23804883405

Committed 31 Mar 2026 03:14PM UTC coverage: 11.195% (+1.8%) from 9.347%

Build Type

push

github

Committed by Martian Congress

Commit Message

refactor: Tier 1 — security fixes, route standardization, code style, docs

S9:  File upload path traversal — assert realpath() within allowed dirs,
     sanitize citizen address in file paths
S11: Citizen registry queries capped with LIMIT 100
S12: External HTTP calls — replaced file_get_contents with Http::timeout()
     in CongressController, Wallet/ApiController, AppHelper
A8:  All routes converted to Laravel 9+ array notation
     [Controller::class, 'method']
D2:  Created DEVELOPMENT.md — complete setup guide for contributors
D4:  Laravel Pint code style enforced across 211 files

Tests updated: public route assertions corrected after route syntax
standardization exposed that old string-notation routes never resolved
properly in tests.

127 tests, 251 assertions, 0 PHPStan errors.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Coverage Stats

302 of 3262 new or added lines in 58 files covered. (9.26%)

139 existing lines in 24 files now uncovered.

620 of 5538 relevant lines covered (11.2%)

1.54 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

16.67

/app/Http/Controllers/Inventory/InventoryController.php

<?php

namespace App\Http\Controllers\Inventory;

use App\Http\Controllers\Controller;
use App\Includes\AppHelper;
use App\Models\CivicWallet;
use App\Models\InventoryItem;
use App\Models\Profile;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Auth;
use Illuminate\Support\Facades\View;

class InventoryController extends Controller
{
    public function __construct() {}

    public function showAll()
    {
        $view = View::make('inventory.dashboard');
        $view->allItems = InventoryItem::orderBy('created_at', 'desc')->get();
        $view->categories = InventoryItem::CATEGORIES;
        $view->conditions = InventoryItem::CONDITIONS;

        if (Auth::check()) {
            $uid = Auth::user()->id;
            $profile = Profile::where('userid', '=', $uid)->first();
            $wallet = CivicWallet::where('user_id', '=', $uid)->first();

            if (! $profile) {
                return redirect('/twofa');
            }
            if ($profile->openchallenge == 1 || is_null($profile->openchallenge)) {
                return redirect('/twofachallenge');
            }

            $view->wallet_open = $profile->civic_wallet_open;
            $view->isCitizen = $profile->citizen;
            $view->isGP = $profile->general_public;
            $view->balance = 0;
            $view->public_address = '';

            if ($wallet) {
                $view->balance = AppHelper::getMarscoinBalance($wallet['public_addr']);
                $view->public_address = $wallet['public_addr'];
            }

            $view->myItems = InventoryItem::where('userid', '=', $uid)->orderBy('created_at', 'desc')->get();
        } else {
            $view->wallet_open = false;
            $view->isCitizen = false;
            $view->isGP = false;
            $view->balance = 0;
            $view->public_address = '';
            $view->myItems = collect();
        }

        return $view;
    }

    public function store(Request $request)
    {
        if (! Auth::check()) {
            return redirect('/login');
        }

        $uid = Auth::user()->id;
        $profile = Profile::where('userid', '=', $uid)->first();

        if (! $profile || ! $profile->civic_wallet_open) {
            return redirect('/inventory/all')->with('error', 'Wallet must be unlocked to add items.');
        }

        $request->validate([
            'name' => 'required|string|max:255',
            'description' => 'nullable|string|max:2000',
            'category' => 'required|string|in:'.implode(',', array_keys(InventoryItem::CATEGORIES)),
            'quantity' => 'required|integer|min:1|max:999999',
            'unit' => 'nullable|string|max:50',
            'location' => 'nullable|string|max:255',
            'condition' => 'required|string|in:'.implode(',', array_keys(InventoryItem::CONDITIONS)),
        ]);

        InventoryItem::create([
            'userid' => $uid,
            'name' => $request->input('name'),
            'description' => $request->input('description'),
            'category' => $request->input('category'),
            'quantity' => $request->input('quantity'),
            'unit' => $request->input('unit'),
            'location' => $request->input('location'),
            'condition' => $request->input('condition'),
        ]);

        return redirect('/inventory/all')->with('success', 'Item added to inventory.');
    }

    public function update(Request $request, $id)
    {
        if (! Auth::check()) {
            return redirect('/login');
        }

        $uid = Auth::user()->id;
        $item = InventoryItem::where('id', $id)->where('userid', $uid)->first();

        if (! $item) {
            return redirect('/inventory/all')->with('error', 'Item not found.');
        }

        $request->validate([
            'name' => 'required|string|max:255',
            'description' => 'nullable|string|max:2000',
            'category' => 'required|string|in:'.implode(',', array_keys(InventoryItem::CATEGORIES)),
            'quantity' => 'required|integer|min:1|max:999999',
            'unit' => 'nullable|string|max:50',
            'location' => 'nullable|string|max:255',
            'condition' => 'required|string|in:'.implode(',', array_keys(InventoryItem::CONDITIONS)),
        ]);

        $item->update($request->only(['name', 'description', 'category', 'quantity', 'unit', 'location', 'condition']));

        return redirect('/inventory/all')->with('success', 'Item updated.');
    }

    public function destroy($id)
    {
        if (! Auth::check()) {
            return redirect('/login');
        }

        $uid = Auth::user()->id;
        $item = InventoryItem::where('id', $id)->where('userid', $uid)->first();

        if (! $item) {
            return redirect('/inventory/all')->with('error', 'Item not found.');
        }

        $item->delete();

        return redirect('/inventory/all')->with('success', 'Item removed from inventory.');
    }
}

1	<?php
2
3	namespace App\Http\Controllers\Inventory;
4
5	use App\Http\Controllers\Controller;
6	use App\Includes\AppHelper;
7	use App\Models\CivicWallet;
8	use App\Models\InventoryItem;
9	use App\Models\Profile;
10	use Illuminate\Http\Request;
11	use Illuminate\Support\Facades\Auth;
12	use Illuminate\Support\Facades\View;
13
14	class InventoryController extends Controller
15	{
16	public function __construct() {}	2✔
17
18	public function showAll()	1✔
19	{
20	$view = View::make('inventory.dashboard');	1✔
21	$view->allItems = InventoryItem::orderBy('created_at', 'desc')->get();	1✔
22	$view->categories = InventoryItem::CATEGORIES;	1✔
23	$view->conditions = InventoryItem::CONDITIONS;	1✔
24
25	if (Auth::check()) {	1✔
NEW 26	$uid = Auth::user()->id;	×
NEW 27	$profile = Profile::where('userid', '=', $uid)->first();	×
NEW 28	$wallet = CivicWallet::where('user_id', '=', $uid)->first();	×
29
NEW 30	if (! $profile) {	×
NEW 31	return redirect('/twofa');	×
32	}
NEW 33	if ($profile->openchallenge == 1 \|\| is_null($profile->openchallenge)) {	×
NEW 34	return redirect('/twofachallenge');	×
35	}
36
NEW 37	$view->wallet_open = $profile->civic_wallet_open;	×
NEW 38	$view->isCitizen = $profile->citizen;	×
NEW 39	$view->isGP = $profile->general_public;	×
NEW 40	$view->balance = 0;	×
NEW 41	$view->public_address = '';	×
42
NEW 43	if ($wallet) {	×
NEW 44	$view->balance = AppHelper::getMarscoinBalance($wallet['public_addr']);	×
NEW 45	$view->public_address = $wallet['public_addr'];	×
46	}
47
NEW 48	$view->myItems = InventoryItem::where('userid', '=', $uid)->orderBy('created_at', 'desc')->get();	×
49	} else {
50	$view->wallet_open = false;	1✔
51	$view->isCitizen = false;	1✔
52	$view->isGP = false;	1✔
53	$view->balance = 0;	1✔
54	$view->public_address = '';	1✔
55	$view->myItems = collect();	1✔
56	}
57
58	return $view;	1✔
59	}
60
NEW 61	public function store(Request $request)	×
62	{
NEW 63	if (! Auth::check()) {	×
NEW 64	return redirect('/login');	×
65	}
66
NEW 67	$uid = Auth::user()->id;	×
NEW 68	$profile = Profile::where('userid', '=', $uid)->first();	×
69
NEW 70	if (! $profile \|\| ! $profile->civic_wallet_open) {	×
NEW 71	return redirect('/inventory/all')->with('error', 'Wallet must be unlocked to add items.');	×
72	}
73
NEW 74	$request->validate([	×
NEW 75	'name' => 'required\|string\|max:255',	×
NEW 76	'description' => 'nullable\|string\|max:2000',	×
NEW 77	'category' => 'required\|string\|in:'.implode(',', array_keys(InventoryItem::CATEGORIES)),	×
NEW 78	'quantity' => 'required\|integer\|min:1\|max:999999',	×
NEW 79	'unit' => 'nullable\|string\|max:50',	×
NEW 80	'location' => 'nullable\|string\|max:255',	×
NEW 81	'condition' => 'required\|string\|in:'.implode(',', array_keys(InventoryItem::CONDITIONS)),	×
NEW 82	]);	×
83
NEW 84	InventoryItem::create([	×
NEW 85	'userid' => $uid,	×
NEW 86	'name' => $request->input('name'),	×
NEW 87	'description' => $request->input('description'),	×
NEW 88	'category' => $request->input('category'),	×
NEW 89	'quantity' => $request->input('quantity'),	×
NEW 90	'unit' => $request->input('unit'),	×
NEW 91	'location' => $request->input('location'),	×
NEW 92	'condition' => $request->input('condition'),	×
NEW 93	]);	×
94
NEW 95	return redirect('/inventory/all')->with('success', 'Item added to inventory.');	×
96	}
97
NEW 98	public function update(Request $request, $id)	×
99	{
NEW 100	if (! Auth::check()) {	×
NEW 101	return redirect('/login');	×
102	}
103
NEW 104	$uid = Auth::user()->id;	×
NEW 105	$item = InventoryItem::where('id', $id)->where('userid', $uid)->first();	×
106
NEW 107	if (! $item) {	×
NEW 108	return redirect('/inventory/all')->with('error', 'Item not found.');	×
109	}
110
NEW 111	$request->validate([	×
NEW 112	'name' => 'required\|string\|max:255',	×
NEW 113	'description' => 'nullable\|string\|max:2000',	×
NEW 114	'category' => 'required\|string\|in:'.implode(',', array_keys(InventoryItem::CATEGORIES)),	×
NEW 115	'quantity' => 'required\|integer\|min:1\|max:999999',	×
NEW 116	'unit' => 'nullable\|string\|max:50',	×
NEW 117	'location' => 'nullable\|string\|max:255',	×
NEW 118	'condition' => 'required\|string\|in:'.implode(',', array_keys(InventoryItem::CONDITIONS)),	×
NEW 119	]);	×
120
NEW 121	$item->update($request->only(['name', 'description', 'category', 'quantity', 'unit', 'location', 'condition']));	×
122
NEW 123	return redirect('/inventory/all')->with('success', 'Item updated.');	×
124	}
125
NEW 126	public function destroy($id)	×
127	{
NEW 128	if (! Auth::check()) {	×
NEW 129	return redirect('/login');	×
130	}
131
NEW 132	$uid = Auth::user()->id;	×
NEW 133	$item = InventoryItem::where('id', $id)->where('userid', $uid)->first();	×
134
NEW 135	if (! $item) {	×
NEW 136	return redirect('/inventory/all')->with('error', 'Item not found.');	×
137	}
138
NEW 139	$item->delete();	×
140
NEW 141	return redirect('/inventory/all')->with('success', 'Item removed from inventory.');	×
142	}
143	}

marscoin / martianrepublic / 23804883405

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous