3 Commits

Author	SHA1	Message	Date
Darko Gjorgjijoski	b73dcb5278	fix: boot app + AI driver registration on invoiceshelf/modules 3.0.3 (via VCS) (#655) ... * fix(deps): require invoiceshelf/modules ^3.0.2 (adds registerExchangeRateDriver) DriverRegistryProvider::registerExchangeRateDrivers() calls Registry::registerExchangeRateDriver(), which only exists in invoiceshelf/modules >= 3.0.2. The constraint (^3.0) and the committed lock (3.0.1) allowed/pinned versions without it, so a fresh `composer install` (CI, Docker, new clones) boots into: Call to undefined method InvoiceShelf\Modules\Registry::registerExchangeRateDriver() Pin to ^3.0.2 and update the lock so every install gets a version that has the method. `php artisan package:discover` verified clean. * fix(ai): register the AI driver via the generic Registry::registerDriver('ai', ...) registerAiDriver() is a convenience wrapper that is NOT present in any published invoiceshelf/modules release (only the generic registerDriver() and registerExchangeRateDriver() ship), so DriverRegistryProvider crashed app boot on a clean composer install: Call to undefined method InvoiceShelf\Modules\Registry::registerAiDriver() Use registerDriver('ai', 'openrouter', ...) instead -- it stores under the 'ai' type exactly like the wrapper would, and AiConfigurationService / AiDriverFactory read it back via allDrivers('ai') / driverMeta('ai', ...). Verified by clean-reinstalling invoiceshelf/modules (no local patch) and running `php artisan package:discover` -> boots clean. * style: fix pre-existing Pint violations in backup services BackupService.php and BackupConfigurationFactory.php (untouched by this PR's boot fix) carried style violations from an earlier domain-reorg refactor (6d1816bd). `pint --test` checks the whole tree and runs on any PR that touches PHP, so these failed CI here. Auto-fixed with Pint (braces_position, no_unused_imports, single_line_empty_body) so the check goes green. * build(deps): pull invoiceshelf/modules ^3.0.3 via VCS, restore registerAiDriver() The 3.0.3 release adds Registry::registerAiDriver() (the method DriverRegistryProvider and AiDriverFactoryTest call). Packagist has the package frozen, so resolve it directly from the canonical GitHub repo via a composer VCS repository and require ^3.0.3 (the tag exists; the freeze is Packagist-side only). Now that the method ships, restore DriverRegistryProvider to Registry::registerAiDriver() — reverting the temporary generic registerDriver('ai', ...) workaround — so it matches the package's intended API and the existing tests. The provider is now net-identical to 3.x. Verified: php artisan package:discover boots clean; the AI suite (incl. the previously failing AiDriverFactoryTest) passes. * test: provision modules_statuses.json in the test bootstrap The Modules/HelloWorld integration test needs the module enabled at the nwidart level, read from storage/app/modules_statuses.json at app boot. That file is gitignored (created locally by `module:make`), so it's absent on CI and fresh clones — HelloWorld stays disabled and the 5 integration tests fail with 404s. Provision it (only if missing) in tests/Pest.php before any test boots the app, so CI matches a local dev environment. Full suite: 462 pass. * fix(test): enable HelloWorld via a committed modules_statuses.json The Modules/HelloWorld integration test needs the module enabled at the nwidart level — read from storage/app/modules_statuses.json by FileActivator. That file is gitignored, so it's absent in CI / fresh clones, leaving HelloWorld disabled and the 5 integration tests failing with 404s. The previous tests/Pest.php provisioning (60a7f0d6) only worked under `./vendor/bin/pest`. CI runs `php artisan test`, which boots the console app first; FileActivator reads and caches the (absent) statuses at construction BEFORE Pest.php runs, so test-runtime provisioning is too late. The file must exist before any boot. Commit the file via a storage/app/.gitignore negation, and revert the ineffective Pest.php hack. Prod-safe: Modules/ is gitignored and not copied by release.yaml, so a phantom "HelloWorld: true" status is ignored by nwidart (no such module on disk). bootstrap/cache/modules.php is gitignored (absent in CI), so nothing overrides the committed file. Verified with `php artisan test --filter=HelloWorld` (the CI command) and the full suite: 462 pass; pint clean. * fix(test): commit the Modules/HelloWorld sample module HelloWorldIntegrationTest exercises Modules/HelloWorld end-to-end, but Modules/ was gitignored (/Modules), so the module was absent from the repo and from CI — the 5 integration tests 404'd, and the committed modules_statuses.json merely enabled a module that wasn't there. Track Modules/HelloWorld (the test fixture) via a `/Modules/*` + `!HelloWorld` negation. Not shipped to prod (release.yaml omits Modules/). Now the module is present, autoloaded (merge-plugin), and enabled (statuses file), so its provider boots and the menu/settings/routes register. * build: drop the boost:update post-update-cmd hook (breaks CI) laravel/boost gates its commands to the local environment, so `php artisan boost:update` fails in CI ("There are no commands defined in the boost namespace"), making composer's post-update-cmd return exit 1. It only began failing the build once Modules/HelloWorld/composer.json was committed: the wikimedia merge-plugin then runs composer's update path on a plain `composer install`, triggering post-update-cmd. Drop the auto-update hook (run `boost:update` manually when needed); vendor:publish stays.	2026-06-05 14:57:06 +02:00
Darko Gjorgjijoski	ac2a8ca939	fix(security): gate AI tools by user ability and block admin-URL SSRF ... The AI chat assistant scoped tool queries by company but ignored the per-user Bouncer abilities the rest of the app enforces, so any `use ai` holder could read customers, invoices, payments, and company financials their role couldn't otherwise see. Each AiTool now declares a required ability (entity-aligned); the registry hides unauthorized tools from the model and refuses to execute them as a backstop. Separately, admin/owner-supplied URLs were fetched server-side with no guard against private/reserved targets (SSRF): the AI base URL, the CurrencyConverter "DEDICATED" exchange-rate URL, and S3/Spaces file-disk endpoints. A shared PrivateNetworkGuard now backs a PublicHttpUrl validation rule (save-time) and runtime guards in each driver. - AiTool::requiredAbility() + mapping across all 12 tools - AiToolRegistry filters schemas() by ability and re-checks in execute() - PrivateNetworkGuard / BlockedUrlException / PublicHttpUrl rule (new) - Rule wired into AI config (service + 3 controllers), exchange-rate, and file-disk endpoints; runtime guards in OpenRouterDriver, CurrencyConverterDriver, and FileDiskService - Tests for ability filtering, the guard, the rule, and 422 rejections	2026-06-05 00:01:09 +02:00
Darko Gjorgjijoski	6d1816bd1b	refactor: reorganize app/Services and app/Support by domain ... The app/Services/ directory had grown into 22 flat files at the root plus 7 uneven subdirectories — finding anything required scrolling through an alphabetical mix of small CRUD services, infrastructure drivers, and install-time utilities. This commit groups services by domain, folds Backup into a new Storage namespace, and moves framework-infrastructure and install-time helpers out of Services and into Support where they belong. New Services layout: Documents/ (Invoice, Estimate, RecurringInvoice, Payment, Expense, Transaction, DocumentItem, SerialNumber, Currency — matches the 'Documents' navigation group); Company/ (Company, Member, Invitation); Mail/ (MailConfiguration, CompanyMailConfig); Storage/ (FileDisk, plus Backup folded in). ExchangeRateProviderService moves next to its drivers in ExchangeRate/; FontService moves into Pdf/ where it belongs. CustomerService, ItemService, CustomFieldService stay at the Services root as standalone single-file domains. Moves to Support/: Hashids/ (library wrapper — not business logic); Setup/ (one-shot install-time utilities — stateless helpers); Pdf/ (ImageUtils, PdfTemplateUtils, plus the existing PdfHtmlSanitizer consolidated into the same subdir). These are all framework infrastructure and stateless utilities — the 'service' label never really fit them. Namespace declarations in 29 moved files updated to match new paths. 62 consumer files (controllers, other services, tests, database factories, seeders, routes, bootstrap/providers.php) have their use statements rewritten via a literal-string replacement script — no regex meant no risk of half-matching. Three Documents services needed an explicit 'use App\Services\Mail\CompanyMailConfigService' added because the same-namespace short reference they relied on no longer resolves after the split. Verified: composer dump-autoload, 350 tests pass (850 assertions), vendor/bin/pint clean, npm run build succeeds.	2026-04-11 10:00:00 +02:00