From 5a364be58b9a72cd1da694b076ac511f495b25e4 Mon Sep 17 00:00:00 2001
From: Your Name <you@example.com>
Date: Thu, 27 Aug 2026 19:12:46 +0930
Subject: [PATCH] fix: remove deprecated Passport::personalAccessClientId() and
 enableImplicitGrant()

- Remove Passport::personalAccessClientId() (removed in Passport v13, auto-discovers now)
- Remove Passport::enableImplicitGrant() (legacy grant, no clients use it)
- Flatten config instance.oauth.pat to pat_enabled (remove dead pat.id key)
- Add OAUTH_PAT_ENABLED=false to .env.example and .env.docker.example
- Show swal alert when PATs disabled instead of hidden API error
- Improve store() error handling to surface 403 messages in the UI
- Remove OAUTH_PAT_ID row from admin diagnostics blade
---
 .env.docker.example                           |  1 +
 .env.example                                  |  1 +
 .../PersonalAccessTokenController.php         |  2 +-
 app/Providers/AppServiceProvider.php          |  4 ----
 config/instance.php                           |  5 +----
 .../passport/PersonalAccessTokens.vue         | 19 ++++++++++++++++++-
 .../views/admin/diagnostics/home.blade.php    |  7 +------
 .../views/settings/applications.blade.php     |  2 +-
 8 files changed, 24 insertions(+), 17 deletions(-)

diff --git a/.env.docker.example b/.env.docker.example
index ba6189b8e..07695379a 100644
--- a/.env.docker.example
+++ b/.env.docker.example
@@ -12,6 +12,7 @@ OPEN_REGISTRATION="false"
 ENFORCE_EMAIL_VERIFICATION="true"
 PF_MAX_USERS="1000"
 OAUTH_ENABLED="true"
+OAUTH_PAT_ENABLED="false"
 ENABLE_CONFIG_CACHE="true"
 INSTANCE_DISCOVER_PUBLIC="true"
 
diff --git a/.env.example b/.env.example
index cc1c12927..b812bd2d4 100644
--- a/.env.example
+++ b/.env.example
@@ -8,6 +8,7 @@ OPEN_REGISTRATION="false"
 ENFORCE_EMAIL_VERIFICATION="false"
 PF_MAX_USERS="1000"
 OAUTH_ENABLED="true"
+OAUTH_PAT_ENABLED="false"
 ENABLE_CONFIG_CACHE="true"
 INSTANCE_DISCOVER_PUBLIC="true"
 
diff --git a/app/Http/Controllers/PersonalAccessTokenController.php b/app/Http/Controllers/PersonalAccessTokenController.php
index c6c2b75f4..839ea8ec1 100644
--- a/app/Http/Controllers/PersonalAccessTokenController.php
+++ b/app/Http/Controllers/PersonalAccessTokenController.php
@@ -52,7 +52,7 @@ class PersonalAccessTokenController extends Controller
 
     public function store(Request $request): JsonResponse
     {
-        if (! config('instance.oauth.pat.enabled')) {
+        if (! config('instance.oauth.pat_enabled')) {
             return response()->json([
                 'error' => 'Personal access tokens are not enabled on this instance. Please contact your administrator.',
             ], 403);
diff --git a/app/Providers/AppServiceProvider.php b/app/Providers/AppServiceProvider.php
index 0738526d9..2fa261245 100644
--- a/app/Providers/AppServiceProvider.php
+++ b/app/Providers/AppServiceProvider.php
@@ -154,10 +154,6 @@ class AppServiceProvider extends ServiceProvider
         Passport::useTokenModel(OAuthToken::class);
         Passport::tokensExpireIn(now()->addDays(config('instance.oauth.token_expiration', 356)));
         Passport::refreshTokensExpireIn(now()->addDays(config('instance.oauth.refresh_expiration', 400)));
-        Passport::enableImplicitGrant();
-        if (config('instance.oauth.pat.enabled')) {
-            Passport::personalAccessClientId(config('instance.oauth.pat.id'));
-        }
 
         Passport::tokensCan([
             'read' => 'Full read access to your account',
diff --git a/config/instance.php b/config/instance.php
index 6b70bc5cf..0657efb9c 100644
--- a/config/instance.php
+++ b/config/instance.php
@@ -74,10 +74,7 @@ return [
     'oauth' => [
         'token_expiration' => env('OAUTH_TOKEN_DAYS', 365),
         'refresh_expiration' => env('OAUTH_REFRESH_DAYS', 400),
-        'pat' => [
-            'enabled' => env('OAUTH_PAT_ENABLED', false),
-            'id' => env('OAUTH_PAT_ID'),
-        ],
+        'pat_enabled' => env('OAUTH_PAT_ENABLED', false),
     ],
 
     'enable_cc' => env('ENABLE_CONFIG_CACHE', true),
diff --git a/resources/assets/js/components/passport/PersonalAccessTokens.vue b/resources/assets/js/components/passport/PersonalAccessTokens.vue
index d3069a9fa..ee72211f3 100644
--- a/resources/assets/js/components/passport/PersonalAccessTokens.vue
+++ b/resources/assets/js/components/passport/PersonalAccessTokens.vue
@@ -182,6 +182,13 @@
 
 <script>
     export default {
+        props: {
+            patEnabled: {
+                type: Boolean,
+                default: true
+            }
+        },
+
         data() {
             return {
                 accessToken: null,
@@ -256,6 +263,14 @@
             },
 
             showCreateTokenForm() {
+                if (!this.patEnabled) {
+                    swal({
+                        title: 'Personal Access Tokens Disabled',
+                        text: 'Personal access tokens are not enabled on this instance. Please contact your administrator.',
+                        icon: 'warning',
+                    });
+                    return;
+                }
                 $('#modal-create-token').modal('show');
             },
 
@@ -275,7 +290,9 @@
                             this.showAccessToken(response.data.accessToken);
                         })
                         .catch(error => {
-                            if (typeof error.response.data === 'object') {
+                            if (error.response && error.response.status === 403 && error.response.data.error) {
+                                this.form.errors = [error.response.data.error];
+                            } else if (typeof error.response.data === 'object' && error.response.data.errors) {
                                 this.form.errors = _.flatten(_.toArray(error.response.data.errors));
                             } else {
                                 this.form.errors = ['Something went wrong. Please try again.'];
diff --git a/resources/views/admin/diagnostics/home.blade.php b/resources/views/admin/diagnostics/home.blade.php
index 5de80b640..589c4b30b 100644
--- a/resources/views/admin/diagnostics/home.blade.php
+++ b/resources/views/admin/diagnostics/home.blade.php
@@ -587,12 +587,7 @@
                                 	<tr>
                                 		<td><span class="badge badge-primary">INSTANCE</span></td>
                                 		<td><strong>OAUTH_PAT_ENABLED</strong></td>
-                                		<td><span>{{config_cache('instance.oauth.pat.enabled') ? '✅ true' : '❌ false' }}</span></td>
-                                	</tr>
-                                	<tr>
-                                		<td><span class="badge badge-primary">INSTANCE</span></td>
-                                		<td><strong>OAUTH_PAT_ID</strong></td>
-                                		<td><span>"{{config_cache('instance.oauth.pat.id')}}"</span></td>
+                                		<td><span>{{config_cache('instance.oauth.pat_enabled') ? '✅ true' : '❌ false' }}</span></td>
                                 	</tr>
                                 	<tr>
                                 		<td><span class="badge badge-primary">INSTANCE</span></td>
diff --git a/resources/views/settings/applications.blade.php b/resources/views/settings/applications.blade.php
index 97270fb62..6aa443861 100644
--- a/resources/views/settings/applications.blade.php
+++ b/resources/views/settings/applications.blade.php
@@ -8,7 +8,7 @@
 <hr>
 @if((bool) config_cache('pixelfed.oauth_enabled') == true)
 	<passport-authorized-clients></passport-authorized-clients>
-	<passport-personal-access-tokens></passport-personal-access-tokens>
+	<passport-personal-access-tokens :pat-enabled="{{ config_cache('instance.oauth.pat_enabled') ? 'true' : 'false' }}"></passport-personal-access-tokens>
 @else
 	<p class="lead">OAuth has not been enabled on this instance.</p>
 @endif