23804883405

Committed 31 Mar 2026 03:14PM UTC coverage: 11.195% (+1.8%) from 9.347%

Build Type

push

github

Committed by Martian Congress

Commit Message

refactor: Tier 1 — security fixes, route standardization, code style, docs

S9:  File upload path traversal — assert realpath() within allowed dirs,
     sanitize citizen address in file paths
S11: Citizen registry queries capped with LIMIT 100
S12: External HTTP calls — replaced file_get_contents with Http::timeout()
     in CongressController, Wallet/ApiController, AppHelper
A8:  All routes converted to Laravel 9+ array notation
     [Controller::class, 'method']
D2:  Created DEVELOPMENT.md — complete setup guide for contributors
D4:  Laravel Pint code style enforced across 211 files

Tests updated: public route assertions corrected after route syntax
standardization exposed that old string-notation routes never resolved
properly in tests.

127 tests, 251 assertions, 0 PHPStan errors.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Coverage Stats

302 of 3262 new or added lines in 58 files covered. (9.26%)

139 existing lines in 24 files now uncovered.

620 of 5538 relevant lines covered (11.2%)

1.54 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

20.0

/app/Models/User.php

<?php

namespace App\Models;

use Illuminate\Database\Eloquent\Factories\HasFactory;
use Illuminate\Database\Eloquent\Relations\HasMany;
use Illuminate\Database\Eloquent\Relations\HasOne;
use Illuminate\Foundation\Auth\User as Authenticatable;
use Illuminate\Notifications\Notifiable;
use Laravel\Sanctum\HasApiTokens;

/**
 * @property Profile $profile
 * @property Feed[] $feeds
 * @property HDWallet $hdWallet
 * @property Citizen $citizen
 * @property CivicWallet $civicWallet
 */
class User extends Authenticatable
{
    use HasApiTokens, HasFactory, Notifiable;

    /**
     * The attributes that are mass assignable.
     *
     * @var array<int, string>
     */
    protected $fillable = [
        'fullname',
        'email',
        'password',
        'status',
    ];

    /**
     * The attributes that should be hidden for serialization.
     *
     * @var array<int, string>
     */
    protected $hidden = [
        'password',
        'remember_token',
    ];

    /**
     * The attributes that should be cast.
     *
     * @var array<string, string>
     */
    protected $casts = [
        'email_verified_at' => 'datetime',
    ];

    // Define the relationship to Profile
    public function profile(): HasOne
    {
        return $this->hasOne(Profile::class, 'userid', 'id');
    }

    // Define the relationship to Feed
    public function feeds(): HasMany
    {
        return $this->hasMany(Feed::class, 'userid', 'id');
    }

    public function hdWallet(): HasOne
    {
        return $this->hasOne(HDWallet::class, 'user_id');
    }

    public function citizen(): HasOne
    {
        return $this->hasOne(Citizen::class, 'userid');
    }

    /**
     * Get the user's civic wallet.
     */
    public function civicWallet(): HasOne
    {
        return $this->hasOne(CivicWallet::class, 'user_id');
    }
}

1	<?php
2
3	namespace App\Models;
4
5	use Illuminate\Database\Eloquent\Factories\HasFactory;
6	use Illuminate\Database\Eloquent\Relations\HasMany;
7	use Illuminate\Database\Eloquent\Relations\HasOne;
8	use Illuminate\Foundation\Auth\User as Authenticatable;
9	use Illuminate\Notifications\Notifiable;
10	use Laravel\Sanctum\HasApiTokens;
11
12	/**
13	* @property Profile $profile
14	* @property Feed[] $feeds
15	* @property HDWallet $hdWallet
16	* @property Citizen $citizen
17	* @property CivicWallet $civicWallet
18	*/
19	class User extends Authenticatable
20	{
21	use HasApiTokens, HasFactory, Notifiable;
22
23	/**
24	* The attributes that are mass assignable.
25	*
26	* @var array<int, string>
27	*/
28	protected $fillable = [
29	'fullname',
30	'email',
31	'password',
32	'status',
33	];
34
35	/**
36	* The attributes that should be hidden for serialization.
37	*
38	* @var array<int, string>
39	*/
40	protected $hidden = [
41	'password',
42	'remember_token',
43	];
44
45	/**
46	* The attributes that should be cast.
47	*
48	* @var array<string, string>
49	*/
50	protected $casts = [
51	'email_verified_at' => 'datetime',
52	];
53
54	// Define the relationship to Profile
55	public function profile(): HasOne	1✔
56	{
57	return $this->hasOne(Profile::class, 'userid', 'id');	1✔
58	}
59
60	// Define the relationship to Feed
NEW 61	public function feeds(): HasMany	×
62	{
63	return $this->hasMany(Feed::class, 'userid', 'id');	×
64	}
65
66	public function hdWallet(): HasOne	×
67	{
68	return $this->hasOne(HDWallet::class, 'user_id');	×
69	}
70
71	public function citizen(): HasOne	×
72	{
73	return $this->hasOne(Citizen::class, 'userid');	×
74	}
75
76	/**
77	* Get the user's civic wallet.
78	*/
UNCOV 79	public function civicWallet(): HasOne	×
80	{
81	return $this->hasOne(CivicWallet::class, 'user_id');	×
82	}
83	}

marscoin / martianrepublic / 23804883405

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous