fix: enable Jetstream API feature so users can issue API tokens - #218
Merged
Conversation
Jetstream's Features::api() was commented out in config/jetstream.php, so the /user/api-tokens routes were never registered. New users had no way to create, list, or delete a Sanctum personal access token through the UI or any endpoint, even though the documented REST API under /api/v1/* requires a bearer token via auth:sanctum on every route. The "API Tokens" nav item and its Vue pages already existed but were unreachable, and CreateApiTokenTest, DeleteApiTokenTest, and ApiTokenPermissionsTest were permanently skipped via Features::hasApiFeatures() checks, masking the gap in CI. Uncomment Features::api() to register the token-management routes and un-skip the existing coverage, and add a regression test asserting the feature stays enabled and that the API tokens page is reachable. Fixes #93 Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JcTTctpWp8wW5bErM58EqX
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What was broken
Jetstream's
Features::api()was commented out inconfig/jetstream.php, so Jetstream never registered its/user/api-tokensroutes/controller. That meant a new user had no way to create, list, or delete a Sanctum personal access token through the UI or any endpoint.This is a serious functional gap because, per
CLAUDE.md, the REST API under/api/v1/*(endpoints,events,deliveries,webhooks/trigger/{eventName}) requiresauth:sanctumon every route — i.e. a bearer token is the only way to call it. With token issuance disabled, the platform's core "trigger webhook via API" integration surface was completely inert for real users without direct database/tinker access.The gap was masked in CI:
tests/Feature/CreateApiTokenTest.php,DeleteApiTokenTest.php, andApiTokenPermissionsTest.phpeach callmarkTestSkipped(...)whenFeatures::hasApiFeatures()is false, so the suite reported green while the token-issuance code path was never exercised. The frontend (resources/js/Pages/API/Index.vue,Partials/ApiTokenManager.vue, and the "API Tokens" nav item) already anticipated the feature being enabled but was unreachable.What changed
Features::api()inconfig/jetstream.php, which registers Jetstream's built-in/user/api-tokensroutes (HasApiTokenswas already present onApp\Models\User, so no model changes were needed).tests/Feature/ApiTokenFeatureEnabledTest.php, a regression test assertingFeatures::hasApiFeatures()staystrueand that an authenticated user can reach/user/api-tokens, so this can't silently regress again.CreateApiTokenTest,DeleteApiTokenTest,ApiTokenPermissionsTest) now run for real and pass.Testing
vendor/bin/pint --dirty— passphp artisan test— full suite passes (224 passed, 4 pre-existing/unrelated skips, 0 failed)Note
Issue #93's own analysis flags that once tokens can be issued, the ability checkboxes shown in the token-creation UI aren't currently enforced by the API controllers (
tokenCan()/ability:middleware) — that gap is already tracked separately in #53 and is out of scope for this fix, which is just about restoring token issuance itself.Fixes #93