11 Commits (89a0aa3bf732d3bda0ddef6058b4ecd44ea7c217)

Author	SHA1	Message	Date
Shlee	46393bd9fc	Move ValidateCsrfToken middleware to a new position	4 weeks ago
Shlee	2c704d9a76	Update app.php	4 weeks ago
dansup	90af7d8a2d	Merge pull request #6879 from pixelfed/fix/csrf-middleware-rename ... Laravel 13 prep: rename VerifyCsrfToken to PreventRequestForgery	4 weeks ago
Your Name	9958b095dd	refactor: rename VerifyCsrfToken to PreventRequestForgery ... Prepares for Laravel 13 where VerifyCsrfToken is deprecated in favor of PreventRequestForgery. The old class remains as an alias in v13 but will be removed in a future version.	4 weeks ago
Your Name	ed90e619fb	feat: add throttle:api middleware to the api route group ... Adds a global rate limiter (240 req/min per user or IP) to all API routes. Previously rate limiting was only applied ad-hoc on individual routes, leaving some endpoints unprotected.	4 weeks ago
Your Name	7a96cd2e91	fix: replace removed Passport scope middleware with current classes ... Laravel Passport 13 renamed: - CheckScopes → CheckToken (verifies ALL listed scopes) - CheckForAnyScope → CheckTokenForAnyScope (verifies ANY listed scope) The old class names no longer exist, causing BindingResolutionException on all /api/v1/admin/* routes that use the 'scope' or 'scopes' middleware aliases.	4 weeks ago
Your Name	8a2649b3ff	feat: add critical path test suite and fix auth/config issues ... Test Infrastructure: - Modernize phpunit.xml (bootstrap, source block, Laravel 12 env vars) - Configure tests/Pest.php with pest()->extend(TestCase::class)->in('Feature') - Add docker-compose.test.yml (Redis for test suite) - Add composer test/test:quick scripts - Rename CACHE_DRIVER to CACHE_STORE across config (backwards compatible) - Update .env.testing for in-memory SQLite + Docker Redis Test Coverage (190 tests): - CriticalRoutes: public routes, auth routes, API endpoints, middleware, schedule - Auth/LoginTest: login, logout, rate limiting, redirect behavior - Auth/RegisterTest: registration flow, validation, disabled registration - Auth/PasswordResetTest: reset request, token validation, password update - Auth/TwoFactorTest: 2FA checkpoint, setup behind password confirmation - Auth/PasswordConfirmationTest: sudo mode flow via Laravel password.confirm - Api/ScopeTest: scope enforcement, public endpoints, admin access Bugs Fixed: - Fix unauthenticated API returning 500 instead of 401 (AuthenticationException not handled in custom exception renderer in bootstrap/app.php) - Replace custom DangerZone middleware with Laravel password.confirm - Add HasFactory trait to Profile model for test factories Bugs Documented (known-bugs group): - Registration crashes with str_ends_with TypeError (RegisterController:82) - OAuth routes use legacy array syntax causing ReflectionFunction TypeError	4 weeks ago
Your Name	ee7d7124d0	refactor: remove thin middleware wrappers, use framework classes directly ... Delete 4 middleware wrapper classes that added no custom logic: - EncryptCookies (empty $except) - TrimStrings ($except matches framework default) - VerifyCsrfToken (exceptions moved to validateCsrfTokens() in bootstrap) - TrustProxies (headers matched framework default) CSRF exceptions (/api/v1/*, oauth/token) are now configured via $middleware->validateCsrfTokens(except: [...]) in bootstrap/app.php. All 107 tests pass.	4 weeks ago
Your Name	8e41f6fdf8	refactor: migrate to modern bootstrap/app.php architecture ... Consolidate the legacy Laravel 5-era kernel/handler architecture into the modern Application::configure() pattern introduced in Laravel 11: - HTTP middleware stack → bootstrap/app.php withMiddleware() - Console schedule → bootstrap/app.php withSchedule() - Exception handling → bootstrap/app.php withExceptions() - Route registration → bootstrap/app.php withRouting() - Service providers → bootstrap/providers.php Deleted files: - app/Http/Kernel.php - app/Console/Kernel.php - app/Exceptions/Handler.php - app/Providers/RouteServiceProvider.php - app/Providers/BroadcastServiceProvider.php Removed framework providers from config/app.php (auto-registered by Application::configure). Package providers use auto-discovery. All 107 tests pass. Schedule, routes, and middleware verified working.	4 weeks ago
Your Name	3b0fd708c8	Apply Pint formatting to bootstrap/	1 month ago
Daniel Supernault	a034358c98	Add Laravel Framework	9 years ago