Feature tests

app/Http/Controllers/PlayerController.php

@@ -24,7 +24,7 @@ public function __construct(
     public function play(Request $request)
     {
         $request->validate([
-            'room_id' => ['required', 'string', 'max:12'],
+            'room_id' => ['required', 'string', 'max:20'],
             'timestamp' => ['required', 'numeric'],
             'current_time' => ['nullable', 'numeric'],
             'is_clicked_big_button' => ['required', 'boolean'],

app/Http/Controllers/RoomMemberController.php

@@ -13,12 +13,8 @@
 
 class RoomMemberController extends Controller
 {
-    public function join(Request $request, Room $room)
+    public function join(Room $room)
     {
-        if (! $request->hasValidSignature()) {
-            abort(401);
-        }
-
         /** @var \App\Models\User */
         $user = Auth::user();
 

app/Http/Controllers/RoomPlaylistController.php

@@ -124,6 +124,10 @@ public function next(Request $request, Room $room)
     {
         $this->authorize('view', $room);
 
+        $request->validate([
+            'current_playing_id' => ['required', 'string', 'max:20'],
+        ]);
+
         if ($room->current_playing_id) {
             // 解碼 Hash ID
             $requestedCurrentPlayingId = current(Hashids::connection('playlist_items')->decode(

app/Http/Controllers/UserController.php

@@ -11,6 +11,13 @@
 
 class UserController extends Controller
 {
+    public function __construct()
+    {
+        if (! config('ycsplayer.password_less')) {
+            $this->middleware('password.confirm')->only('confirmDestroy');
+        }
+    }
+
     public function show()
     {
         return Inertia::render('User/Settings', [

app/Models/Room.php

@@ -216,6 +216,10 @@ public function syncRoomPermissions(): void
 
     public function registerMediaConversions(Media $media = null): void
     {
+        if (config('app.env') === 'testing') {
+            return;
+        }
+
         /** @phpstan-ignore-next-line */
         $this->addMediaConversion('thumb')
             ->width(120)

app/Providers/FortifyServiceProvider.php

@@ -12,7 +12,12 @@
 use Illuminate\Support\ServiceProvider;
 use Illuminate\Support\Str;
 use Inertia\Inertia;
+use Laravel\Fortify\Actions\AttemptToAuthenticate;
+use Laravel\Fortify\Actions\EnsureLoginIsNotThrottled;
+use Laravel\Fortify\Actions\PrepareAuthenticatedSession;
+use Laravel\Fortify\Actions\RedirectIfTwoFactorAuthenticatable;
 use Laravel\Fortify\Contracts\LogoutResponse;
+use Laravel\Fortify\Features;
 use Laravel\Fortify\Fortify;
 
 class FortifyServiceProvider extends ServiceProvider
@@ -72,11 +77,18 @@ public function boot(): void
                 ->title('確認密碼');
         });
 
-        if (config('ycsplayer.password_less')) {
-            Fortify::authenticateThrough(function (Request $request) {
+        Fortify::authenticateThrough(function (Request $request) {
+            if (config('ycsplayer.password_less')) {
                 return [RedirectToSendPasswordlessLoginEmailRoute::class];
-            });
-        }
+            }
+
+            return [
+                config('fortify.limiters.login') ? null : EnsureLoginIsNotThrottled::class,
+                Features::enabled(Features::twoFactorAuthentication()) ? RedirectIfTwoFactorAuthenticatable::class : null,
+                AttemptToAuthenticate::class,
+                PrepareAuthenticatedSession::class,
+            ];
+        });
 
         Fortify::createUsersUsing(CreateNewUser::class);
         Fortify::updateUserProfileInformationUsing(UpdateUserProfileInformation::class);

composer.json

@@ -33,6 +33,8 @@
         "mockery/mockery": "^1.4.4",
         "nunomaduro/collision": "^7.0",
         "nunomaduro/larastan": "^2.0",
+        "pestphp/pest": "^2.16",
+        "pestphp/pest-plugin-laravel": "^2.2",
         "phpunit/phpunit": "^10.1",
         "spatie/laravel-ignition": "^2.0"
     },