From df1e771f930f9520099a9fb681294d98cffe3d5b Mon Sep 17 00:00:00 2001 From: Your Name Date: Wed, 9 Sep 2026 19:03:31 +0930 Subject: [PATCH] Fix admin instance stats endpoint 404 on Postgres via strict is_admin check --- app/Http/Controllers/Api/AdminApiController.php | 2 +- tests/Feature/Security/AdminAccessTest.php | 13 +++++++++++++ 2 files changed, 14 insertions(+), 1 deletion(-) diff --git a/app/Http/Controllers/Api/AdminApiController.php b/app/Http/Controllers/Api/AdminApiController.php index 6ebcaeb4c..527eeec79 100644 --- a/app/Http/Controllers/Api/AdminApiController.php +++ b/app/Http/Controllers/Api/AdminApiController.php @@ -808,7 +808,7 @@ class AdminApiController extends Controller { abort_if(! $request->user() || ! $request->user()->token(), 404); - abort_unless($request->user()->is_admin === 1, 404); + abort_unless($request->user()->is_admin == 1, 404); abort_unless($request->user()->tokenCan('admin:read'), 404); if ($request->has('refresh')) { diff --git a/tests/Feature/Security/AdminAccessTest.php b/tests/Feature/Security/AdminAccessTest.php index c9fbdfac1..0c3cfb98c 100644 --- a/tests/Feature/Security/AdminAccessTest.php +++ b/tests/Feature/Security/AdminAccessTest.php @@ -212,6 +212,19 @@ describe('admin access granted to admin users', function () { ->assertOk(); }); + it('allows admin to access instance stats API when is_admin is a boolean', function () { + // Postgres hydrates the boolean `is_admin` column to a PHP bool, so + // the guard must accept `true` and not just the integer 1. Force the + // boolean here so the test is driver-independent (SQLite hydrates 1). + $admin = User::factory()->admin()->create(); + $admin->refresh(); + $admin->is_admin = true; + Passport::actingAs($admin, ['admin:read']); + + $this->getJson('/api/admin/instance/stats') + ->assertOk(); + }); + it('allows admin to access admin users API', function () { $admin = User::factory()->admin()->create(); $admin->refresh();