- Remove endroid/qr-code: never imported in app code; only
bacon/bacon-qr-code is used directly (for 2FA QR generation).
- Remove nesbot/carbon: already pulled in transitively by
laravel/framework, laravel/horizon, and laravel/pulse.
Changes constraint from exact '7.4.13' to '^7.4.13'. The pin was
introduced for CVE-2026-48736 but is overly restrictive — any 7.4.x
release >= 7.4.13 includes the fix. This allows future security
patches to install via composer update.
Note: Symfony 8.x is blocked by laravel/framework ^12 which requires
symfony/http-foundation ^7.2.0. Symfony 8 support arrives with Laravel 13.
- Delete app/Jobs/RemoteFollowPipeline/RemoteFollowPipeline.php
- Delete app/Jobs/RemoteFollowPipeline/RemoteFollowImportRecent.php
- Neither job is dispatched anywhere in the codebase
- Remote follow is handled by ActivityPub Inbox and FollowPipeline
- Remove Passport::personalAccessClientId() (removed in Passport v13, auto-discovers now)
- Remove Passport::enableImplicitGrant() (legacy grant, no clients use it)
- Flatten config instance.oauth.pat to pat_enabled (remove dead pat.id key)
- Add OAUTH_PAT_ENABLED=false to .env.example and .env.docker.example
- Show swal alert when PATs disabled instead of hidden API error
- Improve store() error handling to surface 403 messages in the UI
- Remove OAUTH_PAT_ID row from admin diagnostics blade
Replace Auth::user() with $request->user() and Auth::check() with
$request->user() !== null (or ! $request->user()) across all
controllers and middleware that have access to the request object.
This resolves 99 larastan.noAuthFacadeInRequestScope errors and
improves Octane compatibility.
For protected helper methods without $request in scope, uses the
request() helper instead.
Methods that previously lacked a Request parameter but used Auth
facade now accept Request $request via Laravel's auto-injection.
AuthScope/RequestUserTest: 22 tests verifying all controllers and
middleware that were migrated from Auth::user() to $request->user().
CI: update to checkout@v7, cache@v6
AuthScope/RequestUserTest: exercises every controller and middleware
that was refactored from Auth::user()/Auth::check() to $request->user().
Covers web routes (follow requests, compose, collections, discover,
profile, status, timeline, newsroom), API routes (verify_credentials,
timelines, notifications, blocks, mutes, favourites, bookmarks), and
middleware (admin, password.confirm, account interstitial).
All 390 tests pass with the auth-scope-3 and passport middleware fixes
applied together.
Laravel Passport 13 renamed:
- CheckScopes → CheckToken (verifies ALL listed scopes)
- CheckForAnyScope → CheckTokenForAnyScope (verifies ANY listed scope)
The old class names no longer exist, causing BindingResolutionException
on all /api/v1/admin/* routes that use the 'scope' or 'scopes' middleware
aliases.
Laravel Passport 13 renamed:
- CheckScopes → CheckToken (verifies ALL listed scopes)
- CheckForAnyScope → CheckTokenForAnyScope (verifies ANY listed scope)
The old class names no longer exist, causing BindingResolutionException
on all /api/v1/admin/* routes that use the 'scope' or 'scopes' middleware
aliases.
Security/AdminAccessTest: verifies non-admin users are blocked from
all admin web routes (dashboard, users, reports, settings, instances,
curated onboarding) and admin API endpoints.
Security/ApiScopeSecurityTest: verifies read-only tokens cannot write
(follow, favourite, delete, mute, block), write tokens can read+write,
cross-user access is denied, and private statuses are protected.
BUG FOUND: CheckForAnyScope middleware (referenced in v1/admin routes)
was removed in Passport 13. All /api/v1/admin/* routes throw
BindingResolutionException. 6 tests skipped pending fix.
Your Name
Shlee