Development

.env.ci.test → .env.ci

@@ -3,6 +3,15 @@ APP_ENV=development
 APP_KEY=
 APP_DEBUG=true
 APP_URL=http://localhost:80
+
+APP_LOCALE=en
+APP_FALLBACK_LOCALE=en
+APP_FAKER_LOCALE=en_US
+APP_MAINTENANCE_DRIVER=file
+APP_MAINTENANCE_STORE=database
+PHP_CLI_SERVER_WORKERS=4
+
+BCRYPT_ROUNDS=12
 APP_DESCRIPTION='nmrXiv is currently developed as the FAIR, consensus-driven NMR data repository and computational platform. The ultimate goal is to accelerate broader coordination and data sharing among natural product (NP) researchers by enabling the storage, management, sharing and analysis of NMR data.'
 COOL_OFF_PERIOD=10
 SCHEMA_VERSION=beta
@@ -14,23 +23,31 @@ EUROPEMC_WS_API=https://www.ebi.ac.uk/europepmc/webservices/rest/search
 ORCID_ID_SEARCH_API=https://pub.orcid.org/v2.1/search
 ORCID_ID_EMPLOYMENT_API=https://pub.orcid.org/v3.0/{orcid_id}/employments
 ORCID_ID_PERSON_API=https://pub.orcid.org/v3.0/{orcid_id}/person
+CM_API=https://api.cheminf.studio/latest/
+CROSSREF_API=https://api.crossref.org/works/
+DATACITE_API=https://api.datacite.org/
+DATACITE_TEST_API=https://api.test.datacite.org
 
 LOG_CHANNEL=stack
+LOG_STACK=single
 LOG_LEVEL=debug
 
 DB_CONNECTION=pgsql
 DB_HOST=127.0.0.1
 DB_PORT=5432
-DB_DATABASE=nmrxiv
+DB_DATABASE=nmrxiv_test
 DB_USERNAME=postgres
-DB_PASSWORD=postgres
+DB_PASSWORD=password
 
 BROADCAST_CONNECTION=log
 CACHE_STORE=file
 FILESYSTEM_DRIVER=local
 QUEUE_CONNECTION=redis
 SESSION_DRIVER=redis
 SESSION_LIFETIME=120
+SESSION_ENCRYPT=false
+SESSION_PATH=/
+SESSION_DOMAIN=null
 
 MEMCACHED_HOST=memcached
 
@@ -58,6 +75,7 @@ AWS_BUCKET=nmrxiv
 AWS_BUCKET_PUBLIC=nmrxiv-public
 AWS_ENDPOINT=https://s3.uni-jena.de
 AWS_URL=https://s3.uni-jena.de
+AWS_USE_PATH_STYLE_ENDPOINT=false
 
 PUSHER_APP_ID=
 PUSHER_APP_KEY=
@@ -67,9 +85,9 @@ PUSHER_APP_CLUSTER=mt1
 MIX_PUSHER_APP_KEY="${PUSHER_APP_KEY}"
 MIX_PUSHER_APP_CLUSTER="${PUSHER_APP_CLUSTER}"
 
-SCOUT_DRIVER=meilisearch
-SCOUT_PREFIX=dev_
-MEILISEARCH_HOST=https://msdev.nmrxiv.org
+SCOUT_DRIVER=null
+SCOUT_PREFIX=test_
+MEILISEARCH_HOST=http://localhost:7700/
 MEILISEARCH_KEY=
 MEILISEARCH_PUBLICKEY=
 
@@ -81,4 +99,40 @@ TWITTER_CLIENT_ID=
 TWITTER_CLIENT_SECRET=
 TWITTER_REDIRECT_URL=http://localhost:80/auth/login/twitter/callback
 
+ORCID_CLIENT_ID=
+ORCID_CLIENT_SECRET=
+ORCID_REDIRECT_URL=http://localhost/auth/login/orcid/callback
+ORCID_ENVIRONMENT=sandbox
+
+NFDIAAI_CLIENT_ID=
+NFDIAAI_CLIENT_SECRET=
+NFDIAAI_REDIRECT_URL="${APP_URL}/auth/login/regapp/callback"
+
 TELESCOPE_ENABLED=false
+
+#DATACITE Properties
+DOI_HOST=datacite
+DATACITE_USERNAME=
+DATACITE_SECRET=
+DATACITE_PREFIX=
+DATACITE_ENDPOINT=https://api.test.datacite.org
+
+NMRKIT_URL=https://nodejs.nmrxiv.org
+PUBCHEM_URL=https://pubchem.ncbi.nlm.nih.gov
+COMMON_CHEMISTRY_URL=https://commonchemistry.cas.org/api
+CAS_API_TOKEN=
+CHEMISTRY_STANDARDIZE_URL=https://api.cheminf.studio/latest/chem/standardize
+
+BACKUP_KEEP_DAYS=7
+
+# CSP Configuration
+CSP_ENABLED=true
+CSP_REPORT_URI="/csp-violation-report"
+CSP_NONCE_ENABLED=true
+CSP_ENABLED_WHILE_HOT_RELOADING=false
+
+# Additional CSP sources (comma-separated, no spaces)
+# CSP_ADDITIONAL_CONNECT_SRC="https://api.example.com,https://analytics.example.com"
+# CSP_ADDITIONAL_IMG_SRC="https://cdn.example.com,https://images.example.com"
+# CSP_ADDITIONAL_SCRIPT_SRC="https://cdn.example.com"
+# CSP_ADDITIONAL_STYLE_SRC="https://fonts.example.com"

.env.example

@@ -26,6 +26,7 @@ ORCID_ID_PERSON_API=https://pub.orcid.org/v3.0/{orcid_id}/person
 CM_API=https://api.cheminf.studio/latest/
 CROSSREF_API=https://api.crossref.org/works/
 DATACITE_API=https://api.datacite.org/
+DATACITE_TEST_API=https://api.test.datacite.org
 
 
 LOG_CHANNEL=stack
@@ -115,12 +116,23 @@ DOI_HOST=datacite
 DATACITE_USERNAME=
 DATACITE_SECRET=
 DATACITE_PREFIX=
-DATACITE_ENDPOINT=
+DATACITE_ENDPOINT=https://api.test.datacite.org
 
 NMRKIT_URL=https://nodejs.nmrxiv.org
-CAS_URL=https://commonchemistry.cas.org
 PUBCHEM_URL=https://pubchem.ncbi.nlm.nih.gov
-COMMON_CHEMISTRY_URL=https://commonchemistry.cas.org
+COMMON_CHEMISTRY_URL=https://commonchemistry.cas.org/api
+CAS_API_TOKEN=
 CHEMISTRY_STANDARDIZE_URL=https://api.cheminf.studio/latest/chem/standardize
 
-BACKUP_KEEP_DAYS=7
+BACKUP_KEEP_DAYS=7
+
+# CSP Configuration
+CSP_ENABLED=true
+CSP_NONCE_ENABLED=false
+CSP_ENABLED_WHILE_HOT_RELOADING=false
+
+# Additional CSP sources (comma-separated, no spaces)
+# CSP_ADDITIONAL_CONNECT_SRC="https://api.example.com,https://analytics.example.com"
+# CSP_ADDITIONAL_IMG_SRC="https://cdn.example.com,https://images.example.com"
+# CSP_ADDITIONAL_SCRIPT_SRC="https://cdn.example.com"
+# CSP_ADDITIONAL_STYLE_SRC="https://fonts.example.com"

.github/workflows/lint-security-check.yml

@@ -40,7 +40,7 @@ jobs:
       - name: Setup PHP
         uses: shivammathur/setup-php@v2
         with:
-          php-version: '8.3'
+          php-version: '8.4'
           coverage: none
           tools: composer
           extensions: mbstring, intl, pdo, pdo_mysql, pdo_pgsql

.github/workflows/pr-lint.yml → .github/workflows/pr-lint-test.yml

@@ -1,4 +1,4 @@
-name: PR Lint & Security
+name: PR Lint, Security and Tests
 
 on:
   pull_request:
@@ -10,6 +10,8 @@ on:
 permissions:
   contents: read
   security-events: write
+  pull-requests: write
+  checks: write
 
 jobs:
   lint-security:
@@ -19,3 +21,8 @@ jobs:
       run_php: true
       run_js: true
       run_secrets: true
+
+  test-coverage:
+    name: Tests & Coverage (PHP 8.4)
+    uses: ./.github/workflows/test-coverage.yml
+    secrets: inherit

.github/workflows/test-coverage.yml

@@ -0,0 +1,79 @@
+name: PHPUnit Tests & Coverage Analysis
+
+on:
+  workflow_call:
+
+jobs:
+  test-coverage:
+    name: Tests & Coverage (PHP 8.4)
+    runs-on: ubuntu-latest
+
+    services:
+      postgres:
+        image: postgres:17
+        env:
+          POSTGRES_DB: nmrxiv_test
+          POSTGRES_USER: postgres
+          POSTGRES_PASSWORD: password
+        ports:
+        - 5432:5432
+        options: --health-cmd pg_isready --health-interval 10s --health-timeout 5s --health-retries 5
+
+    steps:
+    - uses: actions/checkout@v4
+
+    - name: Setup PHP
+      uses: shivammathur/setup-php@v2
+      with:
+        php-version: '8.4'
+        extensions: dom, curl, libxml, mbstring, zip, pcntl, pdo, pdo_pgsql, bcmath, soap, intl, gd, exif, iconv
+        coverage: pcov
+
+    - name: Cache Composer packages
+      uses: actions/cache@v4
+      with:
+        path: vendor
+        key: ${{ runner.os }}-php-${{ hashFiles('**/composer.lock') }}
+        restore-keys: |
+          ${{ runner.os }}-php-
+
+    - name: Install composer dependencies
+      run: composer install --ignore-platform-reqs
+
+    - name: Prepare Laravel Application
+      run: |
+        php -r "file_exists('.env') || copy('.env.ci', '.env');"
+
+        echo AWS_ACCESS_KEY_ID=${{ secrets.AWS_ACCESS_KEY_ID_DEV }} >> .env
+        echo AWS_SECRET_ACCESS_KEY=${{ secrets.AWS_SECRET_ACCESS_KEY_DEV }} >> .env
+        echo MEILISEARCH_KEY=${{ secrets.MEILISEARCH_KEY_DEV }} >> .env
+        echo MEILISEARCH_PUBLICKEY=${{ secrets.MEILISEARCH_PUBLICKEY_DEV }} >> .env
+
+        php artisan key:generate
+        php artisan migrate --seed
+
+    - name: Cache Node modules
+      uses: actions/cache@v4
+      with:
+        path: ~/.npm
+        key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
+        restore-keys: |
+          ${{ runner.os }}-node-
+
+    - name: Install front-end dependencies
+      run: npm ci
+
+    - name: Build front-end assets
+      run: npm run build
+
+    - name: Run tests and collect coverage
+      run: vendor/bin/phpunit --coverage-clover coverage.xml --display-skipped
+
+    - name: Upload coverage to Codecov
+      uses: codecov/codecov-action@v4
+      with:
+        file: ./coverage.xml
+        flags: unittests
+        name: codecov-umbrella
+        fail_ci_if_error: false
+        token: ${{ secrets.CODECOV_TOKEN }}

.gitignore

@@ -7,7 +7,6 @@
 /vendor
 .env
 .env.production
-.env.*
 .env.backup
 .phpunit.result.cache
 docker-compose.override.yml
@@ -24,3 +23,8 @@ docs/.vitepress/cache
 **/caddy
 frankenphp
 frankenphp-worker.php
+
+# Coverage reports
+coverage.xml
+coverage-report/
+.phpunit.cache

app/Actions/Project/ArchiveProject.php

@@ -12,14 +12,24 @@ class ArchiveProject
      * @param  mixed  $project
      * @return void
      */
-    public function toggle($project)
+    public function toggleArchive($project)
     {
         $archiveState = ! $project->is_archived;
-        $project->studies()->update(['is_archived' => $archiveState]);
+        $project->studies()->update([
+            'is_archived' => $archiveState,
+            'status' => $archiveState ? 'archived' : 'published',
+        ]);
+
         foreach ($project->studies as $study) {
-            $study->datasets()->update(['is_archived' => $archiveState]);
+            $study->datasets()->update([
+                'is_archived' => $archiveState,
+                'status' => $archiveState ? 'archived' : 'published',
+            ]);
         }
+
         $project->is_archived = $archiveState;
+        $project->status = $archiveState ? 'archived' : 'published';
+
         if ($project->is_archived) {
             $project->sendNotification('archival', $this->prepareSendList($project));
         }

app/Actions/Project/CreateNewProject.php

@@ -19,7 +19,7 @@ class CreateNewProject
      */
     public function create(array $input)
     {
-        $license = $input['license'];
+        $license = $input['license'] ?? null;
         $errorMessages = [
             'license.required_if' => 'The license field is required when the project is made public.',
         ];

app/Actions/Project/DeleteProject.php

@@ -30,8 +30,8 @@ public function delete($project)
         } else {
             $project->studies()->update(['is_deleted' => true]);
             foreach ($project->studies as $study) {
-                $study->update(['is_deleted' => true]);
-                $study->datasets()->update(['is_deleted' => true]);
+                $study->update(['is_deleted' => true, 'status' => 'deleted']);
+                $study->datasets()->update(['is_deleted' => true, 'status' => 'deleted']);
             }
             $draft = $project->draft;
             if ($draft) {
@@ -40,6 +40,7 @@ public function delete($project)
             $project->name = $project->name;
             $project->deleted_on = Carbon::now();
             $project->is_deleted = true;
+            $project->status = 'deleted';
             $project->sendNotification('deletion', $this->prepareSendList($project));
         }
         $project->save();

app/Actions/Project/RestoreProject.php

@@ -27,8 +27,10 @@ public function restore($project)
                 $study->datasets()->update(['is_deleted' => false]);
             }
             $draft = $project->draft;
-            $draft->is_deleted = false;
-            $draft->save();
+            if ($draft) {
+                $draft->is_deleted = false;
+                $draft->save();
+            }
             $project->is_deleted = false;
             $project->save();
         }