feat: protect search form

app/Http/Controllers/SearchController.php

@@ -2,12 +2,12 @@
 
 namespace App\Http\Controllers;
 
+use App\Http\Requests\SearchRequest;
 use App\Http\ViewModels\Home\HomeViewModel;
 use App\Http\ViewModels\Search\SearchViewModel;
 use App\Http\ViewModels\User\UserViewModel;
 use Illuminate\Contracts\View\View;
 use Illuminate\Support\Facades\Cache;
-use Mauricius\LaravelHtmx\Http\HtmxRequest;
 
 class SearchController extends Controller
 {
@@ -23,11 +23,11 @@ public function index(): View
         ]);
     }
 
-    public function post(HtmxRequest $request): View|string
+    public function post(SearchRequest $request): View|string
     {
-        $stats = Cache::remember('stats', 604800, fn () => HomeViewModel::serverStats());
+        $term = $request->input('term');
 
-        $term = trim($request->input('term'));
+        $stats = Cache::remember('stats', 604800, fn () => HomeViewModel::serverStats());
 
         $names = Cache::remember('search-name-' . $term, 604800, fn () => SearchViewModel::names($term, 1000));
 

app/Http/Requests/SearchRequest.php

@@ -0,0 +1,36 @@
+<?php
+
+namespace App\Http\Requests;
+
+use Illuminate\Foundation\Http\FormRequest;
+
+class SearchRequest extends FormRequest
+{
+    /**
+     * Indicates that the request is made via Htmx.
+     */
+    public function isHtmxRequest(): bool
+    {
+        return filter_var($this->headers->get('HX-Request', 'false'), FILTER_VALIDATE_BOOLEAN);
+    }
+
+    /**
+     * Determine if the user is authorized to make this request.
+     */
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /**
+     * Get the validation rules that apply to the request.
+     *
+     * @return array<string, \Illuminate\Contracts\Validation\ValidationRule|array<mixed>|string>
+     */
+    public function rules(): array
+    {
+        return [
+            'term' => 'required|string|alpha_dash|min:3|max:255',
+        ];
+    }
+}

app/Http/ViewModels/Search/SearchViewModel.php

@@ -16,7 +16,7 @@ public static function names(?string $term = null, int $limit = 20): array
             ->map(fn (Name $name) => [
                 'id' => $name->id,
                 'name' => StringHelper::formatNameFromDB($name->name),
-                'gender' => $name->gender == 'male' ? 'masculin' : 'feminin',
+                'gender' => $name->gender === 'male' ? 'Masculin' : 'Féminin',
                 'url' => [
                     'show' => route('name.show', [
                         'id' => $name->id,

app/Models/User.php

@@ -3,13 +3,14 @@
 namespace App\Models;
 
 use Illuminate\Contracts\Auth\MustVerifyEmail;
+use Illuminate\Contracts\Translation\HasLocalePreference;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Database\Eloquent\Relations\HasMany;
 use Illuminate\Foundation\Auth\User as Authenticatable;
 use Illuminate\Notifications\Notifiable;
 use Laravel\Sanctum\HasApiTokens;
 
-class User extends Authenticatable implements MustVerifyEmail
+class User extends Authenticatable implements HasLocalePreference, MustVerifyEmail
 {
     use HasApiTokens, HasFactory, Notifiable;
 
@@ -51,4 +52,12 @@ public function lists(): HasMany
     {
         return $this->hasMany(NameList::class, 'user_id', 'id');
     }
+
+    /**
+     * Get the user's preferred locale.
+     */
+    public function preferredLocale(): string
+    {
+        return config('app.locale');
+    }
 }

app/Providers/RouteServiceProvider.php

@@ -28,6 +28,12 @@ public function boot(): void
             return Limit::perMinute(60)->by($request->user()?->id ?: $request->ip());
         });
 
+        RateLimiter::for('search', function (Request $request) {
+            return $request->user()
+                        ? Limit::perMinute(100)->by($request->user()->id)
+                        : Limit::perMinute(10)->by($request->ip());
+        });
+
         $this->routes(function (): void {
             Route::middleware('api')
                 ->prefix('api')

routes/web.php

@@ -23,7 +23,7 @@
 
 Route::get('', [HomeController::class, 'index'])->name('home.index');
 Route::get('recherche', [SearchController::class, 'index'])->name('search.index');
-Route::post('recherche', [SearchController::class, 'post'])->name('search.post');
+Route::post('recherche', [SearchController::class, 'post'])->middleware(['throttle:search'])->name('search.post');
 Route::get('prenoms', [NameController::class, 'index'])->name('name.index');
 
 Route::get('conditions', [TermsController::class, 'index'])->name('terms.index');
@@ -72,7 +72,7 @@
         Route::get('listes/{liste}/system', [ListSystemController::class, 'update'])->name('list.system.update');
         Route::delete('listes/{liste}', [ListController::class, 'destroy'])->name('list.destroy');
 
-        Route::post('listes/{liste}/search', [ListSearchController::class, 'index'])->name('list.search.index');
+        Route::post('listes/{liste}/search', [ListSearchController::class, 'index'])->middleware(['throttle:search'])->name('list.search.index');
         Route::post('listes/{liste}/prenoms/{id}', [ListNameController::class, 'store'])->name('list.name.store');
         Route::get('listes/{liste}/prenoms', [ListNameController::class, 'index'])->name('list.name.index');
         Route::delete('listes/{liste}/prenoms/{id}', [ListNameController::class, 'destroy'])->name('list.name.destroy');

tests/Feature/Auth/AuthenticationTest.php

@@ -18,7 +18,7 @@ public function login_screen_can_be_rendered(): void
     {
         $response = $this->get('/login');
 
-        $response->assertStatus(200);
+        $response->assertOk();
     }
 
     /**

tests/Feature/Auth/EmailVerificationTest.php

@@ -25,7 +25,7 @@ public function email_verification_screen_can_be_rendered(): void
 
         $response = $this->actingAs($user)->get('/verify-email');
 
-        $response->assertStatus(200);
+        $response->assertOk();
     }
 
     /**

tests/Feature/Auth/PasswordConfirmationTest.php

@@ -19,7 +19,7 @@ public function confirm_password_screen_can_be_rendered(): void
 
         $response = $this->actingAs($user)->get('/confirm-password');
 
-        $response->assertStatus(200);
+        $response->assertOk();
     }
 
     /**

tests/Feature/Auth/PasswordResetTest.php

@@ -19,7 +19,7 @@ public function reset_password_link_screen_can_be_rendered(): void
     {
         $response = $this->get('/forgot-password');
 
-        $response->assertStatus(200);
+        $response->assertOk();
     }
 
     /**
@@ -50,7 +50,7 @@ public function reset_password_screen_can_be_rendered(): void
         Notification::assertSentTo($user, ResetPassword::class, function ($notification) {
             $response = $this->get('/reset-password/' . $notification->token);
 
-            $response->assertStatus(200);
+            $response->assertOk();
 
             return true;
         });

tests/Feature/Auth/RegistrationTest.php

@@ -17,7 +17,7 @@ public function registration_screen_can_be_rendered(): void
     {
         $response = $this->get('/register');
 
-        $response->assertStatus(200);
+        $response->assertOk();
     }
 
     /**

tests/Feature/HomeTest.php

@@ -17,6 +17,6 @@ public function home_screen_can_be_rendered(): void
 
         $response = $this->get('/');
 
-        $response->assertStatus(200);
+        $response->assertOk();
     }
 }

tests/Feature/NameTest.php

@@ -19,7 +19,7 @@ public function name_screen_can_be_rendered(): void
 
         $response = $this->get('/prenoms');
 
-        $response->assertStatus(200);
+        $response->assertOk();
         $response->assertSee($names[0]->name);
     }
 
@@ -30,7 +30,7 @@ public function name_letter_can_be_rendered(): void
 
         $response = $this->get('/prenoms/' . $name->name[0]);
 
-        $response->assertStatus(200);
+        $response->assertOk();
         $response->assertSee('Tous les prénoms commençant par la lettre ' . Str::upper($name->name[0]));
         $response->assertSee($name->name);
     }
@@ -42,7 +42,7 @@ public function male_screen_can_be_rendered(): void
 
         $response = $this->get('/prenoms/garcons');
 
-        $response->assertStatus(200);
+        $response->assertOk();
         $response->assertSee($names[0]->name);
     }
 
@@ -53,7 +53,7 @@ public function male_letter_can_be_rendered(): void
 
         $response = $this->get('/prenoms/garcons/' . $name->name[0]);
 
-        $response->assertStatus(200);
+        $response->assertOk();
         $response->assertSee('Tous les prénoms masculins commençant par la lettre ' . Str::upper($name->name[0]));
         $response->assertSee($name->name);
     }
@@ -65,7 +65,7 @@ public function female_screen_can_be_rendered(): void
 
         $response = $this->get('/prenoms/filles');
 
-        $response->assertStatus(200);
+        $response->assertOk();
         $response->assertSee($names[0]->name);
     }
 
@@ -76,7 +76,7 @@ public function female_letter_can_be_rendered(): void
 
         $response = $this->get('/prenoms/filles/' . $name->name[0]);
 
-        $response->assertStatus(200);
+        $response->assertOk();
         $response->assertSee('Tous les prénoms féminins commençant par la lettre ' . Str::upper($name->name[0]));
         $response->assertSee($name->name);
     }
@@ -88,7 +88,7 @@ public function unisex_screen_can_be_rendered(): void
 
         $response = $this->get('/prenoms/mixtes');
 
-        $response->assertStatus(200);
+        $response->assertOk();
         $response->assertSee($names[0]->name);
     }
 
@@ -99,7 +99,7 @@ public function unisex_letter_can_be_rendered(): void
 
         $response = $this->get("/prenoms/mixtes/{$name->name[0]}");
 
-        $response->assertStatus(200);
+        $response->assertOk();
         $response->assertSee('Tous les prénoms mixtes commençant par la lettre ' . Str::upper($name->name[0]));
         $response->assertSee($name->name);
     }
@@ -111,7 +111,7 @@ public function name_page_can_be_rendered(): void
 
         $response = $this->get("/prenoms/$name->id/" . Str::slug($name->name));
 
-        $response->assertStatus(200);
+        $response->assertOk();
         $response->assertSee($name->name);
     }
 }

tests/Feature/SearchTest.php

@@ -16,7 +16,7 @@ public function search_screen_can_be_rendered(): void
     {
         $response = $this->get('/recherche');
 
-        $response->assertStatus(200);
+        $response->assertOk();
     }
 
     #[Test]
@@ -26,7 +26,7 @@ public function search_can_be_triggered(): void
 
         $response = $this->post('/recherche', ['term' => $name->name]);
 
-        $response->assertStatus(200);
+        $response->assertOk();
         $response->assertSee($name->name);
     }
 
@@ -37,7 +37,18 @@ public function name_can_be_found(): void
 
         $response = $this->post('/recherche', ['term' => Str::substr($names[0]->name, 0, 3)]);
 
-        $response->assertStatus(200);
+        $response->assertOk();
         $response->assertSee($names[0]->name);
     }
+
+    #[Test]
+    public function search_not_valid_on_one_letter(): void
+    {
+        $name = \App\Models\Name::factory()->create();
+
+        $response = $this->post('/recherche', ['term' => $name->name[0]]);
+
+        $response->assertInvalid(['term']);
+        $response->assertRedirect();
+    }
 }