fix(discovery): expired bearer tokens fail closed on public endpoints (F-015)

[LuanTrindade95]

Closes F-015, the gap ADR-31 recorded on purpose instead of fixing inside a refactor: the public discovery endpoints resolve the optional bearer outside the auth:sanctum guard, and PersonalAccessToken::findToken() does not check expires_at, so an expired token still granted its owner's scope.

What changed

• App\Services\Auth\OptionalBearerUserResolver short-circuits between findToken() and the tokenable check: a resolved token whose expires_at is past returns an unpersisted User — the same empty scope as any non-empty bearer that fails to resolve, never the public scope.
• A token with no expires_at is untouched and still resolves to its owner.
• The characterization case that locked the old behavior was inverted in the same commit, not deleted, and renamed. Added: a token expired five seconds ago, a token with no expires_at, and a case pinning the other seven header cases as unchanged.
• ADR-32 in docs/DECISIONS.md; F-015 closed in the audit; the brain updated.

Only the expired-token row of the 8-case matrix moves, from owner to empty scope.

Deliberately not changed

config('sanctum.expiration') stays null, so a token issued without an explicit expires_at still never lapses, on every surface. Setting a lifetime changes login and session behavior through the guard — a product decision, queued in NEXT_ACTIONS.md. Routes, private middleware, policies and DiscoveryAccess untouched.

Evidence

Independent adversarial audit: APPROVED. It probed the resolver inside the container against a copy of main's class, case by case, and proved the expires_at null edge by execution rather than by reading ?->. It also showed the test bites: with main's resolver and this branch's test file, exactly the two expired-token cases fail (Expected response status code [404] but received 200) while the other ten pass. The inverted assertion is stronger than the one it replaces, because 404 on the owner's own plugin separates empty scope from both owner (200) and public (200).

Assertion inventory main → branch: nothing shrank (assertNotFound 11 → 18, assertOk 17 → 20, the rest equal). No skip, markTestSkipped, ->todo(, or xit(.

Gates

• ./vendor/bin/pest — 100 passed, on a rebuilt image whose file hashes were confirmed against the branch.
• ./vendor/bin/pint --test — PASS, 134 files.
• Frontend gates are PENDING here: this branch is backend-only.

🤖 Generated with Claude Code