Merge pull request #6778 from pixelfed/fix/prevent-pat-client-deletion-6630

Fix: Improve the web UX for deleting the OAuth Client and PAT

app/Http/Controllers/OAuth/OAuthClientController.php

@@ -0,0 +1,40 @@
+<?php
+
+namespace App\Http\Controllers\OAuth;
+
+use App\Http\Controllers\Controller;
+use Illuminate\Http\Request;
+use Illuminate\Http\Response;
+use Laravel\Passport\ClientRepository;
+use Laravel\Passport\Passport;
+
+class OAuthClientController extends Controller
+{
+    public function destroy(Request $request, string|int $clientId): Response
+    {
+        $clients = app(ClientRepository::class);
+
+        $client = $request->user()->clients()->where('revoked', false)->find($clientId);
+
+        if (! $client) {
+            return new Response('', 404);
+        }
+
+        if ($client->hasGrantType('personal_access')) {
+            return new Response(json_encode([
+                'error' => 'Cannot delete the personal access client. This client is required for personal access token functionality.',
+            ]), 403, ['Content-Type' => 'application/json']);
+        }
+
+        // Check legacy column as well
+        if (isset($client->personal_access_client) && $client->personal_access_client) {
+            return new Response(json_encode([
+                'error' => 'Cannot delete the personal access client. This client is required for personal access token functionality.',
+            ]), 403, ['Content-Type' => 'application/json']);
+        }
+
+        $clients->delete($client);
+
+        return new Response('', Response::HTTP_NO_CONTENT);
+    }
+}

resources/assets/js/components/passport/Clients.vue

@@ -455,10 +455,21 @@
              * Destroy the given client.
              */
             destroy(client) {
+                if (!confirm('Are you sure you want to delete this OAuth client? Any applications using it will stop working immediately.')) {
+                    return;
+                }
+
                 axios.delete('/oauth/clients/' + client.id)
-                        .then(response => {
-                            this.getClients();
-                        });
+                    .then(response => {
+                        this.getClients();
+                    })
+                    .catch(error => {
+                        if (error.response && error.response.data && error.response.data.error) {
+                            alert(error.response.data.error);
+                        } else {
+                            alert('Failed to delete client. Please try again.');
+                        }
+                    });
             }
         }
     }

routes/web.php

@@ -110,7 +110,7 @@ Route::domain(config('pixelfed.domain.app'))->middleware(['validemail', 'twofact
             ]);
 
             Route::delete('/clients/{client_id}', [
-                'uses' => '\Laravel\Passport\Http\Controllers\ClientController@destroy',
+                'uses' => '\App\Http\Controllers\OAuth\OAuthClientController@destroy',
                 'as' => 'clients.destroy',
             ]);