Migrate profile-edit page to Vue + /api/v2/users/me (Group 2.2, all 5 tabs)

.gitignore

@@ -32,6 +32,8 @@ restarters-anonymised.sql
 /.claude/settings.local.json
 /public/build/
 /storage/api-docs/api-docs.json
+/storage/app/tus
+/storage/app/tus-cache
 /.phpunit.result.cache
 /playwright-report/
 /events.csv

app/Exceptions/Handler.php

@@ -2,6 +2,7 @@
 
 namespace App\Exceptions;
 
+use Illuminate\Auth\AuthenticationException;
 use Illuminate\Validation\ValidationException;
 use Throwable;
 use Exception;
@@ -26,7 +27,7 @@
      * @param  \Illuminate\Http\Request  $request
      * @return \Illuminate\Http\Response
      */
     public function render($request, Throwable $exception)
     {
         if ($request->wantsJson()) {
             if ($exception instanceof ValidationException) {
@@ -35,6 +36,24 @@
                     422);
             }
 
+            // An unauthenticated request (e.g. a missing/invalid api token on an
+            // auth:api route) throws AuthenticationException, which has no
+            // getStatusCode() and so would otherwise fall through to 500. Map it
+            // to the correct 401 for JSON/API clients.
+            if ($exception instanceof AuthenticationException) {
+                return response()->json(
+                    ['message' => $exception->getMessage()],
+                    401);
+            }
+
+            // An authorization failure (e.g. $this->authorize() / a Policy denial)
+            // throws AuthorizationException, which also has no getStatusCode() and
+            // so would otherwise fall through to 500. Map it to 403 for JSON/API
+            // clients.
+            if ($exception instanceof \Illuminate\Auth\Access\AuthorizationException) {
+                return response()->json(['message' => $exception->getMessage()], 403);
+            }
+
             return response()->json(
                 ['message' => $exception->getMessage()],
                 method_exists($exception, 'getStatusCode') ? $exception->getStatusCode() : 500);

app/Helpers/FixometerFile.php

@@ -62,107 +62,148 @@
 
         /** if we have no error, proceed to elaborate and upload **/
         if ($error == UPLOAD_ERR_OK) {
-            $filename = $this->filename($tmp_name);
-            $this->file = $filename;
-            $lpath = $_SERVER['DOCUMENT_ROOT'].'/uploads/'.$filename;
-
-            // Attempt the move BEFORE touching existing records — if the move fails
-            // (e.g. uploads directory missing/unwritable) we preserve the old image.
-            if (!$this->move($tmp_name, $lpath)) {
-                return false;
-            }
+            return $this->processLocalFile($tmp_name, $type, $reference, $referenceType, $clear, $profile, $crop, true);
+        }
 
-            // Move succeeded — safe to remove previous image records.
-            if ($clear) {
-                Xref::where('reference', $reference)
-                      ->where('reference_type', $referenceType)
-                        ->forceDelete();
-            }
+        return null;
+    }
+
+    /**
+     * Ingest a file that is already sitting on local disk (i.e. NOT a PHP/HTTP
+     * upload for the current request, so move_uploaded_file() would refuse it) -
+     * e.g. a file assembled by a tus resumable-upload server. Runs the same
+     * validation/thumbnailing/DB-record pipeline as upload(), but copies the
+     * source file into place instead of using move_uploaded_file().
+     *
+     * The caller is responsible for having already validated $localPath is a
+     * real, acceptable image before calling this (this method still re-checks
+     * the MIME type itself via filename(), same as upload() does).
+     */
+    public function uploadLocalFile(string $localPath, $type, $reference = null, $referenceType = null, $profile = false, $crop = true)
+    {
+        if (! is_file($localPath)) {
+            return null;
+        }
 
-            $data = [];
-            $this->path = $lpath;
-            $data['path'] = $this->file;
+        return $this->processLocalFile($localPath, $type, $reference, $referenceType, true, $profile, $crop, false);
+    }
+
+    /**
+     * Shared tail-end of upload()/uploadLocalFile(): validate the MIME type,
+     * move/copy the source file into the uploads directory, generate
+     * thumbnails, and create the images/xref DB records.
+     *
+     * @param bool $useUploadedFileMove true for real PHP uploads (move_uploaded_file(),
+     *                                  or copy() under FixometerFile::$uploadTesting),
+     *                                  false to always use a plain copy() (tus/local files).
+     */
+    protected function processLocalFile(string $tmp_name, $type, $reference, $referenceType, bool $clear, bool $profile, bool $crop, bool $useUploadedFileMove)
+    {
+        $filename = $this->filename($tmp_name);
 
-            // Fix orientation
-            Image::make($lpath)->orientate()->save($lpath);
+        if (! $filename) {
+            return false;
+        }
+
+        $this->file = $filename;
+        $lpath = $_SERVER['DOCUMENT_ROOT'].'/uploads/'.$filename;
 
-            if ($type !== 'image') {
-                $this->syncToCloud($filename);
+        // Attempt the move BEFORE touching existing records — if the move fails
+        // (e.g. uploads directory missing/unwritable) we preserve the old image.
+        $moved = $useUploadedFileMove ? $this->move($tmp_name, $lpath) : @copy($tmp_name, $lpath);
+
+        if (! $moved) {
+            return false;
+        }
+
+        // Move succeeded — safe to remove previous image records.
+        if ($clear) {
+            Xref::where('reference', $reference)
+                  ->where('reference_type', $referenceType)
+                    ->forceDelete();
+        }
+
+        $data = [];
+        $this->path = $lpath;
+        $data['path'] = $this->file;
+
+        // Fix orientation
+        Image::make($lpath)->orientate()->save($lpath);
+
+        if ($type !== 'image') {
+            $this->syncToCloud($filename);
+        }
+
+        if ($type === 'image') {
+            $size = getimagesize($this->path);
+            $data['width'] = $size[0];
+            $data['height'] = $size[1];
+
+            if ($profile) {
+                $data['alt_text'] = 'Profile Picture';
             }
 
-            if ($type === 'image') {
-                $size = getimagesize($this->path);
-                $data['width'] = $size[0];
-                $data['height'] = $size[1];
-
-                if ($profile) {
-                    $data['alt_text'] = 'Profile Picture';
-                }
-
-                if ($data['width'] > $data['height']) {
-                    $biggestSide = $data['width'];
-                    $resize_height = true;
-                } else {
-                    $biggestSide = $data['height'];
-                    $resize_height = false;
-                }
-
-                $thumbSize = 80;
-                $midSize = 260;
-
-                // Let's make images, which we will resize or crop
-                $thumb = Image::make($lpath);
-                $mid = Image::make($lpath);
-
-                if ($resize_height) { // Resize before crop
-                    $thumb->resize(null, $thumbSize, function ($constraint) {
-                        $constraint->aspectRatio();
-                    });
-
-                    $mid->resize(null, $midSize, function ($constraint) {
-                        $constraint->aspectRatio();
-                    });
-                } else {
-                    $thumb->resize($thumbSize, null, function ($constraint) {
-                        $constraint->aspectRatio();
-                    });
-
-                    $mid->resize($midSize, null, function ($constraint) {
-                        $constraint->aspectRatio();
-                    });
-                }
-
-                if ($crop) {
-                    $thumb->crop($thumbSize, $thumbSize);
-                    $mid->crop($midSize, $midSize);
-                }
-
-                $thumb->save($_SERVER['DOCUMENT_ROOT'].'/uploads/'.'thumbnail_'.$filename, 85);
-                $mid->save($_SERVER['DOCUMENT_ROOT'].'/uploads/'.'mid_'.$filename, 85);
-
-                $this->syncToCloud($filename);
-                $this->syncToCloud('thumbnail_'.$filename);
-                $this->syncToCloud('mid_'.$filename);
-
-                $this->table = 'images';
-                $Images = new Images;
-
-                $image = $Images->create($data)->id;
-
-                if (is_numeric($image) && ! is_null($reference) && ! is_null($referenceType)) {
-                    Xref::create([
-                        'object' => $image,
-                        'object_type' => env('TBL_IMAGES'),
-                        'reference' => $reference,
-                        'reference_type' => $referenceType,
-                    ]);
-                }
+            if ($data['width'] > $data['height']) {
+                $biggestSide = $data['width'];
+                $resize_height = true;
+            } else {
+                $biggestSide = $data['height'];
+                $resize_height = false;
             }
 
-            return $filename;
+            $thumbSize = 80;
+            $midSize = 260;
+
+            // Let's make images, which we will resize or crop
+            $thumb = Image::make($lpath);
+            $mid = Image::make($lpath);
+
+            if ($resize_height) { // Resize before crop
+                $thumb->resize(null, $thumbSize, function ($constraint) {
+                    $constraint->aspectRatio();
+                });
+
+                $mid->resize(null, $midSize, function ($constraint) {
+                    $constraint->aspectRatio();
+                });
+            } else {
+                $thumb->resize($thumbSize, null, function ($constraint) {
+                    $constraint->aspectRatio();
+                });
+
+                $mid->resize($midSize, null, function ($constraint) {
+                    $constraint->aspectRatio();
+                });
+            }
+
+            if ($crop) {
+                $thumb->crop($thumbSize, $thumbSize);
+                $mid->crop($midSize, $midSize);
+            }
+
+            $thumb->save($_SERVER['DOCUMENT_ROOT'].'/uploads/'.'thumbnail_'.$filename, 85);
+            $mid->save($_SERVER['DOCUMENT_ROOT'].'/uploads/'.'mid_'.$filename, 85);
+
+            $this->syncToCloud($filename);
+            $this->syncToCloud('thumbnail_'.$filename);
+            $this->syncToCloud('mid_'.$filename);
+
+            $this->table = 'images';
+            $Images = new Images;
+
+            $image = $Images->create($data)->id;
+
+            if (is_numeric($image) && ! is_null($reference) && ! is_null($referenceType)) {
+                Xref::create([
+                    'object' => $image,
+                    'object_type' => env('TBL_IMAGES'),
+                    'reference' => $reference,
+                    'reference_type' => $referenceType,
+                ]);
+            }
         }
 
-        return null;
+        return $filename;
     }
 
     /**

app/Helpers/Tus.php

@@ -0,0 +1,86 @@
+<?php
+
+namespace App\Helpers;
+
+use TusPhp\Cache\Cacheable;
+use TusPhp\Cache\FileStore;
+use TusPhp\Tus\Server;
+
+class Tus
+{
+    /**
+     * Directory where in-progress and completed tus uploads are assembled.
+     */
+    public static function uploadDir(): string
+    {
+        return storage_path('app/tus');
+    }
+
+    /**
+     * Directory where the tus-php file cache (upload metadata) is kept.
+     */
+    public static function cacheDir(): string
+    {
+        return storage_path('app/tus-cache/');
+    }
+
+    /**
+     * Build the tus-php file cache directly, WITHOUT constructing a Server/Request.
+     *
+     * TusPhp\Tus\Server's constructor eagerly builds a TusPhp\Request, which calls
+     * Symfony's HttpRequest::createFromGlobals() - that reads PHP's real superglobals
+     * unconditionally, which blows up under PHPUnit's CLI SAPI (no $_SERVER['REQUEST_METHOD']
+     * etc.) once error_reporting is turned up to catch undefined-variable notices as
+     * errors. Callers that only need to read/write the cache (e.g. updateMyPhotov2()
+     * looking up a completed upload by key) should use this instead of buildServer()
+     * so they don't pay for - or crash on - a Request they never use.
+     *
+     * The cache key prefix MUST match what Server actually uses: AbstractTus::setCache()
+     * prefixes every key with "tus:" . strtolower(static::class) . ":" (i.e. "tus:server:"
+     * for TusPhp\Tus\Server) - a bare `new FileStore()` defaults to just "tus:" and would
+     * silently miss every entry the real Server wrote.
+     */
+    public static function buildCache(): Cacheable
+    {
+        $cacheDir = self::cacheDir();
+
+        if (! is_dir($cacheDir)) {
+            mkdir($cacheDir, 0775, true);
+        }
+
+        $cache = new FileStore($cacheDir);
+        $cache->setPrefix('tus:server:');
+
+        return $cache;
+    }
+
+    /**
+     * Build a tus-php Server configured identically wherever it's used (the
+     * TusController that serves the protocol, and the API controller that
+     * later looks up a completed upload by key). Using a shared factory keeps
+     * the upload dir/cache dir/api path in sync between the two call sites.
+     *
+     * Only call this where a real Request is available/expected (i.e. the actual tus
+     * protocol route) - see buildCache() for cache-only access.
+     */
+    public static function buildServer(): Server
+    {
+        $uploadDir = self::uploadDir();
+
+        if (! is_dir($uploadDir)) {
+            mkdir($uploadDir, 0775, true);
+        }
+
+        $server = new Server(self::buildCache());
+        $server->setUploadDir($uploadDir);
+        $server->setApiPath('/api/tus');
+
+        // This route is intentionally unauthenticated (see TusController), so cap what an
+        // anonymous client can push to disk here even though updateMyPhotov2() separately
+        // enforces its own 2MB limit once a completed upload is claimed. A little headroom
+        // over the app-level limit avoids rejecting legitimate uploads before compression.
+        $server->setMaxUploadSize(10 * 1024 * 1024);
+
+        return $server;
+    }
+}