- Pulse: set PULSE_PATH default to admin/pulse; Pulse::ignoreRoutes() in
AppServiceProvider and register the dashboard explicitly in routes/web-admin.php
so it is matched before the {username} profile catch-all.
- Horizon: set horizon.path to admin/horizon (all Horizon routes follow); add an
explicit base-path GET mirroring Horizon's own HomeController@index for clarity.
- Remove now-unneeded 'horizon' reservation from RestrictedNames.
- Add PULSE_ENABLED-gated Pulse links to admin sidenav and topnav.
- Replace HorizonRedirectTest with HorizonDashboardTest (base path now renders
the dashboard directly instead of redirecting).
Sender: followers-only Create deliveries carry a signed
Collection-Synchronization header scoped to the authority of each inbox,
and the partial followers collection is served to authenticated instances
at /users/{username}/followers_synchronization.
Receiver: a signed Collection-Synchronization header whose digest differs
from our copy queues FollowersSyncPipeline, which fetches the partial
collection as the instance actor and reconciles followers, pending follow
requests and unknown follows.
Adds profiles.followers_url for the collectionId check.
Expand the laravel/ui Auth::routes() helper into explicit route
definitions for login, logout, registration and password reset. This
removes the routing magic, makes every auth route visible in web.php,
and lets the honeypot ProtectAgainstSpam middleware live directly on the
single POST /register definition instead of a duplicate route.
laravel/ui is retained since the Auth controllers still rely on its
Illuminate\Foundation\Auth traits.
Swap the custom 'rt' register token anti-spam mechanism for
spatie/laravel-honeypot on the registration and parental-controls
invite flows.
- Add spatie/laravel-honeypot and publish config/honeypot.php
- Remove getRegisterToken() and the rt validation rule from RegisterController
- Replace the rt hidden field with the @honeypot directive in both forms
- Attach ProtectAgainstSpam middleware to POST /register and the
parental-controls invite register route
- Update RegisterTest to disable honeypot for the valid registration case
Laravel 8 adopts the tuple syntax for controller actions. Since the old options array is incompatible with this syntax, Shift converted them to use modern, fluent methods.
The old 'uses' => [Controller::class, 'method'] array format causes a
ReflectionFunction TypeError in Laravel 12 when Livewire's
SupportPageComponents tries to resolve route bindings. The framework's
RouteSignatureParameters::fromAction() expects a Closure or string,
not an array.
Convert all OAuth/Passport routes to the modern fluent syntax:
Route::post('/path', [Controller::class, 'method'])->name('name')
Replace all 'Controller@method' string references with
[Controller::class, 'method'] array syntax across all route files.
Remove the $namespace property and ->namespace() calls from
RouteServiceProvider.
This is required for Laravel 13 compatibility where string-based
controller routing and automatic namespace prefixing will be removed.
742 route references converted across 5 route files.
Fixes#6630 (partial — deletion causing broken PAT)
If a user deletes the OAuth client that serves as the personal access
client, all PAT creation breaks for the entire instance with a 500 error.
Changes:
- Add custom OAuthClientController@destroy that checks if the client
has the personal_access grant type before allowing deletion
- Returns 403 with a clear error message if deletion is blocked
- Add confirmation dialog before client deletion in the frontend
- Add error handling to show server error messages to the user
This prevents accidental destruction of the PAT infrastructure.
- Remove 'loops' from config/exp.php and instance.discover.loops from config/instance.php
- Remove loops API routes (loopsApi, loopWatch) from web-api.php
- Delete LoopComponent.vue, loops.js entry point, and loops blade view
- Remove EXP_LOOPS diagnostic row from admin diagnostics page
The Loops feature was deprecated and hardcoded to disabled.
- Remove userRecommendations controller method and /api/local/exp/rec route
- Remove suggestions UI panel, data properties, and methods from Timeline.vue
- Remove commented-out suggestions card from feed template
The recommendations feature was deprecated and hardcoded to false/empty.
This commit does two things:
* Add invite email support to AdminInviteCommand
- Moves `invite_code` generation to AdminInvite model `creating` event
* Add admin invite management section under admin users dashboard
- Adds `Admin/AdminUserInviteController` and associated `home` and
`create` Blade templates.
- Adds "Invites" button to admin user dashboard
Daniel Supernault
Shlee
Your Name
Shift
Ross Bearman
Gavin Mogan
Felipe Mateus