13 Commits (1f85fc8da2fce9fa8928811459c411ba6b60680b)

Author	SHA1	Message	Date
Your Name	6ff9ffbbb8	Add media storage migration commands (local<->cloud) with integrated GC ... Add admin:MediaMoveStorageLocalToCloud and admin:MediaMoveStorageCloudToLocal: - Copy media (+thumbnail) between local and cloud disks, verify by size (and sha256 against original_sha256 when present) before deleting the source. - Integrated GC: delete the verified source copy (local on upload, cloud on download), set version=4 / reset to 3, and bust MediaService/StatusService caches. --keep-local / --keep-cloud opt out. - Manage PF_ENABLE_CLOUD in .env AND the live runtime + config cache so new uploads route to the correct backend mid-migration on a hot server. Uses the installer's atomic .env writer (shared ManagesMediaStorageEnv trait). - --limit / --dry-run / --force. Replaces media:migrate2cloud (CloudMediaMigrate) and media:s3gc (MediaS3GarbageCollector); scheduler now runs MediaMoveStorageLocalToCloud hourly for straggler upload + GC. Keeps media:fix-nonlocal-driver. Adds feature tests (download+GC, --keep-cloud, dry-run, env-flag flip both directions, unknown-disk guard).	4 weeks ago
Your Name	a142db87b4	polish	4 weeks ago
Shlee	46393bd9fc	Move ValidateCsrfToken middleware to a new position	4 weeks ago
Shlee	2c704d9a76	Update app.php	4 weeks ago
dansup	90af7d8a2d	Merge pull request #6879 from pixelfed/fix/csrf-middleware-rename ... Laravel 13 prep: rename VerifyCsrfToken to PreventRequestForgery	4 weeks ago
Your Name	9958b095dd	refactor: rename VerifyCsrfToken to PreventRequestForgery ... Prepares for Laravel 13 where VerifyCsrfToken is deprecated in favor of PreventRequestForgery. The old class remains as an alias in v13 but will be removed in a future version.	4 weeks ago
Your Name	ed90e619fb	feat: add throttle:api middleware to the api route group ... Adds a global rate limiter (240 req/min per user or IP) to all API routes. Previously rate limiting was only applied ad-hoc on individual routes, leaving some endpoints unprotected.	4 weeks ago
Your Name	7a96cd2e91	fix: replace removed Passport scope middleware with current classes ... Laravel Passport 13 renamed: - CheckScopes → CheckToken (verifies ALL listed scopes) - CheckForAnyScope → CheckTokenForAnyScope (verifies ANY listed scope) The old class names no longer exist, causing BindingResolutionException on all /api/v1/admin/* routes that use the 'scope' or 'scopes' middleware aliases.	4 weeks ago
Your Name	8a2649b3ff	feat: add critical path test suite and fix auth/config issues ... Test Infrastructure: - Modernize phpunit.xml (bootstrap, source block, Laravel 12 env vars) - Configure tests/Pest.php with pest()->extend(TestCase::class)->in('Feature') - Add docker-compose.test.yml (Redis for test suite) - Add composer test/test:quick scripts - Rename CACHE_DRIVER to CACHE_STORE across config (backwards compatible) - Update .env.testing for in-memory SQLite + Docker Redis Test Coverage (190 tests): - CriticalRoutes: public routes, auth routes, API endpoints, middleware, schedule - Auth/LoginTest: login, logout, rate limiting, redirect behavior - Auth/RegisterTest: registration flow, validation, disabled registration - Auth/PasswordResetTest: reset request, token validation, password update - Auth/TwoFactorTest: 2FA checkpoint, setup behind password confirmation - Auth/PasswordConfirmationTest: sudo mode flow via Laravel password.confirm - Api/ScopeTest: scope enforcement, public endpoints, admin access Bugs Fixed: - Fix unauthenticated API returning 500 instead of 401 (AuthenticationException not handled in custom exception renderer in bootstrap/app.php) - Replace custom DangerZone middleware with Laravel password.confirm - Add HasFactory trait to Profile model for test factories Bugs Documented (known-bugs group): - Registration crashes with str_ends_with TypeError (RegisterController:82) - OAuth routes use legacy array syntax causing ReflectionFunction TypeError	4 weeks ago
Your Name	ee7d7124d0	refactor: remove thin middleware wrappers, use framework classes directly ... Delete 4 middleware wrapper classes that added no custom logic: - EncryptCookies (empty $except) - TrimStrings ($except matches framework default) - VerifyCsrfToken (exceptions moved to validateCsrfTokens() in bootstrap) - TrustProxies (headers matched framework default) CSRF exceptions (/api/v1/*, oauth/token) are now configured via $middleware->validateCsrfTokens(except: [...]) in bootstrap/app.php. All 107 tests pass.	4 weeks ago
Your Name	8e41f6fdf8	refactor: migrate to modern bootstrap/app.php architecture ... Consolidate the legacy Laravel 5-era kernel/handler architecture into the modern Application::configure() pattern introduced in Laravel 11: - HTTP middleware stack → bootstrap/app.php withMiddleware() - Console schedule → bootstrap/app.php withSchedule() - Exception handling → bootstrap/app.php withExceptions() - Route registration → bootstrap/app.php withRouting() - Service providers → bootstrap/providers.php Deleted files: - app/Http/Kernel.php - app/Console/Kernel.php - app/Exceptions/Handler.php - app/Providers/RouteServiceProvider.php - app/Providers/BroadcastServiceProvider.php Removed framework providers from config/app.php (auto-registered by Application::configure). Package providers use auto-discovery. All 107 tests pass. Schedule, routes, and middleware verified working.	4 weeks ago
Your Name	3b0fd708c8	Apply Pint formatting to bootstrap/	4 weeks ago
Daniel Supernault	a034358c98	Add Laravel Framework	9 years ago