From 1d36dabc5cf612aa8e57c0016ef87f89924613ec Mon Sep 17 00:00:00 2001
From: snipe <snipe@snipe.net>
Date: Thu, 30 Jul 2026 14:11:28 +0100
Subject: [PATCH] Added test

---
 .../PassportPersonalAccessTokenGateTest.php   | 85 +++++++++++++++++++
 1 file changed, 85 insertions(+)
 create mode 100644 tests/Feature/Auth/PassportPersonalAccessTokenGateTest.php

diff --git a/tests/Feature/Auth/PassportPersonalAccessTokenGateTest.php b/tests/Feature/Auth/PassportPersonalAccessTokenGateTest.php
new file mode 100644
index 0000000000..4bbf9bf899
--- /dev/null
+++ b/tests/Feature/Auth/PassportPersonalAccessTokenGateTest.php
@@ -0,0 +1,85 @@
+<?php
+
+namespace Tests\Feature\Auth;
+
+use App\Models\User;
+use Tests\TestCase;
+
+/**
+ * Regression for the Passport-personal-access-tokens permission
+ * bypass. Passport's default routes at /oauth/personal-access-tokens
+ * are auto-registered by its service provider with only web +
+ * auth:web middleware, so any user with a valid session cookie could
+ * POST and mint a long-lived bearer token even if their self.api
+ * permission had been revoked.
+ *
+ * The fix registers overriding routes at the same URIs in
+ * routes/web.php (which loads before Passport's package service
+ * provider boots, so FIFO route resolution picks ours) with the
+ * `can:self.api` gate added. Authorized users still hit the same
+ * PersonalAccessTokenController Passport would have used.
+ */
+class PassportPersonalAccessTokenGateTest extends TestCase
+{
+    public function test_user_without_self_api_cannot_create_personal_access_token(): void
+    {
+        $user = User::factory()->create(); // default: no self.api permission
+
+        $this->actingAs($user)
+            ->post('/oauth/personal-access-tokens', [
+                'name' => 'bypass-attempt',
+                'scopes' => [],
+            ])
+            ->assertForbidden();
+    }
+
+    public function test_user_without_self_api_cannot_list_personal_access_tokens(): void
+    {
+        $user = User::factory()->create();
+
+        $this->actingAs($user)
+            ->get('/oauth/personal-access-tokens')
+            ->assertForbidden();
+    }
+
+    public function test_user_without_self_api_cannot_delete_personal_access_token(): void
+    {
+        $user = User::factory()->create();
+
+        $this->actingAs($user)
+            ->delete('/oauth/personal-access-tokens/any-token-id')
+            ->assertForbidden();
+    }
+
+    public function test_unauthenticated_request_is_rejected_by_auth_middleware(): void
+    {
+        // Baseline: the outer `auth` middleware still fires before
+        // the can:self.api gate. Unauthenticated requests get bounced
+        // to login, not silently allowed.
+        $response = $this->post('/oauth/personal-access-tokens', [
+            'name' => 'unauth-attempt',
+            'scopes' => [],
+        ]);
+
+        $this->assertContains($response->status(), [302, 401, 403], 'Unauthenticated requests must not receive a 200/2xx');
+    }
+
+    public function test_superuser_passes_the_self_api_gate(): void
+    {
+        // Superusers bypass every gate via AuthServiceProvider's
+        // Gate::before hook, so they must still be able to reach the
+        // controller. The controller itself may fail later in the
+        // test env if no Passport personal access client is
+        // installed; that's a Passport-setup concern, not the gate's.
+        // We only assert the gate lets them through (status != 403).
+        $user = User::factory()->superuser()->create();
+
+        $response = $this->actingAs($user)
+            ->post('/oauth/personal-access-tokens', [
+                'name' => 'authorized-attempt',
+                'scopes' => [],
+            ]);
+
+        $this->assertNotSame(403, $response->status(), 'Superuser must not be blocked by the self.api gate.');
+    }
+}