Merge pull request #549 from HiEventsDev/develop

Author: daveearley

backend/app/Http/Actions/Accounts/CreateAccountAction.php

@@ -17,6 +17,7 @@
 use HiEvents\Services\Application\Handlers\Auth\DTO\LoginCredentialsDTO;
 use HiEvents\Services\Application\Handlers\Auth\LoginHandler;
 use HiEvents\Services\Application\Locale\LocaleService;
+use Illuminate\Contracts\Encryption\DecryptException;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Validation\ValidationException;
 use Throwable;
@@ -54,6 +55,10 @@ public function __invoke(CreateAccountRequest $request): JsonResponse
             throw ValidationException::withMessages([
                 'email' => $e->getMessage(),
             ]);
+        } catch (DecryptException $e) {
+            throw ValidationException::withMessages([
+                'invite_token' => __('Invalid invite token'),
+            ]);
         } catch (AccountRegistrationDisabledException) {
             return $this->errorResponse(
                 message: __('Account registration is disabled'),

backend/app/Http/Actions/Auth/ResetPasswordAction.php

@@ -2,6 +2,7 @@
 
 namespace HiEvents\Http\Actions\Auth;
 
+use HiEvents\Exceptions\InvalidPasswordResetTokenException;
 use HiEvents\Exceptions\PasswordInvalidException;
 use HiEvents\Http\Actions\BaseAction;
 use HiEvents\Http\Request\Auth\ResetPasswordRequest;
@@ -37,6 +38,8 @@ public function __invoke(ResetPasswordRequest $request): JsonResponse
             throw ValidationException::withMessages([
                 'current_password' => $exception->getMessage(),
             ]);
+        } catch (InvalidPasswordResetTokenException $e) {
+            throw new ResourceNotFoundException($e->getMessage());
         }
 
         return $this->jsonResponse(

backend/app/Jobs/Event/SendEventEmailJob.php

@@ -5,15 +5,13 @@
 use HiEvents\DomainObjects\Generated\OutgoingMessageDomainObjectAbstract;
 use HiEvents\DomainObjects\Status\OutgoingMessageStatus;
 use HiEvents\Mail\Event\EventMessage;
-use HiEvents\Providers\AppServiceProvider;
 use HiEvents\Repository\Interfaces\OutgoingMessageRepositoryInterface;
 use HiEvents\Services\Application\Handlers\Message\DTO\SendMessageDTO;
 use Illuminate\Bus\Queueable;
 use Illuminate\Contracts\Queue\ShouldQueue;
 use Illuminate\Foundation\Bus\Dispatchable;
 use Illuminate\Mail\Mailer;
 use Illuminate\Queue\InteractsWithQueue;
-use Illuminate\Queue\Middleware\RateLimited;
 use Illuminate\Queue\SerializesModels;
 use Throwable;
 
@@ -30,13 +28,6 @@ public function __construct(
     {
     }
 
-    public function middleware(): array
-    {
-        return [
-            (new RateLimited(AppServiceProvider::MAIL_RATE_LIMIT_PER_SECOND)),
-        ];
-    }
-
     /**
      * @throws Throwable
      */

backend/app/Models/Account.php

@@ -5,13 +5,15 @@
 namespace HiEvents\Models;
 
 use HiEvents\DomainObjects\Enums\Role;
+use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Database\Eloquent\Relations\BelongsTo;
 use Illuminate\Database\Eloquent\Relations\BelongsToMany;
 use Illuminate\Database\Eloquent\SoftDeletes;
 
 class Account extends BaseModel
 {
     use SoftDeletes;
+    use HasFactory;
 
     public function users(): BelongsToMany
     {

backend/app/Models/User.php

@@ -10,6 +10,7 @@
 use Illuminate\Contracts\Auth\Access\Authorizable as AuthorizableContract;
 use Illuminate\Contracts\Auth\Authenticatable as AuthenticatableContract;
 use Illuminate\Contracts\Auth\CanResetPassword as CanResetPasswordContract;
+use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Database\Eloquent\Relations\BelongsToMany;
 use Illuminate\Database\Eloquent\Relations\HasOne;
 use Illuminate\Database\Eloquent\Relations\HasOneThrough;
@@ -27,6 +28,7 @@ class User extends BaseModel implements AuthenticatableContract, AuthorizableCon
     use Authorizable;
     use CanResetPassword;
     use MustVerifyEmail;
+    use HasFactory;
 
     /** @var array */
     protected $guarded = [];

backend/app/Providers/AppServiceProvider.php

@@ -12,21 +12,16 @@
 use HiEvents\Services\Infrastructure\CurrencyConversion\CurrencyConversionClientInterface;
 use HiEvents\Services\Infrastructure\CurrencyConversion\NoOpCurrencyConversionClient;
 use HiEvents\Services\Infrastructure\CurrencyConversion\OpenExchangeRatesCurrencyConversionClient;
-use Illuminate\Cache\RateLimiting\Limit;
-use Illuminate\Contracts\Queue\ShouldQueue;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Database\Eloquent\Relations\Relation;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\File;
-use Illuminate\Support\Facades\RateLimiter;
 use Illuminate\Support\Facades\URL;
 use Illuminate\Support\ServiceProvider;
 use Stripe\StripeClient;
 
 class AppServiceProvider extends ServiceProvider
 {
-    public const MAIL_RATE_LIMIT_PER_SECOND = 'mail-rate-limit-per-second';
-
     public function register(): void
     {
         $this->bindDoctrineConnection();
@@ -46,18 +41,6 @@ public function boot(): void
         $this->disableLazyLoading();
 
         $this->registerMorphMaps();
-
-        $this->registerJobRateLimiters();
-    }
-
-    private function registerJobRateLimiters(): void
-    {
-        RateLimiter::for(
-            name: self::MAIL_RATE_LIMIT_PER_SECOND,
-            callback: static fn(ShouldQueue $job) => Limit::perMinute(
-                maxAttempts: config('mail.rate_limit_per_second')
-            )
-        );
     }
 
     private function bindDoctrineConnection(): void

backend/app/Services/Application/Handlers/Auth/ForgotPasswordHandler.php

@@ -8,7 +8,7 @@
 use HiEvents\Repository\Interfaces\UserRepositoryInterface;
 use HiEvents\Services\Infrastructure\TokenGenerator\TokenGeneratorService;
 use Illuminate\Database\DatabaseManager;
-use Illuminate\Mail\Mailer;
+use Illuminate\Contracts\Mail\Mailer;
 use Psr\Log\LoggerInterface;
 use Symfony\Component\Routing\Exception\ResourceNotFoundException;
 use Throwable;

backend/app/Services/Application/Handlers/Auth/ResetPasswordHandler.php

@@ -3,14 +3,15 @@
 namespace HiEvents\Services\Application\Handlers\Auth;
 
 use HiEvents\DomainObjects\UserDomainObject;
+use HiEvents\Exceptions\PasswordInvalidException;
 use HiEvents\Mail\User\ResetPasswordSuccess;
 use HiEvents\Repository\Interfaces\PasswordResetTokenRepositoryInterface;
 use HiEvents\Repository\Interfaces\UserRepositoryInterface;
 use HiEvents\Services\Application\Handlers\Auth\DTO\ResetPasswordDTO;
 use HiEvents\Services\Domain\Auth\ResetPasswordTokenValidateService;
+use Illuminate\Contracts\Mail\Mailer;
 use Illuminate\Database\DatabaseManager;
 use Illuminate\Hashing\HashManager;
-use Illuminate\Mail\Mailer;
 use Psr\Log\LoggerInterface;
 use Symfony\Component\Routing\Exception\ResourceNotFoundException;
 use Throwable;
@@ -38,13 +39,22 @@ public function handle(ResetPasswordDTO $resetPasswordData): void
             $resetToken = $this->passwordTokenValidateService->validateAndFetchToken($resetPasswordData->token);
             $user = $this->validateUser($resetToken->getEmail());
 
+            if ($this->checkNewPasswordIsOldPassword($user, $resetPasswordData->password)) {
+                throw new PasswordInvalidException(__('New password must be different from the old password.'));
+            }
+
             $this->resetUserPassword($user->getId(), $resetPasswordData->password);
             $this->deleteResetToken($resetToken->getEmail());
             $this->logResetPasswordSuccess($user);
             $this->sendResetPasswordEmail($user);
         });
     }
 
+    private function checkNewPasswordIsOldPassword(UserDomainObject $user, string $newPassword): bool
+    {
+        return $this->hashManager->check($newPassword, $user->getPassword());
+    }
+
     private function validateUser(string $email): UserDomainObject
     {
         $user = $this->userRepository->findFirstWhere(['email' => $email]);
@@ -72,7 +82,7 @@ private function deleteResetToken(string $email): void
         $this->passwordResetTokenRepository->deleteWhere(['email' => $email]);
     }
 
-    private function logResetPasswordSuccess($user): void
+    private function logResetPasswordSuccess(UserDomainObject $user): void
     {
         $this->logger->info('Password reset successfully', [
                 'user_id' => $user->getId(),

backend/app/Services/Domain/Payment/Stripe/EventHandlers/PaymentIntentSucceededHandler.php

@@ -233,7 +233,7 @@ private function storeApplicationFeePayment(OrderDomainObject $updatedOrder, Pay
     {
         $this->orderApplicationFeeService->createOrderApplicationFee(
             orderId: $updatedOrder->getId(),
-            applicationFeeAmountMinorUnit: $paymentIntent->application_fee_amount,
+            applicationFeeAmountMinorUnit: $paymentIntent->application_fee_amount ?? 0,
             orderApplicationFeeStatus: OrderApplicationFeeStatus::PAID,
             paymentMethod: PaymentProviders::STRIPE,
             currency: $updatedOrder->getCurrency(),

backend/database/factories/AccountFactory.php

@@ -0,0 +1,73 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Database\Factories;
+
+use HiEvents\Helper\IdHelper;
+use Illuminate\Database\Eloquent\Factories\Factory;
+
+/**
+ * @extends \Illuminate\Database\Eloquent\Factories\Factory<\HiEvents\Models\Account>
+ */
+class AccountFactory extends Factory
+{
+    /**
+     * Define the model's default state.
+     *
+     * @return array<string, mixed>
+     */
+    public function definition(): array
+    {
+        $currencies = include base_path('data/currencies.php');
+
+        return [
+            'name' => fake()->name(),
+            'email' => fake()->unique()->safeEmail(),
+            'timezone' => fake()->timezone(),
+            'currency_code' => fake()->randomElement(array_values($currencies)),
+            'short_id' => IdHelper::shortId(IdHelper::ACCOUNT_PREFIX),
+            'account_configuration_id' => 1, // Default account configuration is first entry
+        ];
+    }
+
+    /**
+     * Indicate that the model's stripe account id is set.
+     */
+    public function stripeAccount(): self
+    {
+        return $this->state(fn(array $attributes) => [
+            'stripe_account_id' => fake()->stripeConnectAccountId(),
+        ]);
+    }
+
+    /**
+     * Indicate that the model's stripe account connection setup is complete.
+     */
+    public function stripeConnectSetupComplete(bool $isComplete = true): self
+    {
+        return $this->state(fn(array $attributes) => [
+            'stripe_connect_setup_complete' => $isComplete,
+        ]);
+    }
+
+    /**
+     * Indicate that the model is verified.
+     */
+    public function verified(): self
+    {
+        return $this->state(fn(array $attributes) => [
+            'account_verified_at' => now(),
+        ]);
+    }
+
+    /**
+     * Indicate that the model has been manually verified.
+     */
+    public function manuallyVerified(): self
+    {
+        return $this->state(fn(array $attributes) => [
+            'is_manually_verified' => true,
+        ]);
+    }
+}