From 90ca822c433e1d95a3019518eee8895699c8195e Mon Sep 17 00:00:00 2001
From: Bjarn Bronsveld <bjarn@bronsveld.me>
Date: Fri, 2 Oct 2026 18:28:39 +0200
Subject: [PATCH] Treat widget submissions as anonymous

---
 app/Http/Controllers/WidgetController.php | 25 +----------------------
 tests/Feature/Widget/WidgetTest.php       | 16 ++++++++-------
 2 files changed, 10 insertions(+), 31 deletions(-)

diff --git a/app/Http/Controllers/WidgetController.php b/app/Http/Controllers/WidgetController.php
index 957a5cf5..b9ee7375 100644
--- a/app/Http/Controllers/WidgetController.php
+++ b/app/Http/Controllers/WidgetController.php
@@ -3,7 +3,6 @@
 namespace App\Http\Controllers;
 
 use App\Models\Item;
-use App\Models\User;
 use Illuminate\Http\Request;
 use Illuminate\Http\Response;
 use App\Settings\WidgetSettings;
@@ -102,36 +101,14 @@ public function submit(Request $request): JsonResponse
             return response()->json(['errors' => $validator->errors()], 422);
         }
 
-        // Only create/find user if email is provided
-        $user = null;
-        if ($request->filled('email')) {
-            $user = User::firstOrCreate(
-                ['email' => $request->input('email')],
-                [
-                    'name' => $request->input('name', 'Widget User'),
-                    'password' => bcrypt(str()->random(32)),
-                ]
-            );
-        }
-
-        // Temporarily set the user for this request without triggering login events
-        if ($user) {
-            auth()->setUser($user);
-        }
-
         // Create item
         $item = Item::create([
             'title' => $request->input('title'),
             'content' => $request->input('content'),
-            'user_id' => $user?->id,
+            'user_id' => null,
             'private' => false,
         ]);
 
-        // Automatically upvote the item for the user
-        if ($user) {
-            $item->toggleUpvote($user);
-        }
-
         return response()->json([
             'success' => true,
             'message' => 'Feedback submitted successfully',
diff --git a/tests/Feature/Widget/WidgetTest.php b/tests/Feature/Widget/WidgetTest.php
index bd3642af..b25c5122 100644
--- a/tests/Feature/Widget/WidgetTest.php
+++ b/tests/Feature/Widget/WidgetTest.php
@@ -1,6 +1,7 @@
 <?php
 
 use App\Models\Item;
+use App\Models\User;
 use App\Settings\WidgetSettings;
 use function Pest\Laravel\assertDatabaseHas;
 
@@ -182,7 +183,9 @@
         ->toContain("document.documentElement.classList.contains('dark')");
 });
 
-test('widget submission automatically upvotes item for user', function () {
+test('widget email does not assign an existing user or create a vote', function () {
+    $user = User::factory()->create(['email' => 'voter@example.com']);
+
     $response = $this->postJson('/api/widget/submit', [
         'title' => 'Test Feedback with Vote',
         'content' => 'This feedback should have an automatic upvote',
@@ -195,11 +198,12 @@
     $item = Item::where('title', 'Test Feedback with Vote')->first();
 
     expect($item)->not->toBeNull()
-        ->and($item->votes()->count())->toBe(1)
-        ->and($item->votes()->first()->user->email)->toBe('voter@example.com');
+        ->and($item->user_id)->toBeNull()
+        ->and($item->votes()->count())->toBe(0)
+        ->and(User::find($user->id))->not->toBeNull();
 });
 
-test('widget submission creates activity log with correct user', function () {
+test('widget email does not assign an activity causer', function () {
     $response = $this->postJson('/api/widget/submit', [
         'title' => 'Test Activity Log',
         'content' => 'This should have correct user in activity log',
@@ -214,7 +218,5 @@
 
     expect($item)->not->toBeNull()
         ->and($activity)->not->toBeNull()
-        ->and($activity->causer)->not->toBeNull()
-        ->and($activity->causer->email)->toBe('activity@example.com')
-        ->and($activity->causer->name)->toBe('Activity User');
+        ->and($activity->causer)->toBeNull();
 });