Add Fortify auth, Flux dark mode, demo seed, and Docker hot reload.

Protect recordings per user, seed a demo login on container start, and bind-mount the app with Vite HMR for local Compose development.

app/Actions/Fortify/CreateNewUser.php

@@ -0,0 +1,33 @@
+<?php
+
+namespace App\Actions\Fortify;
+
+use App\Concerns\PasswordValidationRules;
+use App\Concerns\ProfileValidationRules;
+use App\Models\User;
+use Illuminate\Support\Facades\Validator;
+use Laravel\Fortify\Contracts\CreatesNewUsers;
+
+class CreateNewUser implements CreatesNewUsers
+{
+    use PasswordValidationRules, ProfileValidationRules;
+
+    /**
+     * Validate and create a newly registered user.
+     *
+     * @param  array<string, string>  $input
+     */
+    public function create(array $input): User
+    {
+        Validator::make($input, [
+            ...$this->profileRules(),
+            'password' => $this->passwordRules(),
+        ])->validate();
+
+        return User::create([
+            'name' => $input['name'],
+            'email' => $input['email'],
+            'password' => $input['password'],
+        ]);
+    }
+}

app/Actions/Fortify/PasswordValidationRules.php

@@ -0,0 +1,19 @@
+<?php
+
+namespace App\Actions\Fortify;
+
+use Illuminate\Contracts\Validation\Rule;
+use Illuminate\Validation\Rules\Password;
+
+trait PasswordValidationRules
+{
+    /**
+     * Get the validation rules used to validate passwords.
+     *
+     * @return array<int, Rule|array<mixed>|string>
+     */
+    protected function passwordRules(): array
+    {
+        return ['required', 'string', Password::default(), 'confirmed'];
+    }
+}

app/Actions/Fortify/ResetUserPassword.php

@@ -0,0 +1,29 @@
+<?php
+
+namespace App\Actions\Fortify;
+
+use App\Concerns\PasswordValidationRules;
+use App\Models\User;
+use Illuminate\Support\Facades\Validator;
+use Laravel\Fortify\Contracts\ResetsUserPasswords;
+
+class ResetUserPassword implements ResetsUserPasswords
+{
+    use PasswordValidationRules;
+
+    /**
+     * Validate and reset the user's forgotten password.
+     *
+     * @param  array<string, string>  $input
+     */
+    public function reset(User $user, array $input): void
+    {
+        Validator::make($input, [
+            'password' => $this->passwordRules(),
+        ])->validate();
+
+        $user->forceFill([
+            'password' => $input['password'],
+        ])->save();
+    }
+}

app/Actions/Fortify/UpdateUserPassword.php

@@ -0,0 +1,35 @@
+<?php
+
+namespace App\Actions\Fortify;
+
+use App\Models\User;
+use Illuminate\Support\Facades\Hash;
+use Illuminate\Support\Facades\Validator;
+use Illuminate\Validation\ValidationException;
+use Laravel\Fortify\Contracts\UpdatesUserPasswords;
+
+class UpdateUserPassword implements UpdatesUserPasswords
+{
+    use PasswordValidationRules;
+
+    /**
+     * Validate and update the user's password.
+     *
+     * @param  array<string, string>  $input
+     *
+     * @throws ValidationException
+     */
+    public function update(User $user, array $input): void
+    {
+        Validator::make($input, [
+            'current_password' => ['required', 'string', 'current_password:web'],
+            'password' => $this->passwordRules(),
+        ], [
+            'current_password.current_password' => __('The provided password does not match your current password.'),
+        ])->validateWithBag('updatePassword');
+
+        $user->forceFill([
+            'password' => Hash::make($input['password']),
+        ])->save();
+    }
+}

app/Actions/Fortify/UpdateUserProfileInformation.php

@@ -0,0 +1,61 @@
+<?php
+
+namespace App\Actions\Fortify;
+
+use App\Models\User;
+use Illuminate\Contracts\Auth\MustVerifyEmail;
+use Illuminate\Support\Facades\Validator;
+use Illuminate\Validation\Rule;
+use Illuminate\Validation\ValidationException;
+use Laravel\Fortify\Contracts\UpdatesUserProfileInformation;
+
+class UpdateUserProfileInformation implements UpdatesUserProfileInformation
+{
+    /**
+     * Validate and update the given user's profile information.
+     *
+     * @param  array<string, string>  $input
+     *
+     * @throws ValidationException
+     */
+    public function update(User $user, array $input): void
+    {
+        Validator::make($input, [
+            'name' => ['required', 'string', 'max:255'],
+
+            'email' => [
+                'required',
+                'string',
+                'email',
+                'max:255',
+                Rule::unique('users')->ignore($user->id),
+            ],
+        ])->validateWithBag('updateProfileInformation');
+
+        if ($input['email'] !== $user->email &&
+            $user instanceof MustVerifyEmail) {
+            $this->updateVerifiedUser($user, $input);
+        } else {
+            $user->forceFill([
+                'name' => $input['name'],
+                'email' => $input['email'],
+            ])->save();
+        }
+    }
+
+    /**
+     * Update the given verified user's profile information.
+     *
+     * @param  array<string, string>  $input
+     */
+    protected function updateVerifiedUser(User $user, array $input): void
+    {
+        $user->forceFill([
+            'name' => $input['name'],
+            'email' => $input['email'],
+            'email_verified_at' => null,
+        ])->save();
+
+        $user->sendEmailVerificationNotification();
+    }
+}

app/Concerns/PasswordValidationRules.php

@@ -0,0 +1,29 @@
+<?php
+
+namespace App\Concerns;
+
+use Illuminate\Contracts\Validation\ValidationRule;
+use Illuminate\Validation\Rules\Password;
+
+trait PasswordValidationRules
+{
+    /**
+     * Get the validation rules used to validate passwords.
+     *
+     * @return array<int, Password|ValidationRule|array<mixed>|string>
+     */
+    protected function passwordRules(): array
+    {
+        return ['required', 'string', Password::default(), 'confirmed'];
+    }
+
+    /**
+     * Get the validation rules used to validate the current password.
+     *
+     * @return array<int, Password|ValidationRule|array<mixed>|string>
+     */
+    protected function currentPasswordRules(): array
+    {
+        return ['required', 'string', 'current_password'];
+    }
+}

app/Concerns/ProfileValidationRules.php

@@ -0,0 +1,51 @@
+<?php
+
+namespace App\Concerns;
+
+use App\Models\User;
+use Illuminate\Contracts\Validation\ValidationRule;
+use Illuminate\Validation\Rule;
+
+trait ProfileValidationRules
+{
+    /**
+     * Get the validation rules used to validate user profiles.
+     *
+     * @return array<string, array<int, ValidationRule|array<mixed>|string>>
+     */
+    protected function profileRules(?int $userId = null): array
+    {
+        return [
+            'name' => $this->nameRules(),
+            'email' => $this->emailRules($userId),
+        ];
+    }
+
+    /**
+     * Get the validation rules used to validate user names.
+     *
+     * @return array<int, ValidationRule|array<mixed>|string>
+     */
+    protected function nameRules(): array
+    {
+        return ['required', 'string', 'max:255'];
+    }
+
+    /**
+     * Get the validation rules used to validate user emails.
+     *
+     * @return array<int, ValidationRule|array<mixed>|string>
+     */
+    protected function emailRules(?int $userId = null): array
+    {
+        return [
+            'required',
+            'string',
+            'email',
+            'max:255',
+            $userId === null
+                ? Rule::unique(User::class)
+                : Rule::unique(User::class)->ignore($userId),
+        ];
+    }
+}

app/Events/RecordingTranscriptionUpdated.php

@@ -3,8 +3,8 @@
 namespace App\Events;
 
 use App\Models\Recording;
-use Illuminate\Broadcasting\Channel;
 use Illuminate\Broadcasting\InteractsWithSockets;
+use Illuminate\Broadcasting\PrivateChannel;
 use Illuminate\Contracts\Broadcasting\ShouldBroadcastNow;
 use Illuminate\Foundation\Events\Dispatchable;
 use Illuminate\Queue\SerializesModels;
@@ -21,12 +21,12 @@ class RecordingTranscriptionUpdated implements ShouldBroadcastNow
     /**
      * Get the channels the event should broadcast on.
      *
-     * @return array<int, Channel>
+     * @return array<int, PrivateChannel>
      */
     public function broadcastOn(): array
     {
         return [
-            new Channel('recordings'),
+            new PrivateChannel('recording.'.$this->recording->id),
         ];
     }
 

app/Http/Controllers/CancelTranscriptionController.php

@@ -4,6 +4,7 @@ namespace App\Http\Controllers;
 
 use App\Models\Recording;
 use Illuminate\Http\RedirectResponse;
+use Illuminate\Support\Facades\Gate;
 
 class CancelTranscriptionController extends Controller
 {
@@ -12,6 +13,8 @@ class CancelTranscriptionController extends Controller
      */
     public function __invoke(Recording $recording): RedirectResponse
     {
+        Gate::authorize('transcribe', $recording);
+
         if (! $recording->isTranscribing()) {
             return back()->with('error', 'No transcription is currently running.');
         }

app/Http/Controllers/RecordingController.php

@@ -8,6 +8,7 @@ use App\Services\Mp3MetadataService;
 use Illuminate\Http\RedirectResponse;
 use Illuminate\Http\Request;
 use Illuminate\Http\UploadedFile;
+use Illuminate\Support\Facades\Gate;
 use Illuminate\Support\Facades\Storage;
 use Illuminate\View\View;
 
@@ -18,12 +19,14 @@ class RecordingController extends Controller
      */
     public function index(Request $request): View
     {
-        Recording::query()
+        $user = $request->user();
+
+        $user->recordings()
             ->whereIn('transcription_status', ['pending', 'processing'])
             ->orderBy('id')
             ->each(fn (Recording $recording) => $recording->recoverOrphanedTranscription());
 
-        $query = Recording::query()->latest();
+        $query = $user->recordings()->latest();
 
         if ($search = $request->string('q')->trim()->toString()) {
             $query->search($search);
@@ -31,7 +34,7 @@ class RecordingController extends Controller
 
         $recordings = $query->paginate(20)->withQueryString();
 
-        $pendingCount = Recording::query()
+        $pendingCount = $user->recordings()
             ->whereIn('transcription_status', ['pending', 'failed', 'cancelled'])
             ->get()
             ->filter(fn (Recording $recording) => ! $recording->hasActiveTranscriptionJob())
@@ -47,9 +50,9 @@ class RecordingController extends Controller
     /**
      * Show the upload form.
      */
-    public function create(): View
+    public function create(Request $request): View
     {
-        $existingFingerprints = Recording::query()
+        $existingFingerprints = $request->user()->recordings()
             ->get(['original_filename', 'file_size_bytes'])
             ->map(fn (Recording $recording) => $this->uploadFingerprint(
                 $recording->original_filename,
@@ -75,6 +78,7 @@ class RecordingController extends Controller
             fn ($file) => $file instanceof UploadedFile,
         ));
 
+        $user = $request->user();
         $titleOverride = $request->string('title')->trim()->toString();
         $recordings = [];
         $skippedDuplicates = 0;
@@ -89,8 +93,8 @@ class RecordingController extends Controller
 
             if (
                 isset($seenHashes[$hash])
-                || Recording::query()->where('content_hash', $hash)->exists()
-                || Recording::query()
+                || $user->recordings()->where('content_hash', $hash)->exists()
+                || $user->recordings()
                     ->where('original_filename', $file->getClientOriginalName())
                     ->where('file_size_bytes', $file->getSize() ?: 0)
                     ->exists()
@@ -106,7 +110,7 @@ class RecordingController extends Controller
                 ? $titleOverride
                 : null;
 
-            $recordings[] = $this->storeUploadedRecording($file, $metadata, $hash, $title);
+            $recordings[] = $this->storeUploadedRecording($request, $file, $metadata, $hash, $title);
         }
 
         if ($recordings === [] && $skippedDuplicates > 0) {
@@ -149,6 +153,8 @@ class RecordingController extends Controller
      */
     public function show(Recording $recording): View
     {
+        Gate::authorize('view', $recording);
+
         $recording->recoverOrphanedTranscription();
         $recording->refresh();
 
@@ -160,6 +166,8 @@ class RecordingController extends Controller
      */
     public function destroy(Recording $recording): RedirectResponse
     {
+        Gate::authorize('delete', $recording);
+
         $recording->deleteFile();
         $recording->delete();
 
@@ -172,6 +180,7 @@ class RecordingController extends Controller
      * Persist a single uploaded audio file as a recording.
      */
     private function storeUploadedRecording(
+        Request $request,
         UploadedFile $file,
         Mp3MetadataService $metadata,
         string $contentHash,
@@ -185,6 +194,7 @@ class RecordingController extends Controller
             ?: ($tags['title'] ?? pathinfo($file->getClientOriginalName(), PATHINFO_FILENAME));
 
         $recording = Recording::create([
+            'user_id' => $request->user()->id,
             'title' => $title,
             'original_filename' => $file->getClientOriginalName(),
             'file_path' => $path,

app/Http/Controllers/TranscribeController.php

@@ -5,6 +5,7 @@ namespace App\Http\Controllers;
 use App\Http\Requests\TranscribeRecordingRequest;
 use App\Models\Recording;
 use Illuminate\Http\RedirectResponse;
+use Illuminate\Support\Facades\Gate;
 
 class TranscribeController extends Controller
 {
@@ -15,6 +16,8 @@ class TranscribeController extends Controller
      */
     public function __invoke(TranscribeRecordingRequest $request, Recording $recording): RedirectResponse
     {
+        Gate::authorize('transcribe', $recording);
+
         $recording->queueLocalTranscription();
 
         return back()->with('success', 'Transcription started. Progress updates below.');

app/Http/Controllers/TranscribePendingController.php

@@ -4,17 +4,18 @@ namespace App\Http\Controllers;
 
 use App\Models\Recording;
 use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
 
 class TranscribePendingController extends Controller
 {
     /**
      * Queue local transcription for recordings that still need a transcript.
      */
-    public function __invoke(): RedirectResponse
+    public function __invoke(Request $request): RedirectResponse
     {
         $queued = 0;
 
-        Recording::query()
+        $request->user()->recordings()
             ->whereIn('transcription_status', ['pending', 'failed', 'cancelled'])
             ->orderBy('id')
             ->each(function (Recording $recording) use (&$queued): void {

app/Http/Controllers/TranscriptionStatusController.php

@@ -4,6 +4,7 @@ namespace App\Http\Controllers;
 
 use App\Models\Recording;
 use Illuminate\Http\JsonResponse;
+use Illuminate\Support\Facades\Gate;
 
 class TranscriptionStatusController extends Controller
 {
@@ -12,6 +13,8 @@ class TranscriptionStatusController extends Controller
      */
     public function __invoke(Recording $recording): JsonResponse
     {
+        Gate::authorize('view', $recording);
+
         $recording = $recording->fresh();
 
         if ($recording->recoverOrphanedTranscription()) {

app/Http/Requests/StoreRecordingRequest.php

@@ -37,7 +37,7 @@ class StoreRecordingRequest extends FormRequest
 
     public function authorize(): bool
     {
-        return true;
+        return $this->user() !== null;
     }
 
     /**

app/Http/Requests/TranscribeRecordingRequest.php

@@ -8,7 +8,9 @@ class TranscribeRecordingRequest extends FormRequest
 {
     public function authorize(): bool
     {
-        return true;
+        $recording = $this->route('recording');
+
+        return $recording !== null && $this->user()?->can('transcribe', $recording) === true;
     }
 
     /**

app/Listeners/AssignOrphanedRecordings.php

@@ -0,0 +1,24 @@
+<?php
+
+namespace App\Listeners;
+
+use App\Models\Recording;
+use App\Models\User;
+use Illuminate\Auth\Events\Registered;
+
+class AssignOrphanedRecordings
+{
+    /**
+     * Assign unowned recordings to the first registered user.
+     */
+    public function handle(Registered $event): void
+    {
+        if (User::query()->count() !== 1) {
+            return;
+        }
+
+        Recording::query()
+            ->whereNull('user_id')
+            ->update(['user_id' => $event->user->id]);
+    }
+}

app/Livewire/Actions/Logout.php

@@ -0,0 +1,24 @@
+<?php
+
+namespace App\Livewire\Actions;
+
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\Support\Facades\Session;
+use Livewire\Features\SupportRedirects\Redirector;
+
+class Logout
+{
+    /**
+     * Log the current user out of the application.
+     */
+    public function __invoke(): Redirector|RedirectResponse
+    {
+        Auth::guard('web')->logout();
+
+        Session::invalidate();
+        Session::regenerateToken();
+
+        return redirect('/');
+    }
+}

app/Models/Recording.php

@@ -9,6 +9,7 @@ use Illuminate\Database\Eloquent\Attributes\Scope;
 use Illuminate\Database\Eloquent\Builder;
 use Illuminate\Database\Eloquent\Casts\Attribute;
 use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
 use Illuminate\Support\Facades\Cache;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Storage;
@@ -21,6 +22,7 @@ class Recording extends Model
      * @var list<string>
      */
     protected $fillable = [
+        'user_id',
         'title',
         'original_filename',
         'file_path',
@@ -53,9 +55,18 @@ class Recording extends Model
             'duration_seconds' => 'integer',
             'file_size_bytes' => 'integer',
             'transcription_percent' => 'integer',
+            'user_id' => 'integer',
         ];
     }
 
+    /**
+     * @return BelongsTo<User, $this>
+     */
+    public function user(): BelongsTo
+    {
+        return $this->belongsTo(User::class);
+    }
+
     /**
      * Human-readable duration (m:ss).
      */

app/Models/User.php

@@ -2,13 +2,14 @@
 
 namespace App\Models;
 
-// use Illuminate\Contracts\Auth\MustVerifyEmail;
 use Database\Factories\UserFactory;
 use Illuminate\Database\Eloquent\Attributes\Fillable;
 use Illuminate\Database\Eloquent\Attributes\Hidden;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
+use Illuminate\Database\Eloquent\Relations\HasMany;
 use Illuminate\Foundation\Auth\User as Authenticatable;
 use Illuminate\Notifications\Notifiable;
+use Illuminate\Support\Str;
 
 #[Fillable(['name', 'email', 'password'])]
 #[Hidden(['password', 'remember_token'])]
@@ -29,4 +30,24 @@ class User extends Authenticatable
             'password' => 'hashed',
         ];
     }
+
+    /**
+     * @return HasMany<Recording, $this>
+     */
+    public function recordings(): HasMany
+    {
+        return $this->hasMany(Recording::class);
+    }
+
+    /**
+     * Initials for Flux avatar components.
+     */
+    public function initials(): string
+    {
+        return Str::of($this->name)
+            ->explode(' ')
+            ->take(2)
+            ->map(fn (string $part) => Str::substr($part, 0, 1))
+            ->implode('');
+    }
 }

app/Policies/RecordingPolicy.php

@@ -0,0 +1,57 @@
+<?php
+
+namespace App\Policies;
+
+use App\Models\Recording;
+use App\Models\User;
+
+class RecordingPolicy
+{
+    /**
+     * Determine whether the user can view any models.
+     */
+    public function viewAny(User $user): bool
+    {
+        return true;
+    }
+
+    /**
+     * Determine whether the user can view the model.
+     */
+    public function view(User $user, Recording $recording): bool
+    {
+        return $recording->user_id === $user->id;
+    }
+
+    /**
+     * Determine whether the user can create models.
+     */
+    public function create(User $user): bool
+    {
+        return true;
+    }
+
+    /**
+     * Determine whether the user can update the model.
+     */
+    public function update(User $user, Recording $recording): bool
+    {
+        return $recording->user_id === $user->id;
+    }
+
+    /**
+     * Determine whether the user can delete the model.
+     */
+    public function delete(User $user, Recording $recording): bool
+    {
+        return $recording->user_id === $user->id;
+    }
+
+    /**
+     * Determine whether the user can start or stop transcription.
+     */
+    public function transcribe(User $user, Recording $recording): bool
+    {
+        return $recording->user_id === $user->id;
+    }
+}

app/Providers/AppServiceProvider.php

@@ -2,7 +2,11 @@
 
 namespace App\Providers;
 
+use App\Listeners\AssignOrphanedRecordings;
+use Illuminate\Auth\Events\Registered;
+use Illuminate\Support\Facades\Event;
 use Illuminate\Support\ServiceProvider;
+use Illuminate\Validation\Rules\Password;
 
 class AppServiceProvider extends ServiceProvider
 {
@@ -19,6 +23,8 @@ class AppServiceProvider extends ServiceProvider
      */
     public function boot(): void
     {
-        //
+        Password::defaults(fn () => Password::min(8));
+
+        Event::listen(Registered::class, AssignOrphanedRecordings::class);
     }
 }

app/Providers/FortifyServiceProvider.php

@@ -0,0 +1,65 @@
+<?php
+
+namespace App\Providers;
+
+use App\Actions\Fortify\CreateNewUser;
+use App\Actions\Fortify\ResetUserPassword;
+use Illuminate\Cache\RateLimiting\Limit;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\RateLimiter;
+use Illuminate\Support\ServiceProvider;
+use Illuminate\Support\Str;
+use Laravel\Fortify\Fortify;
+
+class FortifyServiceProvider extends ServiceProvider
+{
+    /**
+     * Register any application services.
+     */
+    public function register(): void
+    {
+        //
+    }
+
+    /**
+     * Bootstrap any application services.
+     */
+    public function boot(): void
+    {
+        $this->configureActions();
+        $this->configureViews();
+        $this->configureRateLimiting();
+    }
+
+    /**
+     * Configure Fortify actions.
+     */
+    private function configureActions(): void
+    {
+        Fortify::createUsersUsing(CreateNewUser::class);
+        Fortify::resetUserPasswordsUsing(ResetUserPassword::class);
+    }
+
+    /**
+     * Configure Fortify views.
+     */
+    private function configureViews(): void
+    {
+        Fortify::loginView(fn () => view('pages::auth.login'));
+        Fortify::registerView(fn () => view('pages::auth.register'));
+        Fortify::resetPasswordView(fn () => view('pages::auth.reset-password'));
+        Fortify::requestPasswordResetLinkView(fn () => view('pages::auth.forgot-password'));
+    }
+
+    /**
+     * Configure rate limiting.
+     */
+    private function configureRateLimiting(): void
+    {
+        RateLimiter::for('login', function (Request $request) {
+            $throttleKey = Str::transliterate(Str::lower($request->input(Fortify::username())).'|'.$request->ip());
+
+            return Limit::perMinute(5)->by($throttleKey);
+        });
+    }
+}