Allow multiple social accounts per network via env

.env.ci

@@ -5,6 +5,7 @@ APP_DEBUG=true
 APP_URL=http://localhost
 
 SELF_HOSTED=true
+ALLOW_MULTIPLE_SOCIAL_ACCOUNTS=false
 
 APP_LOCALE=en
 APP_FALLBACK_LOCALE=en

.env.example

@@ -11,6 +11,10 @@ WEBHOOK_URL=
 # Self-hosted mode (skips payment requirements)
 SELF_HOSTED=true
 
+# Allow more than one connected account per social network in a workspace.
+# Independent of SELF_HOSTED (Cloud default is false). Self-hosted typically wants true.
+ALLOW_MULTIPLE_SOCIAL_ACCOUNTS=true
+
 # Passport OAuth keys (API tokens / MCP). Prefer env vars over key files so
 # every node behind a load balancer shares the same key pair. Use literal \n
 # for newlines in the PEM. When unset, Passport falls back to storage/oauth-*.key

AGENTS.md

@@ -222,6 +222,16 @@ Standing constraints:
 - Coupon qualification stays: card required, exactly one workspace, no prior real subscription (`incomplete` / `incomplete_expired` still qualify).
 - Prefer documenting durable billing decisions here (and in `CLAUDE.md`) — do **not** create a `.ai/` rules folder for this project.
 
+## Multiple social accounts per network
+
+One connected identity per social network per workspace is the Cloud default. This is **not** tied to `SELF_HOSTED` — Cloud cannot flip that flag, but it can flip this one.
+
+| Env | Config | Default | Effect |
+| --- | --- | --- | --- |
+| `ALLOW_MULTIPLE_SOCIAL_ACCOUNTS` | `trypost.allow_multiple_social_accounts` | `false` (falls back to `SELF_HOSTED` when unset) | `true`: a workspace may connect more than one account of the same network (two LinkedIns, two Instagrams, …). `false`: one per network (LinkedIn profile + page count as one; Instagram standalone + Instagram-via-Facebook count as one). Reconnecting the same `platform` + `platform_user_id` still updates the existing row. Shared to Inertia as `allowMultipleSocialAccounts`. |
+
+Self-hosted compose / `.env.example` set this `true`. When the env is unset, the config falls back to `SELF_HOSTED` so existing self-hosted installs keep multiple accounts. Do **not** use `selfHosted` for the occupancy check (observer, Telegram connect, `NetworkConnectGrid`).
+
 ## Social Platform API Documentation (official sources)
 
 **Always consult the official docs below before implementing or changing OAuth, publishing, deletion, rate-limit, or any other platform-specific behavior — never guess endpoints, scopes, rate limits, or capabilities from memory.** APIs shift over time; a behavior confirmed in a past session may no longer hold. One entry per social network we integrate with:

CLAUDE.md

@@ -244,6 +244,16 @@ Standing constraints:
 - Coupon qualification stays: card required, exactly one workspace, no prior real subscription (`incomplete` / `incomplete_expired` still qualify).
 - Prefer documenting durable billing decisions here (and in `AGENTS.md`) — do **not** create a `.ai/` rules folder for this project.
 
+## Multiple social accounts per network
+
+One connected identity per social network per workspace is the Cloud default. This is **not** tied to `SELF_HOSTED` — Cloud cannot flip that flag, but it can flip this one.
+
+| Env | Config | Default | Effect |
+| --- | --- | --- | --- |
+| `ALLOW_MULTIPLE_SOCIAL_ACCOUNTS` | `trypost.allow_multiple_social_accounts` | `false` (falls back to `SELF_HOSTED` when unset) | `true`: a workspace may connect more than one account of the same network (two LinkedIns, two Instagrams, …). `false`: one per network (LinkedIn profile + page count as one; Instagram standalone + Instagram-via-Facebook count as one). Reconnecting the same `platform` + `platform_user_id` still updates the existing row. Shared to Inertia as `allowMultipleSocialAccounts`. |
+
+Self-hosted compose / `.env.example` set this `true`. When the env is unset, the config falls back to `SELF_HOSTED` so existing self-hosted installs keep multiple accounts. Do **not** use `selfHosted` for the occupancy check (observer, Telegram connect, `NetworkConnectGrid`).
+
 ## Icons (@tabler/icons-vue)
 
 - This project uses `@tabler/icons-vue` for all icons. NEVER use `lucide-vue-next`.
@@ -304,13 +314,19 @@ Standing constraints:
     - Example: `$this->postJson(route('app.posts.store'))` instead of `$this->postJson('/posts')`.
     - With params: `route('app.posts.ai.create.finalize', $creationId)`.
 
-## Dusk (Browser Tests)
+## Browser Tests (Pest + Playwright)
+
+Browser tests live in `tests/Browser` and run on `pestphp/pest-plugin-browser` driving Playwright. **Laravel Dusk is not installed** — there is no `DuskTestCase`, no `$browser` object, and no `browse()`. Do not add `dusk="..."` attributes; they select nothing.
 
-- In Dusk tests, ALWAYS use named routes via `route()` helper. NEVER hardcode URLs like `'https://trypost.test/login'`.
-    - Example: `$browser->visit(route('login'))` instead of `$browser->visit('https://trypost.test/login')`.
-- ALWAYS use `dusk` selectors (`@selector-name`) for interacting with and asserting elements. NEVER use CSS classes (`.text-red-600`), tag names, or text strings.
-    - Add `dusk="my-element"` attributes to Vue components and use `$browser->click('@my-element')`, `$browser->waitFor('@my-element')`, etc.
-    - Example: `$browser->waitFor('@input-error')` instead of `$browser->waitFor('.text-red-600')`.
+- ALWAYS use named routes via `route()`. NEVER hardcode URLs like `'https://trypost.test/login'`.
+    - Example: `visit(route('login'))`.
+- ALWAYS target elements by `data-testid`. NEVER use CSS classes (`.text-red-600`), tag names, or text strings.
+    - `@my-element` resolves to `[data-testid="my-element"]`, so add `data-testid="my-element"` in the Vue component and use `$page->click('@my-element')`.
+    - Bind it for repeated elements: `:data-testid="`connect-${platform.value}`"`.
+- Assertions do NOT auto-wait on SPA paint. Wait for the element to mount and lay out first — see the `waitFor*TestId()` helper at the top of `tests/Browser/WelcomeConnectTest.php` and copy the pattern under a file-unique name (these helpers are global functions; a duplicated name collides across test files).
+- `BrowserTestCase` sets `$fakesVite = false` on purpose: these tests load real built assets, so faking Vite blanks the app.
+- End page assertions with `->assertNoJavaScriptErrors()`.
+- CI runs them un-parallelised (`php artisan test tests/Browser --compact`) against `npm run build` output, so keep them independent of a running dev server.
 
 ## Array Data Access
 

app/Actions/SocialAccount/ConnectTelegramChannel.php

@@ -8,6 +8,7 @@
 use App\Enums\SocialAccount\Status;
 use App\Events\TelegramChannelConnected;
 use App\Events\TelegramConnectFailed;
+use App\Exceptions\SocialAccount\NetworkAlreadyConnectedException;
 use App\Models\SocialAccount;
 use App\Models\Workspace;
 use App\Services\Social\Telegram\TelegramApi;
@@ -24,51 +25,73 @@ class ConnectTelegramChannel
      * @return SocialAccount|null The linked account, or null when blocked (account
      *                            limit reached or the code was already consumed).
      */
-    public static function execute(Workspace $workspace, array $chat, string $nonce): ?SocialAccount
+    public static function execute(Workspace $workspace, array $chat, string $nonce, mixed $reconnectId = null): ?SocialAccount
     {
         $chatId = (string) data_get($chat, 'id');
         $username = data_get($chat, 'username');
+        $reconnect = is_string($reconnectId)
+            ? $workspace->socialAccounts()
+                ->whereIn('platform', Platform::Telegram->networkPlatformValues())
+                ->find($reconnectId)
+            : null;
 
         $isNewAccount = ! $workspace->socialAccounts()
             ->where('platform', Platform::Telegram->value)
             ->where('platform_user_id', $chatId)
             ->exists();
 
-        if ($isNewAccount && self::networkAlreadyConnected($workspace, $chatId)) {
+        if ($reconnect === null && $isNewAccount && SocialAccount::occupiesNetwork((string) $workspace->id, Platform::Telegram)) {
             TelegramConnectFailed::dispatch($workspace->id, $nonce, 'network_taken');
 
             return null;
         }
 
+        // Reject before consuming the nonce so the user can retry in the right
+        // chat with the code they already have.
+        if ($reconnect !== null && (string) $reconnect->platform_user_id !== $chatId) {
+            TelegramConnectFailed::dispatch($workspace->id, $nonce, 'wrong_chat');
+
+            return null;
+        }
+
         // Consume the code once so a leaked code can't be replayed to link another chat.
         if (! Cache::add("telegram:connect:{$nonce}", true, now()->addMinutes(15))) {
             return null;
         }
 
-        $account = $workspace->socialAccounts()->updateOrCreate(
-            [
-                'platform' => Platform::Telegram->value,
-                'platform_user_id' => $chatId,
-            ],
-            [
-                'username' => $username,
-                'display_name' => data_get($chat, 'title') ?? $username ?? "Telegram {$chatId}",
-                'avatar_url' => self::fetchChannelAvatar($chatId),
-                'access_token' => '',
-                'refresh_token' => '',
-                'token_expires_at' => null,
-                'scopes' => [],
-                'status' => Status::Connected,
-                'error_message' => null,
-                'disconnected_at' => null,
-                'meta' => [
-                    'chat_id' => $chatId,
+        try {
+            $account = SocialAccount::connectIdentity(
+                $workspace,
+                Platform::Telegram,
+                $chatId,
+                [
                     'username' => $username,
-                    'type' => data_get($chat, 'type'),
-                    'connect_nonce' => $nonce,
+                    'display_name' => data_get($chat, 'title') ?? $username ?? "Telegram {$chatId}",
+                    'avatar_url' => self::fetchChannelAvatar($chatId),
+                    'access_token' => '',
+                    'refresh_token' => '',
+                    'token_expires_at' => null,
+                    'scopes' => [],
+                    'status' => Status::Connected,
+                    'error_message' => null,
+                    'disconnected_at' => null,
+                    'meta' => [
+                        'chat_id' => $chatId,
+                        'username' => $username,
+                        'type' => data_get($chat, 'type'),
+                        'connect_nonce' => $nonce,
+                    ],
                 ],
-            ],
-        );
+                $reconnect,
+            );
+        } catch (NetworkAlreadyConnectedException $e) {
+            // The nonce is already spent, so letting a busy lock reach the
+            // webhook would 500 to Telegram and its retry would short-circuit
+            // on the consumed code, leaving the dialog spinning with no error.
+            TelegramConnectFailed::dispatch($workspace->id, $nonce, $e->messageKey);
+
+            return null;
+        }
 
         TelegramChannelConnected::dispatch($workspace->id, $nonce);
 
@@ -102,16 +125,4 @@ private static function fetchChannelAvatar(string $chatId): ?string
             return null;
         }
     }
-
-    private static function networkAlreadyConnected(Workspace $workspace, string $chatId): bool
-    {
-        if (config('trypost.self_hosted')) {
-            return false;
-        }
-
-        return $workspace->socialAccounts()
-            ->whereIn('platform', Platform::Telegram->networkPlatformValues())
-            ->where('platform_user_id', '!=', $chatId)
-            ->exists();
-    }
 }

app/Enums/SocialAccount/Platform.php

@@ -431,7 +431,7 @@ public static function instagramConnectMethods(): array
      * Instagram includes `connect_methods` so the connect dialog only lists
      * OAuth entry points that are actually enabled (self-hosters may disable one).
      *
-     * @return list<array{value: string, label: string, color: string, network: string, connect_methods?: list<string>}>
+     * @return list<array{value: string, label: string, network: string, connect_methods?: list<string>}>
      */
     public static function connectableOptions(): array
     {
@@ -442,7 +442,6 @@ public static function connectableOptions(): array
                 $option = [
                     'value' => $platform->value,
                     'label' => $platform->label(),
-                    'color' => $platform->color(),
                     'network' => $platform->network(),
                 ];
 

app/Exceptions/SocialAccount/ConnectPopupException.php

@@ -0,0 +1,43 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Exceptions\SocialAccount;
+
+use App\Enums\SocialAccount\Platform;
+use Illuminate\Contracts\Debug\ShouldntReport;
+use Illuminate\Http\Request;
+use Inertia\Inertia;
+use Inertia\Response;
+use RuntimeException;
+
+/**
+ * Abort a social connect flow and close the popup with a reason.
+ *
+ * Rendering lives on the exception so the session and permission guards that
+ * open every connect action stay a single line instead of six.
+ *
+ * An expired popup session is a normal outcome, not an incident, so this never
+ * reaches the error log.
+ */
+class ConnectPopupException extends RuntimeException implements ShouldntReport
+{
+    public function __construct(
+        public readonly string $messageKey,
+        public readonly ?Platform $platform = null,
+    ) {
+        parent::__construct("Social connect aborted: {$messageKey}");
+    }
+
+    public function render(Request $request): Response
+    {
+        session()->forget(['social_connect_workspace', 'social_reconnect_id']);
+
+        return Inertia::render('accounts/PopupCallback', [
+            'success' => false,
+            'message' => __("accounts.popup_callback.{$this->messageKey}"),
+            'platform' => $this->platform?->value,
+            'onboardingProgress' => false,
+        ]);
+    }
+}

app/Exceptions/SocialAccount/NetworkAlreadyConnectedException.php

@@ -9,8 +9,30 @@
 
 class NetworkAlreadyConnectedException extends RuntimeException
 {
-    public function __construct(public readonly Platform $platform)
+    public function __construct(
+        public readonly Platform $platform,
+        public readonly string $messageKey = 'network_taken',
+        ?string $reason = null,
+    ) {
+        parent::__construct($reason ?? "This workspace already has a {$platform->network()} account connected.");
+    }
+
+    /**
+     * The provider handed back an account other than the one being reconnected,
+     * which is a different problem from the network slot being taken.
+     */
+    public static function identityMismatch(Platform $platform): self
+    {
+        return new self($platform, 'wrong_account', "The provider returned an identity other than the {$platform->network()} card being reconnected.");
+    }
+
+    /**
+     * Another connect on this network holds the lock. Carried on this exception
+     * so it lands in the messageKey branch every connect flow already handles,
+     * rather than the generic catch that files a normal race as an error.
+     */
+    public static function connectInProgress(Platform $platform): self
     {
-        parent::__construct("This workspace already has a {$platform->network()} account connected.");
+        return new self($platform, 'busy', "Another {$platform->network()} connect is still finishing.");
     }
 }

app/Http/Controllers/Auth/BlueskyController.php

@@ -6,6 +6,8 @@
 
 use App\Enums\SocialAccount\Platform as SocialPlatform;
 use App\Enums\SocialAccount\Status;
+use App\Exceptions\SocialAccount\NetworkAlreadyConnectedException;
+use App\Models\SocialAccount;
 use App\Services\Social\BlueskyLexicon;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Http;
@@ -26,6 +28,8 @@ public function connect(Request $request): InertiaResponse
 
         $this->authorize('manageAccounts', $workspace);
 
+        $this->rememberConnectSession($request, $workspace);
+
         return Inertia::render('accounts/BlueskyConnect', [
             'errors' => session('errors')?->getBag('default')?->toArray() ?? [],
         ]);
@@ -79,12 +83,12 @@ public function store(Request $request): InertiaResponse
             $profile = $profileResponse->successful() ? $profileResponse->json() : [];
 
             $avatarPath = data_get($profile, 'avatar') ? uploadFromUrl(data_get($profile, 'avatar')) : null;
+            $reconnect = $this->reconnectAccount($workspace);
 
-            $workspace->socialAccounts()->updateOrCreate(
-                [
-                    'platform' => $this->platform->value,
-                    'platform_user_id' => data_get($data, 'did'),
-                ],
+            SocialAccount::connectIdentity(
+                $workspace,
+                $this->platform,
+                (string) data_get($data, 'did'),
                 [
                     'username' => data_get($data, 'handle'),
                     'display_name' => data_get($profile, 'displayName', data_get($data, 'handle')),
@@ -101,11 +105,14 @@ public function store(Request $request): InertiaResponse
                         'password' => encrypt($request->password),
                     ],
                 ],
+                $reconnect,
             );
 
-            return $this->popupCallback(true, __('accounts.popup_callback.connected'), $this->platform->value);
+            return $this->connectedCallback($reconnect);
         } catch (ValidationException $e) {
             throw $e;
+        } catch (NetworkAlreadyConnectedException $e) {
+            return $this->popupCallback(false, __("accounts.popup_callback.{$e->messageKey}"), $this->platform->value);
         } catch (\Exception $e) {
             Log::error('Bluesky connection error', [
                 'error' => $e->getMessage(),

app/Http/Controllers/Auth/DiscordController.php

@@ -28,6 +28,6 @@ public function connect(Request $request): Response
 
     public function callback(Request $request): InertiaResponse
     {
-        return $this->handleCallback($request, $this->platform, $this->driver);
+        return $this->handleCallback($request, $this->driver);
     }
 }