Merge pull request #21 from RedberryProducts/feat/redirect-url

Feat/redirect url

Author: nikajorjika

README.md

@@ -40,9 +40,9 @@ A Laravel package that captures outgoing mail and stores it for in-app viewing.
 The published `config/inbox.php` file exposes several options:
 
 - `INBOX_ENABLED` — enable the inbox even in production (defaults to non-production only).
-- `INBOX_PUBLIC` — bypass authorization and allow public access.
 - `INBOX_GATE` — ability checked by the `mailbox.authorize` middleware (defaults to `viewMailbox`).
 - `INBOX_DASHBOARD_ROUTE` — URI where the dashboard is mounted (`/mailbox` by default).
+- `INBOX_REDIRECT` — URI where the user is redirected when they are unauthorized (defaults to Laravel's Forbidden Page).
 - `INBOX_STORE_DRIVER` & `INBOX_FILE_PATH` — storage driver and path for captured messages.
 - `INBOX_RETENTION` — number of seconds before stored messages are purged.
 

config/inbox.php

@@ -2,7 +2,6 @@
 
 return [
     'enabled' => env('INBOX_ENABLED', env('APP_ENV') !== 'production'),
-    'public' => env('INBOX_PUBLIC', false),
     'store' => [
         'driver' => env('INBOX_STORE_DRIVER', 'file'),
         'resolvers' => [
@@ -17,6 +16,7 @@
         'seconds' => (int) env('INBOX_RETENTION', 60 * 60 * 24),
     ],
     'gate' => env('INBOX_GATE', 'viewMailbox'),
+    'unauthorized_redirect' => env('INBOX_REDIRECT', null),
     'route' => env('INBOX_DASHBOARD_ROUTE', 'mailbox'),
     'middleware' => ['web'],
 ];

src/Http/Middleware/AuthorizeInboxMiddleware.php

@@ -9,16 +9,17 @@ class AuthorizeInboxMiddleware
 {
     public function handle($request, Closure $next)
     {
-        if (config('inbox.public', false)) {
-            return $next($request);
-        }
-
         $ability = config('inbox.gate', 'viewMailbox');
-        // Let Gate decide (works with or without authenticated user; $user can be null)
-        if (Gate::allows($ability)) {
-            return $next($request);
+
+        if (! Gate::allows($ability)) {
+            $redirect = config('inbox.unauthorized_redirect');
+
+            if ($redirect) {
+                return redirect($redirect);
+            }
+            abort(403);
         }
 
-        abort(403);
+        return $next($request);
     }
 }

tests/Feature/AssetControllerTest.php

@@ -1,6 +1,5 @@
 <?php
 
-use Illuminate\Support\Facades\Gate;
 use Illuminate\Support\Facades\Route;
 use Redberry\MailboxForLaravel\CaptureService;
 use Redberry\MailboxForLaravel\Http\Controllers\AssetController;
@@ -50,13 +49,6 @@ function storeMessage(): array
         $this->get("/mailbox/messages/{$key}/attachments/missing.txt")->assertNotFound();
     });
 
-    it('rejects unauthorized access when middleware denies', function () {
-        Gate::shouldReceive('allows')->with('viewMailbox')->andReturn(false);
-        config()->set('inbox.public', false);
-
-        $this->get('/mailbox/messages/abc/attachments/file.txt')->assertForbidden();
-    });
-
     it('streams large assets without loading entire file into memory', function () {
         $file = tempnam(sys_get_temp_dir(), 'inbox-');
         file_put_contents($file, str_repeat('A', 1024 * 1024));

tests/Feature/AuthorizeInboxMiddlewareTest.php

@@ -21,11 +21,18 @@
         $this->get('/mailbox-test')->assertForbidden();
     });
 
-    it('allows access when config(inbox.public)=true', function () {
-        config()->set('inbox.public', true);
-        Gate::shouldReceive('allows')->never();
+    it('redirects to 403 page when no inbox.unauthorized_redirect config is set', function () {
+        config()->set('inbox.unauthorized_redirect', null);
+        Gate::shouldReceive('allows')->with('viewMailbox')->andReturn(false);
 
-        $this->get('/mailbox-test')->assertOk();
+        $this->get('/mailbox-test')->assertForbidden();
+    });
+
+    it('redirects to inbox.unauthorized_redirect page when set in config', function () {
+        config()->set('inbox.unauthorized_redirect', '/custom-unauthorized');
+        Gate::shouldReceive('allows')->with('viewMailbox')->andReturn(false);
+
+        $this->get('/mailbox-test')->assertRedirect('/custom-unauthorized');
     });
 
     it('denies access in production when config forbids public access', function () {

tests/Unit/InboxServiceProviderTest.php

@@ -53,6 +53,5 @@
     it('merges default config values correctly', function () {
         expect(config('inbox.store.driver'))->toBe('file');
         expect(config('inbox.middleware'))->toBe(['web']);
-        expect(config('inbox.public'))->toBeFalse();
     });
 });