routes/web-admin.php
index eff18a62c..2aa3655da 100644
--- a/routes/web-admin.php
+++ b/routes/web-admin.php
@@ -117,7 +117,6 @@ Route::domain(config('pixelfed.domain.admin'))->prefix('i/admin')->group(functio
     Route::post('asf/edit/{id}', [AdminShadowFilterController::class, 'storeEdit']);
     Route::post('asf/create', [AdminShadowFilterController::class, 'store']);
 
-    Route::get('asf/home', [AdminShadowFilterController::class, 'home']);
     Route::redirect('curated-onboarding/', 'curated-onboarding/home');
     Route::get('curated-onboarding/home', [AdminCuratedRegisterController::class, 'index'])->name('admin.curated-onboarding');
     Route::get('curated-onboarding/templates', [AdminCuratedRegisterController::class, 'templates'])->name('admin.curated-onboarding.templates');
diff --git a/tests/Feature/Security/AdminControllerDangerzoneMiddlewareTest.php b/tests/Feature/Security/AdminControllerDangerzoneMiddlewareTest.php
new file mode 100644
index 000000000..1c6429449
--- /dev/null
+++ b/tests/Feature/Security/AdminControllerDangerzoneMiddlewareTest.php
@@ -0,0 +1,37 @@
+<?php
+
+use App\Http\Controllers\AdminCuratedRegisterController;
+use App\Http\Controllers\AdminShadowFilterController;
+use App\Http\Controllers\PageController;
+
+/*
+|--------------------------------------------------------------------------
+| Admin controllers must enforce sudo mode
+|--------------------------------------------------------------------------
+|
+| AdminController applies the `dangerzone` (sudo mode / RequirePassword)
+| middleware to every admin route. Controllers that expose equally sensitive
+| admin operations must do the same so a stolen long-lived session cannot be
+| used to modify pages, shadow-filter users, or approve registrations without
+| a recent password confirmation.
+|
+*/
+
+function controllerMiddleware(object $controller): array
+{
+    return collect($controller->getMiddleware())
+        ->pluck('middleware')
+        ->all();
+}
+
+it('requires dangerzone middleware on PageController', function () {
+    expect(controllerMiddleware(new PageController))->toContain('dangerzone');
+});
+
+it('requires dangerzone middleware on AdminShadowFilterController', function () {
+    expect(controllerMiddleware(new AdminShadowFilterController))->toContain('dangerzone');
+});
+
+it('requires dangerzone middleware on AdminCuratedRegisterController', function () {
+    expect(controllerMiddleware(new AdminCuratedRegisterController))->toContain('dangerzone');
+});