- Remove Passport::personalAccessClientId() (removed in Passport v13, auto-discovers now)
- Remove Passport::enableImplicitGrant() (legacy grant, no clients use it)
- Flatten config instance.oauth.pat to pat_enabled (remove dead pat.id key)
- Add OAUTH_PAT_ENABLED=false to .env.example and .env.docker.example
- Show swal alert when PATs disabled instead of hidden API error
- Improve store() error handling to surface 403 messages in the UI
- Remove OAUTH_PAT_ID row from admin diagnostics blade
Replace Auth::user() with $request->user() and Auth::check() with
$request->user() !== null (or ! $request->user()) across all
controllers and middleware that have access to the request object.
This resolves 99 larastan.noAuthFacadeInRequestScope errors and
improves Octane compatibility.
For protected helper methods without $request in scope, uses the
request() helper instead.
Methods that previously lacked a Request parameter but used Auth
facade now accept Request $request via Laravel's auto-injection.
AuthScope/RequestUserTest: 22 tests verifying all controllers and
middleware that were migrated from Auth::user() to $request->user().
CI: update to checkout@v7, cache@v6
AuthScope/RequestUserTest: exercises every controller and middleware
that was refactored from Auth::user()/Auth::check() to $request->user().
Covers web routes (follow requests, compose, collections, discover,
profile, status, timeline, newsroom), API routes (verify_credentials,
timelines, notifications, blocks, mutes, favourites, bookmarks), and
middleware (admin, password.confirm, account interstitial).
All 390 tests pass with the auth-scope-3 and passport middleware fixes
applied together.
Laravel Passport 13 renamed:
- CheckScopes → CheckToken (verifies ALL listed scopes)
- CheckForAnyScope → CheckTokenForAnyScope (verifies ANY listed scope)
The old class names no longer exist, causing BindingResolutionException
on all /api/v1/admin/* routes that use the 'scope' or 'scopes' middleware
aliases.
Laravel Passport 13 renamed:
- CheckScopes → CheckToken (verifies ALL listed scopes)
- CheckForAnyScope → CheckTokenForAnyScope (verifies ANY listed scope)
The old class names no longer exist, causing BindingResolutionException
on all /api/v1/admin/* routes that use the 'scope' or 'scopes' middleware
aliases.
Security/AdminAccessTest: verifies non-admin users are blocked from
all admin web routes (dashboard, users, reports, settings, instances,
curated onboarding) and admin API endpoints.
Security/ApiScopeSecurityTest: verifies read-only tokens cannot write
(follow, favourite, delete, mute, block), write tokens can read+write,
cross-user access is denied, and private statuses are protected.
BUG FOUND: CheckForAnyScope middleware (referenced in v1/admin routes)
was removed in Passport 13. All /api/v1/admin/* routes throw
BindingResolutionException. 6 tests skipped pending fix.
PHP's str_ends_with() only accepts a string needle, not an array.
The username validation was passing an array of extensions which
caused a TypeError on every registration attempt.
Replace with a loop over a configurable array of disallowed extensions,
making it easy to add new entries.
Also updates RegisterTest to properly test the registration flow
including the RT anti-bot token and age verification fields.
The old 'uses' => [Controller::class, 'method'] array format causes a
ReflectionFunction TypeError in Laravel 12 when Livewire's
SupportPageComponents tries to resolve route bindings. The framework's
RouteSignatureParameters::fromAction() expects a Closure or string,
not an array.
Convert all OAuth/Passport routes to the modern fluent syntax:
Route::post('/path', [Controller::class, 'method'])->name('name')
Methods that are registered as route actions without a Request type-hint
(settings views, export actions) cannot accept Request $request without
breaking Laravel's route signature reflection. Use the request() helper
instead to avoid ReflectionFunction TypeError.
Replace Auth::user() with $request->user() and Auth::check() with
$request->user() !== null (or ! $request->user()) across all
controllers and middleware that have access to the request object.
This resolves 99 larastan.noAuthFacadeInRequestScope errors and
improves Octane compatibility.
For protected helper methods without $request in scope, uses the
request() helper instead.
Methods that previously lacked a Request parameter but used Auth
facade now accept Request $request via Laravel's auto-injection.
Replace Auth::user() with $request->user() and Auth::check() with
$request->user() !== null (or ! $request->user()) across all
controllers and middleware that have access to the request object.
This resolves 99 larastan.noAuthFacadeInRequestScope errors and
improves Octane compatibility.
For protected helper methods without $request in scope, uses the
request() helper instead.
Methods that previously lacked a Request parameter but used Auth
facade now accept Request $request via Laravel's auto-injection.
Replace all references to non-existent $status with $gp (the GroupPost
instance already in scope). This was a bug where the closure variable
name was changed but references inside the method body were not updated.
Your Name
Shlee