Merge branch 'develop' into release

.github/dependabot.yml

@@ -0,0 +1,10 @@
+version: 2
+updates:
+  - package-ecosystem: "composer"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"

.github/workflows/phpunit.yml

@@ -59,7 +59,7 @@ jobs:
         run: php artisan test --parallel
 
       - name: Run codacy-coverage-reporter
-        if: github.repository == 'Traewelling/traewelling'
+        if: ${{github.repository == 'Traewelling/traewelling' && github.actor != 'dependabot'}}
         uses: codacy/codacy-coverage-reporter-action@v1
         with:
           project-token: ${{ secrets.CODACY_PROJECT_TOKEN }}

README.md

@@ -30,12 +30,7 @@ To set up a Träwelling instance you'll need:
 * [MariaDB](https://mariadb.org/download) (SQLite is used for running tests)
 * A local instance of [db-rest v5](https://github.com/derhuerst/db-rest/tree/5)
 * [Composer](https://getcomposer.org/download/)
-* PHP 8.0 and the following extensions:
-    * gd
-    * sodium
-    * exif
-    * pdo_mysql
-    * pdo_sqlite
+* PHP 8.0 and the dependencies mentioned in composer.json
 
 After setting up these, you can clone the repository and install the project's dependencies:
 
@@ -76,13 +71,10 @@ feature - great; if you don't want to, that's fine, too.
 
 If you add code:
 
-* If you edit the language files, please check if your change is applicable at least in german.
-  
+* If you edit the language files, please check if your change is applicable at least in english.
+
 * If you work on the front page (see screenshot above), please consider updating the screenshot.
-
-* Unless you really want to work on Träwelling for a long time, we cannot support more languages. It would be sad to
-  have half-baked languages that have missing strings after a while.
-
+
 * Please consider adding unit and integration tests, especially if you're adding new features.
 
 ### Translations
@@ -93,6 +85,13 @@ international and for this we need you and your language skills.
 We use a [Weblate instance](https://weblate.bubu1.eu/projects/trawelling/) to manage the translations. There you can add
 new translations and correct mistakes.
 
+### Security
+
+If you have identified a security issue, please refrain from directly creating an issue or PullRequest so that the
+vulnerability is not exploited.
+
+Instead, please contact [email protected] or use other [contact methods](https://traewelling.de/security.txt).
+
 ## License
 
 We are using the [Affero General Public License](/LICENSE) ([why?](http://www.gnu.org/licenses/why-affero-gpl)) - you

app/Exceptions/Handler.php

@@ -5,6 +5,7 @@
 use Illuminate\Foundation\Exceptions\Handler as ExceptionHandler;
 use Illuminate\Http\Request;
 use Illuminate\Http\Response;
+use League\OAuth2\Server\Exception\OAuthServerException;
 use Throwable;
 
 class Handler extends ExceptionHandler
@@ -15,7 +16,7 @@ class Handler extends ExceptionHandler
      * @var array
      */
     protected $dontReport = [
-        //
+        OAuthServerException::class
     ];
 
     /**
@@ -32,6 +33,7 @@ class Handler extends ExceptionHandler
      * Report or log an exception.
      *
      * @param Throwable $exception
+     *
      * @return void
      * @throws Throwable
      */
@@ -42,8 +44,9 @@ public function report(Throwable $exception) {
     /**
      * Render an exception into an HTTP response.
      *
-     * @param Request $request
+     * @param Request   $request
      * @param Throwable $exception
+     *
      * @return Response
      * @throws Throwable
      */

app/Http/Controllers/API/StatusController.php

@@ -8,6 +8,7 @@
 use App\Http\Controllers\StatusController as StatusBackend;
 use App\Http\Controllers\UserController as UserBackend;
 use App\Models\Status;
+use Illuminate\Auth\Access\AuthorizationException;
 use Illuminate\Database\Eloquent\ModelNotFoundException;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
@@ -66,9 +67,14 @@ public function index(Request $request) {
         return response()->json($statuses['statuses']);
     }
 
-    public function show($statusId) {
-        $statusResponse = StatusBackend::getStatus($statusId);
-        return $this->sendResponse($statusResponse);
+    public function show($statusId): JsonResponse {
+        $status = StatusBackend::getStatus($statusId);
+        try {
+            $this->authorize('view', $status);
+        } catch (AuthorizationException) {
+            abort(403, 'Status invisible to you.');
+        }
+        return $this->sendResponse($status);
     }
 
     public function update(Request $request): JsonResponse {

app/Http/Controllers/API/v1/FollowController.php

@@ -0,0 +1,127 @@
+<?php
+
+namespace App\Http\Controllers\API\v1;
+
+use App\Exceptions\AlreadyFollowingException;
+use App\Exceptions\IdenticalModelException;
+use App\Exceptions\PermissionException;
+use App\Http\Controllers\API\ResponseController;
+use App\Http\Controllers\Backend\User\FollowController as FollowBackend;
+use App\Http\Controllers\Backend\User\FollowController as SettingsBackend;
+use App\Http\Controllers\UserController as UserBackend;
+use App\Http\Resources\UserResource;
+use App\Models\Follow;
+use App\Models\User;
+use Illuminate\Database\Eloquent\ModelNotFoundException;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+use Illuminate\Http\Resources\Json\AnonymousResourceCollection;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\Validation\Rule;
+
+class FollowController extends ResponseController
+{
+
+    public static function createFollow(Request $request, FollowController $instance): JsonResponse {
+        $validated    = $request->validate(['userId' => ['required', 'exists:users,id']]);
+        $userToFollow = User::find($validated['userId']);
+
+        try {
+            $createFollowResponse = UserBackend::createOrRequestFollow(Auth::user(), $userToFollow);
+        } catch (AlreadyFollowingException) {
+            return $instance->sendv1Error(['message' => __('controller.user.follow-error')], 409);
+        } catch (IdenticalModelException) {
+            abort(409);
+        }
+
+        return $instance->sendv1Response(new UserResource($createFollowResponse), 204);
+    }
+
+    public static function destroyFollow(Request $request, FollowController $instance): JsonResponse {
+        $validated      = $request->validate(['userId' => ['required', 'exists:users,id']]);
+        $userToUnfollow = User::find($validated['userId']);
+
+        $destroyFollowResponse = UserBackend::destroyFollow(Auth::user(), $userToUnfollow);
+        if ($destroyFollowResponse === false) {
+            return $instance->sendv1Error(['message' => __('controller.user.follow-404')], 409);
+        }
+
+        $userToUnfollow->fresh();
+        return $instance->sendv1Response(new UserResource($userToUnfollow));
+
+    }
+
+    public function getFollowers(): AnonymousResourceCollection {
+        $followersResponse = FollowBackend::getFollowers(user: auth()->user());
+        return UserResource::collection($followersResponse);
+    }
+
+    public function getFollowRequests(): AnonymousResourceCollection {
+        $followRequestResponse = FollowBackend::getFollowRequests(user: auth()->user());
+        return UserResource::collection($followRequestResponse);
+    }
+
+    public function getFollowings(): AnonymousResourceCollection {
+        $followingResponse = FollowBackend::getFollowings(user: auth()->user());
+        return UserResource::collection($followingResponse);
+    }
+
+    public function removeFollower(Request $request): void {
+        $validated = $request->validate([
+                                            'userId' => [
+                                                'required',
+                                                Rule::in(auth()->user()->followers->pluck('user_id')),
+                                            ]
+                                        ]);
+
+        $follow = Follow::where('user_id', $validated['userId'])
+                        ->where('follow_id', auth()->user()->id)
+                        ->firstOrFail();
+
+        try {
+            $removeResponse = FollowBackend::removeFollower(follow: $follow, user: auth()->user());
+        } catch (PermissionException) {
+            abort(403);
+        }
+
+        if ($removeResponse === true) {
+            abort(204);
+        }
+        abort(500);
+    }
+
+    public function approveFollowRequest(Request $request) {
+        $validated = $request->validate([
+                                            'userId' => [
+                                                'required',
+                                                Rule::in(auth()->user()->followRequests->pluck('user_id'))
+                                            ]
+                                        ]);
+
+        try {
+            FollowBackend::approveFollower(auth()->user()->id, $validated['userId']);
+            abort(204);
+        } catch (ModelNotFoundException) {
+            abort(404);
+        } catch (AlreadyFollowingException $exception) {
+            report($exception);
+        }
+        abort(500);
+    }
+
+    public function rejectFollowRequest(Request $request) {
+        $validated = $request->validate([
+                                            'userId' => [
+                                                'required',
+                                                Rule::in(auth()->user()->followRequests->pluck('user_id'))
+                                            ]
+                                        ]);
+        try {
+            FollowBackend::rejectFollower(auth()->user()->id, $validated['userId']);
+            abort(204);
+        } catch (ModelNotFoundException) {
+            abort(404);
+        }
+        abort(500);
+    }
+}

app/Http/Controllers/API/v1/StatusController.php

@@ -14,6 +14,7 @@
 use App\Http\Resources\StopoverResource;
 use App\Models\HafasTrip;
 use App\Models\Status;
+use Illuminate\Auth\Access\AuthorizationException;
 use Illuminate\Database\Eloquent\ModelNotFoundException;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
@@ -44,15 +45,24 @@ public function enRoute(): AnonymousResourceCollection {
 
     /**
      * Show single status
+     *
      * @param int $id
+     *
      * @return StatusResource|Response
      */
     public function show(int $id): StatusResource|Response {
-        return new StatusResource(StatusBackend::getStatus($id));
+        $status = StatusBackend::getStatus($id);
+        try {
+            $this->authorize('view', $status);
+        } catch (AuthorizationException) {
+            abort(403, 'Status invisible to you.');
+        }
+        return new StatusResource($status);
     }
 
     /**
      * @param int $id
+     *
      * @return JsonResponse
      */
     public function destroy(int $id): JsonResponse {
@@ -69,7 +79,8 @@ public function destroy(int $id): JsonResponse {
 
     /**
      * @param Request $request
-     * @param int $statusId
+     * @param int     $statusId
+     *
      * @return JsonResponse
      * @throws ValidationException
      */
@@ -87,10 +98,10 @@ public function update(Request $request, int $statusId): JsonResponse {
 
         try {
             $editStatusResponse = StatusBackend::EditStatus(
-                user: Auth::user(),
-                statusId: $statusId,
-                body: $validated['body'],
-                business: $validated['business'],
+                user:       Auth::user(),
+                statusId:   $statusId,
+                body:       $validated['body'],
+                business:   $validated['business'],
                 visibility: $validated['visibility']
             );
             return $this->sendv1Response(new StatusResource($editStatusResponse));
@@ -103,42 +114,41 @@ public function update(Request $request, int $statusId): JsonResponse {
 
     /**
      * @param string $parameters
+     *
      * @return JsonResponse
      * @todo extract this to backend
      * @todo does this conform to the private checkin-shit?
      */
     public function getPolyline(string $parameters): JsonResponse {
-        $ids      = explode(',', $parameters, 50);
+        $ids             = explode(',', $parameters, 50);
         $geoJsonFeatures = Status::whereIn('id', $ids)
-                          ->with('trainCheckin.HafasTrip.polyline')
-                          ->get()
-                          ->reject(function($status) {
-                              return ($status->user->userInvisibleToMe
-                                      || ($status->statusInvisibleToMe
-                                          && $status->visibility !== StatusVisibility::UNLISTED
-                                      ));
-                          })
-                          ->map(function($status) {
-                              return [
-                                  'type' => 'Feature',
-                                  'geometry' => [
-                                      'type' => 'LineString',
-                                      'coordinates' => $status->trainCheckin->getMapLines()
-                                  ],
-                                  'properties' => [
-                                      'statusId' => $status->id
-                                  ]
-                                ];
-                          });
-        $geoJson = [
-            'type' => 'FeatureCollection',
+                                 ->with('trainCheckin.HafasTrip.polyline')
+                                 ->get()
+                                 ->filter(function(Status $status) {
+                                     return \request()?->user()->can('view', $status);
+                                 })
+                                 ->map(function($status) {
+                                     return [
+                                         'type'       => 'Feature',
+                                         'geometry'   => [
+                                             'type'        => 'LineString',
+                                             'coordinates' => $status->trainCheckin->getMapLines()
+                                         ],
+                                         'properties' => [
+                                             'statusId' => $status->id
+                                         ]
+                                     ];
+                                 });
+        $geoJson         = [
+            'type'     => 'FeatureCollection',
             'features' => $geoJsonFeatures
         ];
         return $ids ? $this->sendv1Response($geoJson) : $this->sendv1Error("");
     }
 
     /**
      * @param string $parameters
+     *
      * @return JsonResponse
      */
     public function getStopovers(string $parameters): JsonResponse {