fix: remove deprecated Passport::personalAccessClientId() and enableImplicitGrant()

- Remove Passport::personalAccessClientId() (removed in Passport v13, auto-discovers now)
- Remove Passport::enableImplicitGrant() (legacy grant, no clients use it)
- Flatten config instance.oauth.pat to pat_enabled (remove dead pat.id key)
- Add OAUTH_PAT_ENABLED=false to .env.example and .env.docker.example
- Show swal alert when PATs disabled instead of hidden API error
- Improve store() error handling to surface 403 messages in the UI
- Remove OAUTH_PAT_ID row from admin diagnostics blade

.env.docker.example

@@ -12,6 +12,7 @@ OPEN_REGISTRATION="false"
 ENFORCE_EMAIL_VERIFICATION="true"
 PF_MAX_USERS="1000"
 OAUTH_ENABLED="true"
+OAUTH_PAT_ENABLED="false"
 ENABLE_CONFIG_CACHE="true"
 INSTANCE_DISCOVER_PUBLIC="true"
 

.env.example

@@ -8,6 +8,7 @@ OPEN_REGISTRATION="false"
 ENFORCE_EMAIL_VERIFICATION="false"
 PF_MAX_USERS="1000"
 OAUTH_ENABLED="true"
+OAUTH_PAT_ENABLED="false"
 ENABLE_CONFIG_CACHE="true"
 INSTANCE_DISCOVER_PUBLIC="true"
 

app/Http/Controllers/PersonalAccessTokenController.php

@@ -52,7 +52,7 @@ class PersonalAccessTokenController extends Controller
 
     public function store(Request $request): JsonResponse
     {
-        if (! config('instance.oauth.pat.enabled')) {
+        if (! config('instance.oauth.pat_enabled')) {
             return response()->json([
                 'error' => 'Personal access tokens are not enabled on this instance. Please contact your administrator.',
             ], 403);

app/Providers/AppServiceProvider.php

@@ -154,10 +154,6 @@ class AppServiceProvider extends ServiceProvider
         Passport::useTokenModel(OAuthToken::class);
         Passport::tokensExpireIn(now()->addDays(config('instance.oauth.token_expiration', 356)));
         Passport::refreshTokensExpireIn(now()->addDays(config('instance.oauth.refresh_expiration', 400)));
-        Passport::enableImplicitGrant();
-        if (config('instance.oauth.pat.enabled')) {
-            Passport::personalAccessClientId(config('instance.oauth.pat.id'));
-        }
 
         Passport::tokensCan([
             'read' => 'Full read access to your account',

config/instance.php

@@ -74,10 +74,7 @@ return [
     'oauth' => [
         'token_expiration' => env('OAUTH_TOKEN_DAYS', 365),
         'refresh_expiration' => env('OAUTH_REFRESH_DAYS', 400),
-        'pat' => [
-            'enabled' => env('OAUTH_PAT_ENABLED', false),
-            'id' => env('OAUTH_PAT_ID'),
-        ],
+        'pat_enabled' => env('OAUTH_PAT_ENABLED', false),
     ],
 
     'enable_cc' => env('ENABLE_CONFIG_CACHE', true),

resources/assets/js/components/passport/PersonalAccessTokens.vue

@@ -182,6 +182,13 @@
 
 <script>
     export default {
+        props: {
+            patEnabled: {
+                type: Boolean,
+                default: true
+            }
+        },
+
         data() {
             return {
                 accessToken: null,
@@ -256,6 +263,14 @@
             },
 
             showCreateTokenForm() {
+                if (!this.patEnabled) {
+                    swal({
+                        title: 'Personal Access Tokens Disabled',
+                        text: 'Personal access tokens are not enabled on this instance. Please contact your administrator.',
+                        icon: 'warning',
+                    });
+                    return;
+                }
                 $('#modal-create-token').modal('show');
             },
 
@@ -275,7 +290,9 @@
                             this.showAccessToken(response.data.accessToken);
                         })
                         .catch(error => {
-                            if (typeof error.response.data === 'object') {
+                            if (error.response && error.response.status === 403 && error.response.data.error) {
+                                this.form.errors = [error.response.data.error];
+                            } else if (typeof error.response.data === 'object' && error.response.data.errors) {
                                 this.form.errors = _.flatten(_.toArray(error.response.data.errors));
                             } else {
                                 this.form.errors = ['Something went wrong. Please try again.'];

resources/views/admin/diagnostics/home.blade.php

@@ -587,12 +587,7 @@
                                 	<tr>
                                 		<td><span class="badge badge-primary">INSTANCE</span></td>
                                 		<td><strong>OAUTH_PAT_ENABLED</strong></td>
-                                		<td><span>{{config_cache('instance.oauth.pat.enabled') ? '✅ true' : '❌ false' }}</span></td>
-                                	</tr>
-                                	<tr>
-                                		<td><span class="badge badge-primary">INSTANCE</span></td>
-                                		<td><strong>OAUTH_PAT_ID</strong></td>
-                                		<td><span>"{{config_cache('instance.oauth.pat.id')}}"</span></td>
+                                		<td><span>{{config_cache('instance.oauth.pat_enabled') ? '✅ true' : '❌ false' }}</span></td>
                                 	</tr>
                                 	<tr>
                                 		<td><span class="badge badge-primary">INSTANCE</span></td>

resources/views/settings/applications.blade.php

@@ -8,7 +8,7 @@
 <hr>
 @if((bool) config_cache('pixelfed.oauth_enabled') == true)
 	<passport-authorized-clients></passport-authorized-clients>
-	<passport-personal-access-tokens></passport-personal-access-tokens>
+	<passport-personal-access-tokens :pat-enabled="{{ config_cache('instance.oauth.pat_enabled') ? 'true' : 'false' }}"></passport-personal-access-tokens>
 @else
 	<p class="lead">OAuth has not been enabled on this instance.</p>
 @endif