23804883405

Committed 31 Mar 2026 03:14PM UTC coverage: 11.195% (+1.8%) from 9.347%

Build Type

push

github

Committed by Martian Congress

Commit Message

refactor: Tier 1 — security fixes, route standardization, code style, docs

S9:  File upload path traversal — assert realpath() within allowed dirs,
     sanitize citizen address in file paths
S11: Citizen registry queries capped with LIMIT 100
S12: External HTTP calls — replaced file_get_contents with Http::timeout()
     in CongressController, Wallet/ApiController, AppHelper
A8:  All routes converted to Laravel 9+ array notation
     [Controller::class, 'method']
D2:  Created DEVELOPMENT.md — complete setup guide for contributors
D4:  Laravel Pint code style enforced across 211 files

Tests updated: public route assertions corrected after route syntax
standardization exposed that old string-notation routes never resolved
properly in tests.

127 tests, 251 assertions, 0 PHPStan errors.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Coverage Stats

302 of 3262 new or added lines in 58 files covered. (9.26%)

139 existing lines in 24 files now uncovered.

620 of 5538 relevant lines covered (11.2%)

1.54 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

28.93

/app/Http/Controllers/Citizen/IdentityController.php

<?php

namespace App\Http\Controllers\Citizen;

use App\Http\Controllers\Controller;
use App\Includes\AppHelper;
use App\Models\Citizen;
use App\Models\CivicWallet;
use App\Models\Feed;
use App\Models\Profile;
use App\Models\Proposals;
use App\Models\User;
use Carbon\Carbon;
use Illuminate\Support\Facades\Auth;
use Illuminate\Support\Facades\Cache;
use Illuminate\Support\Facades\DB;
use Illuminate\Support\Facades\View;

class IdentityController extends Controller
{
    /**
     * Setup the layout used by the controller.
     *
     * @return void
     */
    public function __construct() {}

    // The Gateway: citizen onboarding wizard
    public function showJoin()
    {
        if (! Auth::check()) {
            return redirect('/login');
        }
        $uid = Auth::user()->id;
        $profile = Profile::where('userid', $uid)->first();
        if (! $profile) {
            return redirect('/twofa');
        }

        $civic_wallet = CivicWallet::where('user_id', $uid)->first();
        if (! $civic_wallet) {
            return redirect('/wallet/dashboard/hd');
        }

        $citcache = Citizen::where('userid', $uid)->first();
        $view = View::make('citizen.join');
        $view->citcache = $citcache ? $citcache->toArray() : [];
        $view->public_address = $civic_wallet->public_addr;

        return $view;
    }

    // Get all public registrations and display table
    //
    public function showAll()
    {
        if (! Auth::check()) {
            return redirect('/login');
        }

        $view = View::make('citizen.registry');

        // Shared data - cached registry lists
        $view->everyPublic = Cache::remember('registry_every_public', 300, function () {
            return DB::select('SELECT u.*, p.*, c.*, ( SELECT f.txid FROM feed f WHERE f.userid = u.id AND f.tag = ? ORDER BY f.id DESC LIMIT 1) AS txid, ( SELECT f.mined FROM feed f WHERE f.userid = u.id AND f.tag = ? ORDER BY f.id DESC LIMIT 1) AS mined FROM users u JOIN profile p ON u.id = p.userid JOIN citizen c ON u.id = c.userid WHERE EXISTS ( SELECT 1 FROM feed f WHERE f.userid = u.id AND f.tag = ?) AND u.id NOT IN (?, ?) ORDER BY mined DESC LIMIT 100', ['GP', 'GP', 'GP', 6462, 7601]);
        });

        $view->everyCitizen = Cache::remember('registry_every_citizen', 300, function () {
            return DB::select('SELECT u.*, p.*, c.*, ( SELECT f.txid FROM feed f WHERE f.userid = u.id AND f.tag = ? ORDER BY f.id DESC LIMIT 1 ) AS txid, ( SELECT f.mined FROM feed f WHERE f.userid = u.id AND f.tag = ? ORDER BY f.id DESC LIMIT 1 ) AS mined FROM users u JOIN profile p ON u.id = p.userid JOIN citizen c ON u.id = c.userid WHERE EXISTS ( SELECT 1 FROM feed f WHERE f.userid = u.id AND f.tag = ? ) AND u.id NOT IN (?) ORDER BY mined DESC LIMIT 100', ['CT', 'CT', 'CT', 6462]);
        });

        $view->everyApplicant = Cache::remember('registry_every_applicant', 300, function () {
            return DB::select('SELECT profile.userid, users.fullname, citizen.*, civic_wallet.public_addr AS address FROM users, profile, civic_wallet, citizen WHERE profile.userid = users.id AND users.id = civic_wallet.user_id AND citizen.userid = users.id AND profile.has_application = ? AND users.id NOT IN (?) ORDER BY citizen.created_at DESC LIMIT 100', [1, 6462]);
        });

        if (Auth::check()) {
            $uid = Auth::user()->id;
            $profile = Profile::where('userid', '=', $uid)->first();
            $wallet = CivicWallet::where('user_id', '=', $uid)->first();
            $citcache = Citizen::where('userid', '=', $uid)->first();
            if (! $profile) {
                return redirect('/twofa');
            } else {
                if ($profile->openchallenge == 1 || is_null($profile->openchallenge)) {
                    return redirect('/twofachallenge');
                }
            }
            $view->wallet_open = $profile->civic_wallet_open;
            $view->isCitizen = $profile->citizen;
            $view->citcache = $citcache;
            $view->isGP = $profile->general_public;
            $view->mePublic = Feed::where('userid', '=', $uid)->where('tag', '=', 'GP')->first();
            $view->meCitizen = Feed::where('userid', '=', $uid)->where('tag', '=', 'CT')->first();
            $view->feed = Feed::where('userid', '=', $uid)->whereNotNull('mined')->whereNotIn('tag', ['GP', 'CT'])->orderBy('created_at', 'desc')->get();
            $view->endorsed = [];
            $view->recentActivityCount = Feed::where('userid', $uid)->where('mined', '>=', Carbon::now()->subDay())->count();

            if ($wallet) {
                $view->balance = AppHelper::getMarscoinBalance($wallet['public_addr']);
                $view->public_address = $wallet['public_addr'];
                $view->endorsed = Feed::where('message', '=', $wallet['public_addr'])->where('tag', '=', 'ED')->get();
            } else {
                $view->balance = 0;
                $view->public_address = '';
            }
        }
        // Auth check at top of function ensures we never reach here unauthenticated

        return $view;

    }

    public function printout()
    {
        if (Auth::check()) {
            $uid = Auth::user()->id;
            $profile = Profile::where('userid', '=', $uid)->first();
            $civic_wallet = CivicWallet::where('user_id', '=', $uid)->first();
            $view = View::make('citizen.printout');
            $citcache = Citizen::where('userid', '=', $uid)->first();
            $view->fullname = $citcache->firstname.' '.$citcache->lastname;

            if ($civic_wallet) {
                $view->public_address = $civic_wallet['public_addr'];
            } else {
                $view->balance = 0;
                $view->public_address = '';
            }

            return $view;
        } else {
            return redirect('/login');
        }
    }

    public function printout2()
    {
        if (Auth::check()) {
            $uid = Auth::user()->id;
            $profile = Profile::where('userid', '=', $uid)->first();
            $civic_wallet = CivicWallet::where('user_id', '=', $uid)->first();
            $view = View::make('citizen.themes.printout2');
            $citcache = Citizen::where('userid', '=', $uid)->first();
            $view->fullname = $citcache->firstname.' '.$citcache->lastname;

            if ($civic_wallet) {
                $view->public_address = $civic_wallet['public_addr'];
            } else {
                $view->balance = 0;
                $view->public_address = '';
            }

            return $view;
        } else {
            return redirect('/login');
        }
    }

    public function printout3()
    {
        if (Auth::check()) {
            $uid = Auth::user()->id;
            $profile = Profile::where('userid', '=', $uid)->first();
            $civic_wallet = CivicWallet::where('user_id', '=', $uid)->first();
            $view = View::make('citizen.themes.printout3');
            $citcache = Citizen::where('userid', '=', $uid)->first();
            $view->fullname = $citcache->firstname.' '.$citcache->lastname;

            if ($civic_wallet) {
                $view->public_address = $civic_wallet['public_addr'];
            } else {
                $view->balance = 0;
                $view->public_address = '';
            }

            return $view;
        } else {
            return redirect('/login');
        }
    }

    // Get profile view of another Martian Citizen
    //
    public function showId($address)
    {

        if (Auth::check()) {
            $uid = Auth::user()->id;
            // Martian user we are looking at
            $martian = Citizen::where('public_address', '=', $address)->first();
            if (! $martian) {
                abort(404, 'Citizen not found');
            }
            $martian_profile = Profile::where('userid', '=', $martian->userid)->first();
            $martian_proposals = Proposals::where('user_id', '=', $martian->userid)->count();
            $myprofile = Profile::where('userid', '=', $uid)->first();

            if (! $myprofile) {
                return redirect('/twofa');
            } else {
                if ($myprofile->openchallenge == 1 || is_null($myprofile->openchallenge)) {
                    return redirect('/twofachallenge');
                }
            }
            $view = View::make('citizen.martian');
            $view->wallet_open = $myprofile->civic_wallet_open;

            $view->isCitizen = $martian_profile->citizen;
            $view->endorsements = $martian_profile->endorse_cnt;
            $view->proposals = $martian_proposals;
            $view->isGP = $martian_profile->general_public;
            $view->mePublic = Feed::where('userid', '=', $martian->userid)->where('tag', '=', 'GP')->first();
            $view->meCitizen = Feed::where('userid', '=', $martian->userid)->where('tag', '=', 'CT')->first();
            $view->endorsed = Feed::where('userid', '=', $martian->userid)->where('tag', '=', 'ED')->count();

            $view->citcache = $martian;

            return $view;

        } else {
            return redirect('/login');
        }

    }
}

1	<?php
2
3	namespace App\Http\Controllers\Citizen;
4
5	use App\Http\Controllers\Controller;
6	use App\Includes\AppHelper;
7	use App\Models\Citizen;
8	use App\Models\CivicWallet;
9	use App\Models\Feed;
10	use App\Models\Profile;
11	use App\Models\Proposals;
12	use App\Models\User;
13	use Carbon\Carbon;
14	use Illuminate\Support\Facades\Auth;
15	use Illuminate\Support\Facades\Cache;
16	use Illuminate\Support\Facades\DB;
17	use Illuminate\Support\Facades\View;
18
19	class IdentityController extends Controller
20	{
21	/**
22	* Setup the layout used by the controller.
23	*
24	* @return void
25	*/
26	public function __construct() {}	3✔
27
28	// The Gateway: citizen onboarding wizard
NEW 29	public function showJoin()	×
30	{
NEW 31	if (! Auth::check()) {	×
NEW 32	return redirect('/login');	×
33	}
NEW 34	$uid = Auth::user()->id;	×
NEW 35	$profile = Profile::where('userid', $uid)->first();	×
NEW 36	if (! $profile) {	×
NEW 37	return redirect('/twofa');	×
38	}
39
NEW 40	$civic_wallet = CivicWallet::where('user_id', $uid)->first();	×
NEW 41	if (! $civic_wallet) {	×
NEW 42	return redirect('/wallet/dashboard/hd');	×
43	}
44
NEW 45	$citcache = Citizen::where('userid', $uid)->first();	×
NEW 46	$view = View::make('citizen.join');	×
NEW 47	$view->citcache = $citcache ? $citcache->toArray() : [];	×
NEW 48	$view->public_address = $civic_wallet->public_addr;	×
49
NEW 50	return $view;	×
51	}
52
53	// Get all public registrations and display table
54	//
55	public function showAll()	3✔
56	{
57	if (! Auth::check()) {	3✔
58	return redirect('/login');	2✔
59	}
60
61	$view = View::make('citizen.registry');	1✔
62
63	// Shared data - cached registry lists
64	$view->everyPublic = Cache::remember('registry_every_public', 300, function () {	1✔
65	return DB::select('SELECT u., p., c.*, ( SELECT f.txid FROM feed f WHERE f.userid = u.id AND f.tag = ? ORDER BY f.id DESC LIMIT 1) AS txid, ( SELECT f.mined FROM feed f WHERE f.userid = u.id AND f.tag = ? ORDER BY f.id DESC LIMIT 1) AS mined FROM users u JOIN profile p ON u.id = p.userid JOIN citizen c ON u.id = c.userid WHERE EXISTS ( SELECT 1 FROM feed f WHERE f.userid = u.id AND f.tag = ?) AND u.id NOT IN (?, ?) ORDER BY mined DESC LIMIT 100', ['GP', 'GP', 'GP', 6462, 7601]);	1✔
66	});	1✔
67
68	$view->everyCitizen = Cache::remember('registry_every_citizen', 300, function () {	1✔
69	return DB::select('SELECT u., p., c.*, ( SELECT f.txid FROM feed f WHERE f.userid = u.id AND f.tag = ? ORDER BY f.id DESC LIMIT 1 ) AS txid, ( SELECT f.mined FROM feed f WHERE f.userid = u.id AND f.tag = ? ORDER BY f.id DESC LIMIT 1 ) AS mined FROM users u JOIN profile p ON u.id = p.userid JOIN citizen c ON u.id = c.userid WHERE EXISTS ( SELECT 1 FROM feed f WHERE f.userid = u.id AND f.tag = ? ) AND u.id NOT IN (?) ORDER BY mined DESC LIMIT 100', ['CT', 'CT', 'CT', 6462]);	1✔
70	});	1✔
71
72	$view->everyApplicant = Cache::remember('registry_every_applicant', 300, function () {	1✔
73	return DB::select('SELECT profile.userid, users.fullname, citizen.*, civic_wallet.public_addr AS address FROM users, profile, civic_wallet, citizen WHERE profile.userid = users.id AND users.id = civic_wallet.user_id AND citizen.userid = users.id AND profile.has_application = ? AND users.id NOT IN (?) ORDER BY citizen.created_at DESC LIMIT 100', [1, 6462]);	1✔
74	});	1✔
75
76	if (Auth::check()) {	1✔
77	$uid = Auth::user()->id;	1✔
78	$profile = Profile::where('userid', '=', $uid)->first();	1✔
79	$wallet = CivicWallet::where('user_id', '=', $uid)->first();	1✔
80	$citcache = Citizen::where('userid', '=', $uid)->first();	1✔
81	if (! $profile) {	1✔
NEW 82	return redirect('/twofa');	×
83	} else {
84	if ($profile->openchallenge == 1 \|\| is_null($profile->openchallenge)) {	1✔
NEW 85	return redirect('/twofachallenge');	×
86	}
87	}
88	$view->wallet_open = $profile->civic_wallet_open;	1✔
89	$view->isCitizen = $profile->citizen;	1✔
90	$view->citcache = $citcache;	1✔
91	$view->isGP = $profile->general_public;	1✔
92	$view->mePublic = Feed::where('userid', '=', $uid)->where('tag', '=', 'GP')->first();	1✔
93	$view->meCitizen = Feed::where('userid', '=', $uid)->where('tag', '=', 'CT')->first();	1✔
94	$view->feed = Feed::where('userid', '=', $uid)->whereNotNull('mined')->whereNotIn('tag', ['GP', 'CT'])->orderBy('created_at', 'desc')->get();	1✔
95	$view->endorsed = [];	1✔
96	$view->recentActivityCount = Feed::where('userid', $uid)->where('mined', '>=', Carbon::now()->subDay())->count();	1✔
97
98	if ($wallet) {	1✔
99	$view->balance = AppHelper::getMarscoinBalance($wallet['public_addr']);	1✔
100	$view->public_address = $wallet['public_addr'];	1✔
101	$view->endorsed = Feed::where('message', '=', $wallet['public_addr'])->where('tag', '=', 'ED')->get();	1✔
102	} else {
NEW 103	$view->balance = 0;	×
NEW 104	$view->public_address = '';	×
105	}
106	}
107	// Auth check at top of function ensures we never reach here unauthenticated
108
109	return $view;	1✔
110
111	}
112
NEW 113	public function printout()	×
114	{
NEW 115	if (Auth::check()) {	×
NEW 116	$uid = Auth::user()->id;	×
NEW 117	$profile = Profile::where('userid', '=', $uid)->first();	×
NEW 118	$civic_wallet = CivicWallet::where('user_id', '=', $uid)->first();	×
NEW 119	$view = View::make('citizen.printout');	×
NEW 120	$citcache = Citizen::where('userid', '=', $uid)->first();	×
NEW 121	$view->fullname = $citcache->firstname.' '.$citcache->lastname;	×
122
NEW 123	if ($civic_wallet) {	×
NEW 124	$view->public_address = $civic_wallet['public_addr'];	×
125	} else {
NEW 126	$view->balance = 0;	×
NEW 127	$view->public_address = '';	×
128	}
129
NEW 130	return $view;	×
131	} else {
UNCOV 132	return redirect('/login');	×
133	}
134	}
135
NEW 136	public function printout2()	×
137	{
NEW 138	if (Auth::check()) {	×
NEW 139	$uid = Auth::user()->id;	×
NEW 140	$profile = Profile::where('userid', '=', $uid)->first();	×
NEW 141	$civic_wallet = CivicWallet::where('user_id', '=', $uid)->first();	×
NEW 142	$view = View::make('citizen.themes.printout2');	×
NEW 143	$citcache = Citizen::where('userid', '=', $uid)->first();	×
NEW 144	$view->fullname = $citcache->firstname.' '.$citcache->lastname;	×
145
NEW 146	if ($civic_wallet) {	×
NEW 147	$view->public_address = $civic_wallet['public_addr'];	×
148	} else {
NEW 149	$view->balance = 0;	×
NEW 150	$view->public_address = '';	×
151	}
152
NEW 153	return $view;	×
154	} else {
UNCOV 155	return redirect('/login');	×
156	}
157	}
158
NEW 159	public function printout3()	×
160	{
NEW 161	if (Auth::check()) {	×
NEW 162	$uid = Auth::user()->id;	×
NEW 163	$profile = Profile::where('userid', '=', $uid)->first();	×
NEW 164	$civic_wallet = CivicWallet::where('user_id', '=', $uid)->first();	×
NEW 165	$view = View::make('citizen.themes.printout3');	×
NEW 166	$citcache = Citizen::where('userid', '=', $uid)->first();	×
NEW 167	$view->fullname = $citcache->firstname.' '.$citcache->lastname;	×
168
NEW 169	if ($civic_wallet) {	×
NEW 170	$view->public_address = $civic_wallet['public_addr'];	×
171	} else {
NEW 172	$view->balance = 0;	×
NEW 173	$view->public_address = '';	×
174	}
175
NEW 176	return $view;	×
177	} else {
NEW 178	return redirect('/login');	×
179	}
180	}
181
182	// Get profile view of another Martian Citizen
183	//
UNCOV 184	public function showId($address)	×
185	{
186
NEW 187	if (Auth::check()) {	×
NEW 188	$uid = Auth::user()->id;	×
189	// Martian user we are looking at
NEW 190	$martian = Citizen::where('public_address', '=', $address)->first();	×
NEW 191	if (! $martian) {	×
NEW 192	abort(404, 'Citizen not found');	×
193	}
NEW 194	$martian_profile = Profile::where('userid', '=', $martian->userid)->first();	×
NEW 195	$martian_proposals = Proposals::where('user_id', '=', $martian->userid)->count();	×
NEW 196	$myprofile = Profile::where('userid', '=', $uid)->first();	×
197
NEW 198	if (! $myprofile) {	×
NEW 199	return redirect('/twofa');	×
200	} else {
NEW 201	if ($myprofile->openchallenge == 1 \|\| is_null($myprofile->openchallenge)) {	×
NEW 202	return redirect('/twofachallenge');	×
203	}
204	}
NEW 205	$view = View::make('citizen.martian');	×
NEW 206	$view->wallet_open = $myprofile->civic_wallet_open;	×
207
NEW 208	$view->isCitizen = $martian_profile->citizen;	×
NEW 209	$view->endorsements = $martian_profile->endorse_cnt;	×
NEW 210	$view->proposals = $martian_proposals;	×
NEW 211	$view->isGP = $martian_profile->general_public;	×
NEW 212	$view->mePublic = Feed::where('userid', '=', $martian->userid)->where('tag', '=', 'GP')->first();	×
NEW 213	$view->meCitizen = Feed::where('userid', '=', $martian->userid)->where('tag', '=', 'CT')->first();	×
NEW 214	$view->endorsed = Feed::where('userid', '=', $martian->userid)->where('tag', '=', 'ED')->count();	×
215
NEW 216	$view->citcache = $martian;	×
217
NEW 218	return $view;	×
219
220	} else {
UNCOV 221	return redirect('/login');	×
222	}
223
224	}
225	}

marscoin / martianrepublic / 23804883405

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous