kalugin66/InvoiceShelf
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

refactor(modules): marketplace install flow with checksum validation

Browse Source 
Rewires module installation to use slug + version + checksum_sha256 instead of the opaque module identifier. ModuleInstaller splits marketplace token handling out of install() into helpers, adopts structured error responses, and validates the downloaded archive's SHA-256 against the marketplace manifest before unpacking.

ModuleResource is simplified to accept an already-loaded installed-module instance rather than fetching it from state, exposes access_tier and checksum fields, and drops the auto-disable-on-unpurchased side effect that was bleeding write logic into a read resource. UnzipUpdateRequest accepts a nullable module with a conditional module_name field so the same endpoint serves both app and module updates.

ModulesPolicy::manageModules now short-circuits for super-admins so administration flows (token validation, store state) are not blocked on a company-scoped ability. Two new feature tests cover both the authorization bypass and ModuleResource serialization.
This commit is contained in:
Darko Gjorgjijoski
2026-04-10 17:30:00 +02:00
parent 2af31d0e5f
commit 23d1476870
10 changed files with 332 additions and 186 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
app/Http/Controllers/Admin/Modules/ModuleInstallationController.php
View File

@@ -15,7 +15,11 @@ class ModuleInstallationController extends Controller
{
$this->authorize('manage modules');
$response = ModuleInstaller::download($request->module, $request->version);
$response = ModuleInstaller::download(
(string) $request->slug,
(string) $request->version,
$request->checksum_sha256 ? (string) $request->checksum_sha256 : null,
);
return response()->json($response);
}
@@ -33,7 +37,7 @@ class ModuleInstallationController extends Controller
{
$this->authorize('manage modules');
$path = ModuleInstaller::unzip($request->module, $request->path);
$path = ModuleInstaller::unzip($request->module_name ?? $request->module, $request->path);
return response()->json([
'success' => true,
@@ -45,7 +49,7 @@ class ModuleInstallationController extends Controller
{
$this->authorize('manage modules');
$response = ModuleInstaller::copyFiles($request->module, $request->path);
$response = ModuleInstaller::copyFiles($request->module_name ?? $request->module, $request->path);
return response()->json([
'success' => $response,
@@ -56,7 +60,7 @@ class ModuleInstallationController extends Controller
{
$this->authorize('manage modules');
$response = ModuleInstaller::complete($request->module, $request->version);
$response = ModuleInstaller::complete($request->module_name ?? $request->module, $request->version);
return response()->json([
'success' => $response,

22
app/Http/Controllers/Admin/Modules/ModulesController.php
View File

@@ -18,7 +18,13 @@ class ModulesController extends Controller
{
$this->authorize('manage modules');
return ModuleInstaller::getModules();
$response = ModuleInstaller::getModules();
if (($response['status'] ?? 0) !== 200 || ! isset($response['body']->modules)) {
return response()->json(['error' => 'marketplace_unavailable'], 503);
}
return ModuleResource::collection(collect($response['body']->modules));
}
public function show(Request $request, string $module)
@@ -27,13 +33,19 @@ class ModulesController extends Controller
$response = ModuleInstaller::getModule($module);
if (! $response->success) {
return response()->json($response);
if (($response['status'] ?? 0) === 404) {
return response()->json(['error' => 'not_found'], 404);
}
return (new ModuleResource($response->module))
if (($response['status'] ?? 0) !== 200 || ! isset($response['body']->data)) {
return response()->json(['error' => 'marketplace_unavailable'], 503);
}
return (new ModuleResource($response['body']->data))
->additional(['meta' => [
'modules' => ModuleResource::collection(collect($response->modules)),
'modules' => ModuleResource::collection(
collect($response['body']->meta->modules ?? [])
),
]]);
}

6
app/Http/Requests/UnzipUpdateRequest.php
View File

@@ -25,7 +25,11 @@ class UnzipUpdateRequest extends FormRequest
'regex:/^[\.\/\w\-]+$/',
],
'module' => [
'required',
'nullable',
'string',
],
'module_name' => [
'required_without:module',
'string',
],
];

91
app/Http/Resources/ModuleResource.php
View File

@@ -3,11 +3,9 @@
namespace App\Http\Resources;
use App\Models\Module as ModelsModule;
use App\Models\Setting;
use Illuminate\Contracts\Support\Arrayable;
use Illuminate\Http\Request;
use Illuminate\Http\Resources\Json\JsonResource;
use Nwidart\Modules\Facades\Module;
class ModuleResource extends JsonResource
{
@@ -19,8 +17,7 @@ class ModuleResource extends JsonResource
*/
public function toArray($request): array
{
$this->checkPurchased();
$this->installed_module = ModelsModule::where('name', $this->module_name)->first();
$installedModule = ModelsModule::where('name', $this->module_name)->first();
return [
'id' => $this->id,
@@ -28,107 +25,75 @@ class ModuleResource extends JsonResource
'cover' => $this->cover,
'slug' => $this->slug,
'module_name' => $this->module_name,
'access_tier' => $this->access_tier ?? 'public',
'faq' => $this->faq,
'highlights' => $this->highlights,
'installed_module_version' => $this->getInstalledModuleVersion(),
'installed_module_version_updated_at' => $this->getInstalledModuleUpdatedAt(),
'latest_module_version' => $this->latest_module_version->module_version,
'latest_module_version_updated_at' => $this->latest_module_version->created_at,
'installed_module_version' => $this->getInstalledModuleVersion($installedModule),
'installed_module_version_updated_at' => $this->getInstalledModuleUpdatedAt($installedModule),
'latest_module_version' => $this->latest_module_version,
'latest_module_version_updated_at' => $this->latest_module_version_updated_at,
'latest_min_invoiceshelf_version' => $this->latest_min_invoiceshelf_version ?? null,
'latest_module_checksum_sha256' => $this->latest_module_checksum_sha256 ?? null,
'is_dev' => $this->is_dev,
'license' => $this->license,
'long_description' => $this->long_description,
'monthly_price' => $this->monthly_price,
'name' => $this->name,
'purchased' => $this->purchased,
'purchased' => $this->purchased ?? true,
'reviews' => $this->reviews ?? [],
'screenshots' => $this->screenshots,
'short_description' => $this->short_description,
'type' => $this->type,
'yearly_price' => $this->yearly_price,
'author_name' => $this->author->name,
'author_avatar' => $this->author->avatar,
'installed' => $this->moduleInstalled(),
'enabled' => $this->moduleEnabled(),
'update_available' => $this->updateAvailable(),
'author_name' => $this->author_name,
'author_avatar' => $this->author_avatar,
'installed' => $this->moduleInstalled($installedModule),
'enabled' => $this->moduleEnabled($installedModule),
'update_available' => $this->updateAvailable($installedModule),
'video_link' => $this->video_link,
'video_thumbnail' => $this->video_thumbnail,
'links' => $this->links,
];
}
public function getInstalledModuleVersion()
public function getInstalledModuleVersion(?ModelsModule $installedModule): ?string
{
if (isset($this->installed_module) && $this->installed_module->installed) {
return $this->installed_module->version;
if ($installedModule && $installedModule->installed) {
return $installedModule->version;
}
return null;
}
public function getInstalledModuleUpdatedAt()
public function getInstalledModuleUpdatedAt(?ModelsModule $installedModule): ?string
{
if (isset($this->installed_module) && $this->installed_module->installed) {
return $this->installed_module->updated_at;
if ($installedModule && $installedModule->installed) {
return $installedModule->updated_at?->toIso8601String();
}
return null;
}
public function moduleInstalled()
public function moduleInstalled(?ModelsModule $installedModule): bool
{
if (isset($this->installed_module) && $this->installed_module->installed) {
return true;
}
return false;
return (bool) ($installedModule?->installed);
}
public function moduleEnabled()
public function moduleEnabled(?ModelsModule $installedModule): bool
{
if (isset($this->installed_module) && $this->installed_module->installed) {
return $this->installed_module->enabled;
}
return false;
return (bool) ($installedModule?->installed && $installedModule?->enabled);
}
public function updateAvailable()
public function updateAvailable(?ModelsModule $installedModule): bool
{
if (! isset($this->installed_module)) {
if (! $installedModule || ! $installedModule->installed) {
return false;
}
if (! $this->installed_module->installed) {
if (! isset($this->latest_module_version) || ! is_string($this->latest_module_version)) {
return false;
}
if (! isset($this->latest_module_version)) {
return false;
}
if (version_compare($this->installed_module->version, $this->latest_module_version->module_version, '>=')) {
return false;
}
if (version_compare(Setting::getSetting('version'), $this->latest_module_version->invoiceshelf_version, '<')) {
return false;
}
return true;
}
public function checkPurchased()
{
if ($this->purchased) {
return true;
}
if (Module::has($this->module_name)) {
$module = Module::find($this->module_name);
$module->disable();
ModelsModule::where('name', $this->module_name)->update(['enabled' => false]);
}
return false;
return version_compare($installedModule->version, $this->latest_module_version, '<');
}
}