Add filament resource for tokens; Ignore non-personal tokens in API token endpoints

app/Exceptions/Api/PersonalAccessClientIsNotConfiguredException.php

@@ -0,0 +1,10 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Exceptions\Api;
+
+class PersonalAccessClientIsNotConfiguredException extends ApiException
+{
+    public const string KEY = 'personal_access_client_is_not_configured';
+}

app/Filament/Resources/TokenResource.php

@@ -0,0 +1,148 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources;
+
+use App\Filament\Resources\TokenResource\Pages;
+use App\Models\Passport\Client;
+use App\Models\Passport\Token;
+use Filament\Forms;
+use Filament\Forms\Form;
+use Filament\Resources\Resource;
+use Filament\Tables;
+use Filament\Tables\Filters\TernaryFilter;
+use Filament\Tables\Table;
+use Illuminate\Database\Eloquent\Builder;
+
+class TokenResource extends Resource
+{
+    protected static ?string $model = Token::class;
+
+    protected static ?string $navigationIcon = 'heroicon-o-key';
+
+    protected static ?string $navigationGroup = 'Auth';
+
+    protected static ?int $navigationSort = 6;
+
+    public static function form(Form $form): Form
+    {
+        return $form
+            ->columns(1)
+            ->schema([
+                Forms\Components\TextInput::make('id')
+                    ->label('ID')
+                    ->disabled()
+                    ->visibleOn(['update', 'show'])
+                    ->readOnly()
+                    ->maxLength(255),
+                Forms\Components\TextInput::make('name')
+                    ->label('Name')
+                    ->required()
+                    ->maxLength(255),
+                Forms\Components\Select::make('user_id')
+                    ->label('User')
+                    ->relationship(name: 'user', titleAttribute: 'name')
+                    ->searchable(['name'])
+                    ->disabled()
+                    ->required(),
+                Forms\Components\Select::make('client_id')
+                    ->label('Client')
+                    ->relationship(name: 'client', titleAttribute: 'name')
+                    ->searchable(['name'])
+                    ->required(),
+                Forms\Components\Toggle::make('revoked')
+                    ->label('Revoked')
+                    ->required(),
+                Forms\Components\DateTimePicker::make('expires_at')
+                    ->label('Expires At')
+                    ->disabled(),
+                Forms\Components\DateTimePicker::make('created_at')
+                    ->label('Created At')
+                    ->disabled(),
+                Forms\Components\DateTimePicker::make('updated_at')
+                    ->label('Updated At')
+                    ->disabled(),
+            ]);
+    }
+
+    public static function table(Table $table): Table
+    {
+        return $table
+            ->columns([
+                Tables\Columns\TextColumn::make('name')
+                    ->searchable()
+                    ->sortable(),
+                Tables\Columns\TextColumn::make('user.name')
+                    ->searchable()
+                    ->sortable(),
+                Tables\Columns\TextColumn::make('client.name')
+                    ->searchable()
+                    ->sortable(),
+                Tables\Columns\IconColumn::make('client.personal_access_client')
+                    ->boolean()
+                    ->label('API token?')
+                    ->sortable(),
+                Tables\Columns\IconColumn::make('revoked')
+                    ->boolean()
+                    ->label('Revoked?')
+                    ->sortable(),
+                Tables\Columns\TextColumn::make('expires_at')
+                    ->dateTime()
+                    ->sortable(),
+                Tables\Columns\TextColumn::make('created_at')
+                    ->dateTime()
+                    ->sortable(),
+                Tables\Columns\TextColumn::make('updated_at')
+                    ->dateTime()
+                    ->sortable()
+                    ->toggleable(isToggledHiddenByDefault: true),
+            ])
+            ->defaultSort('created_at', 'desc')
+            ->filters([
+                TernaryFilter::make('is_personal_access_client')
+                    ->queries(
+                        true: function (Builder $query) {
+                            /** @var Builder<Token> $query */
+                            return $query->whereHas('client', function (Builder $query) {
+                                /** @var Builder<Client> $query */
+                                return $query->where('personal_access_client', true);
+                            });
+                        },
+                        false: function (Builder $query) {
+                            /** @var Builder<Token> $query */
+                            return $query->whereHas('client', function (Builder $query) {
+                                /** @var Builder<Client> $query */
+                                return $query->where('personal_access_client', false);
+                            });
+                        },
+                        blank: function (Builder $query) {
+                            /** @var Builder<Token> $query */
+                            return $query;
+                        },
+                    )
+                    ->label('API token?'),
+                TernaryFilter::make('revoked')
+                    ->label('Revoked?'),
+            ])
+            ->actions([
+                Tables\Actions\ViewAction::make(),
+            ])
+            ->bulkActions([
+            ]);
+    }
+
+    public static function getRelations(): array
+    {
+        return [
+        ];
+    }
+
+    public static function getPages(): array
+    {
+        return [
+            'index' => Pages\ListTokens::route('/'),
+            'view' => Pages\ViewToken::route('/{record}'),
+        ];
+    }
+}

app/Filament/Resources/TokenResource/Pages/ListTokens.php

@@ -0,0 +1,19 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\TokenResource\Pages;
+
+use App\Filament\Resources\TokenResource;
+use Filament\Resources\Pages\ListRecords;
+
+class ListTokens extends ListRecords
+{
+    protected static string $resource = TokenResource::class;
+
+    protected function getHeaderActions(): array
+    {
+        return [
+        ];
+    }
+}

app/Filament/Resources/TokenResource/Pages/ViewToken.php

@@ -0,0 +1,19 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\TokenResource\Pages;
+
+use App\Filament\Resources\TokenResource;
+use Filament\Resources\Pages\ViewRecord;
+
+class ViewToken extends ViewRecord
+{
+    protected static string $resource = TokenResource::class;
+
+    protected function getHeaderActions(): array
+    {
+        return [
+        ];
+    }
+}

app/Http/Controllers/Api/V1/ApiTokenController.php

@@ -4,6 +4,7 @@ declare(strict_types=1);
 
 namespace App\Http\Controllers\Api\V1;
 
+use App\Exceptions\Api\PersonalAccessClientIsNotConfiguredException;
 use App\Http\Requests\V1\ApiToken\ApiTokenStoreRequest;
 use App\Http\Resources\V1\ApiToken\ApiTokenCollection;
 use App\Http\Resources\V1\ApiToken\ApiTokenWithAccessTokenResource;
@@ -26,7 +27,9 @@ class ApiTokenController extends Controller
     {
         $user = $this->user();
 
-        $tokens = $user->tokens()->get();
+        $tokens = $user->tokens()
+            ->where('client_id', '=', config('passport.personal_access_client.id'))
+            ->get();
 
         return new ApiTokenCollection($tokens);
     }
@@ -39,12 +42,16 @@ class ApiTokenController extends Controller
      *
      * @operationId createApiToken
      *
-     * @throws AuthorizationException
+     * @throws AuthorizationException|PersonalAccessClientIsNotConfiguredException
      */
     public function store(ApiTokenStoreRequest $request): ApiTokenWithAccessTokenResource
     {
         $user = $this->user();
 
+        if (config('passport.personal_access_client.id') === null || config('passport.personal_access_client.secret') === null) {
+            throw new PersonalAccessClientIsNotConfiguredException;
+        }
+
         $token = $user->createToken($request->getName(), ['*']);
         /** @var Token $tokenModel */
         $tokenModel = $token->token;
@@ -58,14 +65,21 @@ class ApiTokenController extends Controller
      * @operationId revokeApiToken
      *
      * @throws AuthorizationException
+     * @throws PersonalAccessClientIsNotConfiguredException
      */
     public function revoke(Token $apiToken): JsonResponse
     {
         $user = $this->user();
 
+        if (config('passport.personal_access_client.id') === null || config('passport.personal_access_client.secret') === null) {
+            throw new PersonalAccessClientIsNotConfiguredException;
+        }
         if ($apiToken->user_id !== $user->getKey()) {
             throw new AuthorizationException('API token does not belong to user');
         }
+        if ($apiToken->client_id !== config('passport.personal_access_client.id')) {
+            throw new AuthorizationException('API token is not a personal access token');
+        }
 
         $apiToken->revoke();
 
@@ -77,15 +91,21 @@ class ApiTokenController extends Controller
      *
      * @operationId deleteApiToken
      *
-     * @throws AuthorizationException
+     * @throws AuthorizationException|PersonalAccessClientIsNotConfiguredException
      */
     public function destroy(Token $apiToken): JsonResponse
     {
         $user = $this->user();
 
+        if (config('passport.personal_access_client.id') === null || config('passport.personal_access_client.secret') === null) {
+            throw new PersonalAccessClientIsNotConfiguredException;
+        }
         if ($apiToken->user_id !== $user->getKey()) {
             throw new AuthorizationException('API token does not belong to user');
         }
+        if ($apiToken->client_id !== config('passport.personal_access_client.id')) {
+            throw new AuthorizationException('API token is not a personal access token');
+        }
 
         $apiToken->delete();
 

app/Models/Passport/Token.php

@@ -6,6 +6,7 @@ namespace App\Models\Passport;
 
 use Database\Factories\Passport\TokenFactory;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
 use Illuminate\Support\Carbon;
 use Laravel\Passport\Token as PassportToken;
 
@@ -24,4 +25,14 @@ class Token extends PassportToken
 {
     /** @use HasFactory<TokenFactory> */
     use HasFactory;
+
+    /**
+     * Get the client that the token belongs to.
+     *
+     * @return BelongsTo<Client, Token>
+     */
+    public function client(): BelongsTo
+    {
+        return $this->belongsTo(Client::class, 'client_id', 'id');
+    }
 }

app/Providers/Filament/AdminPanelProvider.php

@@ -69,6 +69,9 @@ class AdminPanelProvider extends PanelProvider
                 NavigationGroup::make()
                     ->label('System')
                     ->collapsed(),
+                NavigationGroup::make()
+                    ->label('Auth')
+                    ->collapsed(),
             ])
             ->middleware([
                 EncryptCookies::class,

lang/en/exceptions.php

@@ -12,6 +12,7 @@ use App\Exceptions\Api\OnlyOwnerCanChangeOwnership;
 use App\Exceptions\Api\OrganizationHasNoSubscriptionButMultipleMembersException;
 use App\Exceptions\Api\OrganizationNeedsAtLeastOneOwner;
 use App\Exceptions\Api\PdfRendererIsNotConfiguredException;
+use App\Exceptions\Api\PersonalAccessClientIsNotConfiguredException;
 use App\Exceptions\Api\TimeEntryCanNotBeRestartedApiException;
 use App\Exceptions\Api\TimeEntryStillRunningApiException;
 use App\Exceptions\Api\UserIsAlreadyMemberOfOrganizationApiException;
@@ -37,6 +38,7 @@ return [
         OrganizationHasNoSubscriptionButMultipleMembersException::KEY => 'Organization has no subscription but multiple members',
         PdfRendererIsNotConfiguredException::KEY => 'PDF renderer is not configured',
         FeatureIsNotAvailableInFreePlanApiException::KEY => 'Feature is not available in free plan',
+        PersonalAccessClientIsNotConfiguredException::KEY => 'Personal access client is not configured',
     ],
     'unknown_error_in_admin_panel' => 'An unknown error occurred. Please check the logs.',
 ];

tests/Unit/Endpoint/Api/V1/ApiTokenEndpointTest.php

@@ -19,10 +19,14 @@ class ApiTokenEndpointTest extends ApiEndpointTestAbstract
     {
         // Arrange
         $data = $this->createUserWithPermission([]);
-        $client = $this->createPersonalAccessClient();
-        $token = Token::factory()->forUser($data->user)->forClient($client)->create();
+        $personalAccessClient = $this->createPersonalAccessClient();
+        Config::set('passport.personal_access_client.id', $personalAccessClient->id);
+        Config::set('passport.personal_access_client.secret', $personalAccessClient->secret);
+        $client = $this->createClient();
+        $token = Token::factory()->forUser($data->user)->forClient($personalAccessClient)->create();
+        $otherTokenType = Token::factory()->forUser($data->user)->forClient($client)->create();
         $otherData = $this->createUserWithPermission([]);
-        $otherToken = Token::factory()->forUser($otherData->user)->forClient($client)->create();
+        $otherToken = Token::factory()->forUser($otherData->user)->forClient($personalAccessClient)->create();
         Passport::actingAs($data->user);
 
         // Act
@@ -48,9 +52,9 @@ class ApiTokenEndpointTest extends ApiEndpointTestAbstract
     {
         // Arrange
         $data = $this->createUserWithPermission([]);
-        $client = $this->createPersonalAccessClient();
-        Config::set('passport.personal_access_client.id', $client->id);
-        Config::set('passport.personal_access_client.secret', $client->secret);
+        $personalAccessClient = $this->createPersonalAccessClient();
+        Config::set('passport.personal_access_client.id', $personalAccessClient->id);
+        Config::set('passport.personal_access_client.secret', $personalAccessClient->secret);
         Passport::actingAs($data->user);
 
         // Act
@@ -73,11 +77,33 @@ class ApiTokenEndpointTest extends ApiEndpointTestAbstract
         ]);
     }
 
+    public function test_store_fails_if_personal_access_client_is_not_configured(): void
+    {
+        // Arrange
+        $data = $this->createUserWithPermission([]);
+        Passport::actingAs($data->user);
+
+        // Act
+        $response = $this->postJson(route('api.v1.api-tokens.store'), [
+            'name' => 'Test Token',
+        ]);
+
+        // Assert
+        $this->assertResponseCode($response, 400);
+        $response->assertExactJson([
+            'error' => true,
+            'key' => 'personal_access_client_is_not_configured',
+            'message' => 'Personal access client is not configured',
+        ]);
+    }
+
     public function test_revoke_endpoint_revokes_api_token(): void
     {
         // Arrange
         $data = $this->createUserWithPermission([]);
         $client = $this->createPersonalAccessClient();
+        Config::set('passport.personal_access_client.id', $client->id);
+        Config::set('passport.personal_access_client.secret', $client->secret);
         $token = Token::factory()->forUser($data->user)->forClient($client)->create();
         Passport::actingAs($data->user);
 
@@ -92,6 +118,28 @@ class ApiTokenEndpointTest extends ApiEndpointTestAbstract
         ]);
     }
 
+    public function test_revoke_fails_if_token_is_not_personal_access_token(): void
+    {
+        // Arrange
+        $data = $this->createUserWithPermission([]);
+        $personalAccessClient = $this->createPersonalAccessClient();
+        Config::set('passport.personal_access_client.id', $personalAccessClient->id);
+        Config::set('passport.personal_access_client.secret', $personalAccessClient->secret);
+        $client = $this->createClient();
+        $token = Token::factory()->forUser($data->user)->forClient($client)->create();
+        Passport::actingAs($data->user);
+
+        // Act
+        $response = $this->postJson(route('api.v1.api-tokens.revoke', $token->id));
+
+        // Assert
+        $this->assertResponseCode($response, 403);
+        $this->assertDatabaseHas(Token::class, [
+            'id' => $token->id,
+            'revoked' => false,
+        ]);
+    }
+
     public function test_revoke_fails_if_token_with_id_does_not_exist(): void
     {
         // Arrange
@@ -105,12 +153,34 @@ class ApiTokenEndpointTest extends ApiEndpointTestAbstract
         $this->assertResponseCode($response, 404);
     }
 
+    public function test_revoke_fails_if_personal_access_client_is_not_configured(): void
+    {
+        // Arrange
+        $data = $this->createUserWithPermission([]);
+        $client = $this->createPersonalAccessClient();
+        $token = Token::factory()->forUser($data->user)->forClient($client)->create();
+        Passport::actingAs($data->user);
+
+        // Act
+        $response = $this->postJson(route('api.v1.api-tokens.revoke', $token->id));
+
+        // Assert
+        $this->assertResponseCode($response, 400);
+        $response->assertExactJson([
+            'error' => true,
+            'key' => 'personal_access_client_is_not_configured',
+            'message' => 'Personal access client is not configured',
+        ]);
+    }
+
     public function test_revoke_fails_if_the_token_does_not_belong_to_the_user(): void
     {
         // Arrange
         $data = $this->createUserWithPermission([]);
         $otherData = $this->createUserWithPermission([]);
         $client = $this->createPersonalAccessClient();
+        Config::set('passport.personal_access_client.id', $client->id);
+        Config::set('passport.personal_access_client.secret', $client->secret);
         $token = Token::factory()->forUser($otherData->user)->forClient($client)->create();
         Passport::actingAs($data->user);
 
@@ -130,6 +200,8 @@ class ApiTokenEndpointTest extends ApiEndpointTestAbstract
         // Arrange
         $data = $this->createUserWithPermission([]);
         $client = $this->createPersonalAccessClient();
+        Config::set('passport.personal_access_client.id', $client->id);
+        Config::set('passport.personal_access_client.secret', $client->secret);
         $token = Token::factory()->forUser($data->user)->forClient($client)->create();
         Passport::actingAs($data->user);
 
@@ -141,6 +213,47 @@ class ApiTokenEndpointTest extends ApiEndpointTestAbstract
         $this->assertDatabaseMissing(Token::class, ['id' => $token->id]);
     }
 
+    public function test_destroy_fails_if_personal_access_client_is_not_configured(): void
+    {
+        // Arrange
+        $data = $this->createUserWithPermission([]);
+        $client = $this->createPersonalAccessClient();
+        $token = Token::factory()->forUser($data->user)->forClient($client)->create();
+        Passport::actingAs($data->user);
+
+        // Act
+        $response = $this->deleteJson(route('api.v1.api-tokens.destroy', $token->id));
+
+        // Assert
+        $this->assertResponseCode($response, 400);
+        $response->assertExactJson([
+            'error' => true,
+            'key' => 'personal_access_client_is_not_configured',
+            'message' => 'Personal access client is not configured',
+        ]);
+    }
+
+    public function test_destroy_fails_if_token_is_not_personal_access_token(): void
+    {
+        // Arrange
+        $data = $this->createUserWithPermission([]);
+        $personalAccessClient = $this->createPersonalAccessClient();
+        Config::set('passport.personal_access_client.id', $personalAccessClient->id);
+        Config::set('passport.personal_access_client.secret', $personalAccessClient->secret);
+        $client = $this->createClient();
+        $token = Token::factory()->forUser($data->user)->forClient($client)->create();
+        Passport::actingAs($data->user);
+
+        // Act
+        $response = $this->deleteJson(route('api.v1.api-tokens.destroy', $token->id));
+
+        // Assert
+        $this->assertResponseCode($response, 403);
+        $this->assertDatabaseHas(Token::class, [
+            'id' => $token->id,
+        ]);
+    }
+
     public function test_destroy_fails_if_token_with_id_does_not_exist(): void
     {
         // Arrange
@@ -160,6 +273,8 @@ class ApiTokenEndpointTest extends ApiEndpointTestAbstract
         $data = $this->createUserWithPermission([]);
         $otherData = $this->createUserWithPermission([]);
         $client = $this->createPersonalAccessClient();
+        Config::set('passport.personal_access_client.id', $client->id);
+        Config::set('passport.personal_access_client.secret', $client->secret);
         $token = Token::factory()->forUser($otherData->user)->forClient($client)->create();
         Passport::actingAs($data->user);
 
@@ -183,4 +298,15 @@ class ApiTokenEndpointTest extends ApiEndpointTestAbstract
 
         return $client;
     }
+
+    private function createClient(): Client
+    {
+        $clientRepository = new ClientRepository;
+        /** @var Client $client */
+        $client = $clientRepository->create(
+            null, 'Desktop App', 'http://localhost', null
+        );
+
+        return $client;
+    }
 }

tests/Unit/Filament/Resources/TokenResourceTest.php

@@ -0,0 +1,94 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tests\Unit\Filament\Resources;
+
+use App\Filament\Resources\TokenResource;
+use App\Models\Passport\Client;
+use App\Models\Passport\Token;
+use App\Models\User;
+use Illuminate\Support\Facades\Config;
+use Livewire\Livewire;
+use PHPUnit\Framework\Attributes\UsesClass;
+use Tests\Unit\Filament\FilamentTestCase;
+
+#[UsesClass(TokenResource::class)]
+class TokenResourceTest extends FilamentTestCase
+{
+    protected function setUp(): void
+    {
+        parent::setUp();
+        Config::set('auth.super_admins', ['admin@example.com']);
+        $user = User::factory()->withPersonalOrganization()->create([
+            'email' => 'admin@example.com',
+        ]);
+
+        $this->actingAs($user);
+    }
+
+    public function test_can_list_tokens(): void
+    {
+        // Arrange
+        $client = Client::factory()->create();
+        $tokens = Token::factory()->forClient($client)->createMany(5);
+
+        // Act
+        $response = Livewire::test(TokenResource\Pages\ListTokens::class);
+
+        // Assert
+        $response->assertSuccessful();
+        $response->assertCanSeeTableRecords($tokens);
+    }
+
+    public function test_list_tokens_with_filter_is_personal_access_client_true(): void
+    {
+        // Arrange
+        $client = Client::factory()->create();
+        $personalAccessClient = Client::factory()->personalAccessClient()->create();
+        $tokens = Token::factory()->forClient($client)->createMany(5);
+        $personalAccessTokens = Token::factory()->forClient($personalAccessClient)->createMany(5);
+
+        // Act
+        $response = Livewire::test(TokenResource\Pages\ListTokens::class)
+            ->filterTable('is_personal_access_client', true);
+
+        // Assert
+        $response->assertSuccessful();
+        $response->assertCountTableRecords(5);
+        $response->assertCanSeeTableRecords($personalAccessTokens);
+        $response->assertCanNotSeeTableRecords($tokens);
+    }
+
+    public function test_list_tokens_with_filter_is_personal_access_client_false(): void
+    {
+        // Arrange
+        $client = Client::factory()->create();
+        $personalAccessClient = Client::factory()->personalAccessClient()->create();
+        $tokens = Token::factory()->forClient($client)->createMany(5);
+        $personalAccessTokens = Token::factory()->forClient($personalAccessClient)->createMany(5);
+
+        // Act
+        $response = Livewire::test(TokenResource\Pages\ListTokens::class)
+            ->filterTable('is_personal_access_client', false);
+
+        // Assert
+        $response->assertSuccessful();
+        $response->assertCountTableRecords(5);
+        $response->assertCanSeeTableRecords($tokens);
+        $response->assertCanNotSeeTableRecords($personalAccessTokens);
+    }
+
+    public function test_can_see_view_page_of_token(): void
+    {
+        // Arrange
+        $client = Client::factory()->create();
+        $token = Token::factory()->forClient($client)->create();
+
+        // Act
+        $response = Livewire::test(TokenResource\Pages\ViewToken::class, ['record' => $token->getKey()]);
+
+        // Assert
+        $response->assertSuccessful();
+    }
+}