update rm deadcode

app/Http/Controllers/Api/Transaction/ManualDepositController.php

@@ -182,6 +182,18 @@ class ManualDepositController extends Controller
 
         $user = $request->user();
 
+        if (
+            !str_starts_with($request->proof_image, "deposit-proofs/{$user->id}/")
+            || str_contains($request->proof_image, '..')
+            || !Storage::disk('local')->exists($request->proof_image)
+            || Transaction::where('proof_image', $request->proof_image)->exists()
+        ) {
+            return response()->json([
+                'error'   => true,
+                'message' => 'Chứng từ không hợp lệ',
+            ], 422);
+        }
+
         $transaction = Transaction::where('uuid', $request->uuid)
             ->where('customer_id', $user->id)
             ->where('type', 'manual')
@@ -254,14 +266,15 @@ class ManualDepositController extends Controller
     public function uploadProof(Request $request): JsonResponse
     {
         $request->validate([
-            'file' => 'required|image|mimes:jpeg,jpg,png|max:5120',
+            'file' => 'required|image|mimes:jpeg,jpg,png,webp|max:5120',
         ]);
 
-        $path = $request->file('file')->store('deposit-proofs', 'public');
+        $user = $request->user();
+
+        $path = $request->file('file')->store('deposit-proofs/' . $user->id, 'local');
 
         return response()->json([
             'error' => false,
-            'url'   => Storage::disk('public')->url($path),
             'path'  => $path,
         ]);
     }
@@ -288,7 +301,7 @@ class ManualDepositController extends Controller
                 'client_ip' => $request->ip(),
                 'transaction_code' => $transaction->public_code,
                 'amount' => $transaction->amount,
-                'proof_image_url' => $transaction->proof_image ? Storage::disk('public')->url($transaction->proof_image) : null,
+                'proof_image_url' => $transaction->proof_image_urls[0] ?? null,
                 'created_at' => now()->format('d/m/Y H:i:s'),
             ]));
         } catch (\Throwable $e) {