Initial commit

.github/workflows/test.yml

@@ -0,0 +1,59 @@
+name: Test
+
+on:
+  push:
+    branches:
+      - "**"
+    paths-ignore:
+      - "README.md"
+  pull_request:
+    types: [ready_for_review, synchronize, opened]
+    paths-ignore:
+      - "README.md"
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        php: [8.1, 8.2, 8.3]
+        laravel: [10.*, 11.*]
+        exclude:
+          - php: 8.1
+            laravel: 11.*
+
+    name: PHP:${{ matrix.php }} / Laravel:${{ matrix.laravel }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup PHP, with composer and extensions
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: ${{ matrix.php }}
+          extensions: dom, curl, libxml, mbstring, iconv, intl, zip, pdo_sqlite
+          tools: composer:v2
+          coverage: none
+
+      - name: Get composer cache directory
+        id: composer-cache
+        run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
+
+      - name: Cache composer dependencies
+        uses: actions/cache@v4
+        with:
+          path: ${{ steps.composer-cache.outputs.dir }}
+          key: dependencies-laravel-${{ matrix.laravel }}-php-${{ matrix.php }}-composer-${{ hashFiles('composer.json') }}
+          restore-keys: dependencies-laravel-${{ matrix.laravel }}-php-${{ matrix.php }}-composer-
+
+      - name: Install Composer dependencies
+        run: |
+          composer require "laravel/framework:${{ matrix.laravel }}" --no-interaction --no-update --dev
+          composer update --prefer-stable --no-interaction
+
+      - name: Run Unit tests
+        run: vendor/bin/phpunit --testsuite Unit
+        env:
+          RUNNING_IN_CI: true

.gitignore

@@ -0,0 +1,18 @@
+/vendor/
+/node_modules/
+_runtime_components.json
+SCRATCH.md
+COMMIT_MSG.aim.txt
+composer.lock
+.phpunit.cache/
+.phpunit.result.cache
+.idea
+phpunit.xml
+
+# OS generated files
+.DS_Store
+._*
+.Spotlight-V100
+.Trashes
+ehthumbs.db
+Thumbs.db

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2024 Philo Hermans
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -0,0 +1,13 @@
+# Livewire Strict
+
+<p align="center">  
+<a href="https://packagist.org/packages/wire-elements/livewire-strict"><img src="https://img.shields.io/packagist/dt/wire-elements/livewire-strict" alt="Total Downloads"></a>
+<a href="https://packagist.org/packages/wire-elements/livewire-strict"><img src="https://img.shields.io/packagist/v/wire-elements/livewire-strict" alt="Latest Stable Version"></a>
+<a href="https://packagist.org/packages/wire-elements/livewire-strict"><img src="https://img.shields.io/packagist/l/wire-elements/livewire-strict" alt="License"></a>
+</p>
+
+## Enforce additional Livewire security measures
+Livewire Strict helps to enforce security measures and prevents you from leaving sensitive public properties unprotected.
+
+## Documentation
+You can find the [full documentation on our site](https://wire-elements.dev/blog/livewire-strict-enforce-additional-security-measures-to-livewire).

composer.json

@@ -0,0 +1,39 @@
+{
+    "name": "wire-elements/livewire-strict",
+    "description": "Add strict mode to Livewire.",
+    "require": {
+        "php": "^8.1"
+    },
+    "license": "MIT",
+    "autoload": {
+        "psr-4": {
+            "WireElements\\LivewireStrict\\": "src/"
+        }
+    },
+    "autoload-dev": {
+        "psr-4": {
+            "Tests\\": "tests/"
+        }
+    },
+    "authors": [
+        {
+            "name": "Philo Hermans",
+            "email": "[email protected]"
+        }
+    ],
+    "extra": {
+        "laravel": {
+            "providers": [
+                "WireElements\\LivewireStrict\\LivewireStrictServiceProvider"
+            ]
+        }
+    },
+    "minimum-stability": "dev",
+    "prefer-stable": true,
+    "require-dev": {
+        "phpunit/phpunit": "^10.4",
+        "laravel/framework": "^10.15.0|^11.0",
+        "orchestra/testbench": "^8.21.0|^9.1",
+        "livewire/livewire": "^3.5"
+    }
+}

phpunit.xml.dist

@@ -0,0 +1,20 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<phpunit xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         colors="true"
+         stopOnFailure="false"
+         backupGlobals="false"
+         processIsolation="false"
+         bootstrap="vendor/autoload.php"
+         xsi:noNamespaceSchemaLocation="https://schema.phpunit.de/10.4/phpunit.xsd"
+         cacheDirectory=".phpunit.cache"
+         backupStaticProperties="false">
+    <testsuites>
+        <testsuite name="Unit">
+            <directory suffix="UnitTest.php">./src</directory>
+        </testsuite>
+    </testsuites>
+    <php>
+        <env name="CACHE_STORE" value="file"/>
+        <env name="SESSION_DRIVER" value="file"/>
+    </php>
+</phpunit>

src/Attributes/Unlocked.php

@@ -0,0 +1,10 @@
+<?php
+
+namespace WireElements\LivewireStrict\Attributes;
+
+use Livewire\Features\SupportAttributes\Attribute;
+
+#[\Attribute]
+class Unlocked extends Attribute
+{
+}

src/Features/SupportLockedProperties/SupportLockedProperties.php

@@ -0,0 +1,38 @@
+<?php
+
+namespace WireElements\LivewireStrict\Features\SupportLockedProperties;
+
+use Livewire\ComponentHook;
+use Livewire\Features\SupportAttributes\AttributeLevel;
+use Livewire\Features\SupportLockedProperties\CannotUpdateLockedPropertyException;
+use WireElements\LivewireStrict\Attributes\Unlocked;
+
+class SupportLockedProperties extends ComponentHook
+{
+    public static bool $locked = false;
+
+    public function update($propertyName, $fullPath, $newValue)
+    {
+        if (self::$locked === false) {
+            return;
+        }
+
+        $componentIsUnlocked = $this->component
+            ->getAttributes()
+            ->whereInstanceOf(Unlocked::class)
+            ->filter(fn (Unlocked $attribute) => $attribute->getLevel() === AttributeLevel::ROOT)
+            ->isNotEmpty();
+
+        if ($componentIsUnlocked) {
+            return;
+        }
+
+        $propertyIsUnlocked = $this->component
+            ->getAttributes()
+            ->whereInstanceOf(Unlocked::class)
+            ->filter(fn (Unlocked $attribute) => $attribute->getSubName() === $propertyName && $attribute->getLevel() === AttributeLevel::PROPERTY)
+            ->isNotEmpty();
+
+        throw_unless($propertyIsUnlocked, CannotUpdateLockedPropertyException::class, $propertyName);
+    }
+}

src/Features/SupportLockedProperties/UnitTest.php

@@ -0,0 +1,72 @@
+<?php
+
+namespace WireElements\LivewireStrict\Features\SupportLockedProperties;
+
+use Livewire\Component;
+use Livewire\Livewire;
+use WireElements\LivewireStrict\Attributes\Unlocked;
+use WireElements\LivewireStrict\LivewireStrict;
+
+class UnitTest extends \Tests\TestCase
+{
+    public function tearDown(): void
+    {
+        //SupportLockedProperties::$locked = false;
+
+        parent::tearDown();
+    }
+
+    public function test_cant_update_globally_locked_property()
+    {
+        $this->expectExceptionMessage(
+            'Cannot update locked property: [count]'
+        );
+
+        LivewireStrict::lockProperties();
+
+        Livewire::test(new class extends TestComponent
+        {
+            public $count = 1;
+
+            public function increment()
+            {
+                $this->count++;
+            }
+        })
+            ->assertSetStrict('count', 1)
+            ->set('count', 2);
+    }
+
+    public function test_can_update_unlocked_property()
+    {
+        LivewireStrict::lockProperties();
+
+        Livewire::test(new class extends TestComponent
+        {
+            #[Unlocked]
+            public $count = 1;
+        })
+            ->assertSetStrict('count', 1)
+            ->set('count', 2);
+    }
+
+    public function test_can_update_unlocked_component()
+    {
+        LivewireStrict::lockProperties();
+
+        Livewire::test(new #[Unlocked] class extends TestComponent
+        {
+            public $count = 1;
+        })
+            ->assertSetStrict('count', 1)
+            ->set('count', 2);
+    }
+}
+
+class TestComponent extends Component
+{
+    public function render()
+    {
+        return '<div></div>';
+    }
+}

src/LivewireStrict.php

@@ -0,0 +1,22 @@
+<?php
+
+namespace WireElements\LivewireStrict;
+
+use WireElements\LivewireStrict\Features\SupportLockedProperties\SupportLockedProperties;
+
+class LivewireStrict
+{
+    public static function lockProperties($condition = true)
+    {
+        SupportLockedProperties::$locked = $condition;
+    }
+
+    public static function enableAll($condition = true)
+    {
+        if (! $condition) {
+            return;
+        }
+
+        self::lockProperties();
+    }
+}

src/LivewireStrictServiceProvider.php

@@ -0,0 +1,16 @@
+<?php
+
+namespace WireElements\LivewireStrict;
+
+use Illuminate\Support\ServiceProvider;
+
+class LivewireStrictServiceProvider extends ServiceProvider
+{
+    /**
+     * Bootstrap any application services.
+     */
+    public function register(): void
+    {
+        app('livewire')->componentHook(Features\SupportLockedProperties\SupportLockedProperties::class);
+    }
+}

tests/TestCase.php

@@ -0,0 +1,43 @@
+<?php
+
+namespace Tests;
+
+use Illuminate\Support\Facades\Artisan;
+use Illuminate\Support\Facades\File;
+use WireElements\LivewireStrict\LivewireStrictServiceProvider;
+
+class TestCase extends \Orchestra\Testbench\TestCase
+{
+    public function setUp(): void
+    {
+        $this->afterApplicationCreated(function () {
+            $this->makeACleanSlate();
+        });
+
+        $this->beforeApplicationDestroyed(function () {
+            $this->makeACleanSlate();
+        });
+
+        parent::setUp();
+    }
+
+    public function makeACleanSlate()
+    {
+        Artisan::call('view:clear');
+
+        File::delete(app()->bootstrapPath('cache/livewire-components.php'));
+    }
+
+    protected function getPackageProviders($app)
+    {
+        return [
+            \Livewire\LivewireServiceProvider::class,
+            LivewireStrictServiceProvider::class,
+        ];
+    }
+
+    protected function defineEnvironment($app)
+    {
+        $app['config']->set('app.key', 'base64:Hupx3yAySikrM2/edkZQNQHslgDWYfiBfCuSThJ5SK8=');
+    }
+}