feat(jetstream): enable read-only personal access tokens

app/Providers/JetstreamServiceProvider.php

@@ -31,13 +31,9 @@ public function boot(): void
      */
     protected function configurePermissions(): void
     {
+        // Sanctum PAT abilities are scoped to read only. REST authorization uses Spatie via policies.
         Jetstream::defaultApiTokenPermissions(['read']);
 
-        Jetstream::permissions([
-            'create',
-            'read',
-            'update',
-            'delete',
-        ]);
+        Jetstream::permissions(['read']);
     }
 }

config/jetstream.php

@@ -60,7 +60,7 @@
     'features' => [
         // Features::termsAndPrivacyPolicy(),
         Features::profilePhotos(),
-        // Features::api(),
+        Features::api(),
         // Features::teams(['invitations' => true]),
         Features::accountDeletion(),
     ],

docs/api-documentation.md

@@ -37,6 +37,15 @@ POST /api/auth/login
 :::info
 The token is of **Bearer** type. This has to be supplied in the headers of the requests. In case you are using the [swagger UI of the API](https://coconut.naturalproducts.net/api-documentation), click on the **Authorize** button and provide the token as per the instruction.
 :::
+
+### Personal Access Tokens
+
+Verified users can create long-lived **Personal Access Tokens** from the web application: account menu → **Personal Access Tokens** (`/user/api-tokens`). Use the token in the `Authorization` header as `Bearer <token>`.
+
+- Sanctum token abilities are limited to **read** at the token layer.
+- What you can do on the API (search, mutate, delete, and so on) is controlled by **Spatie permissions** on your user account, enforced through Lomkit policies—not by the token ability checkboxes.
+- Login and register responses return a separate short-lived `auth_token`; personal access tokens are intended for scripts and integrations you name and manage yourself.
+
 ### Logout
 ```
 GET /api/auth/logout
@@ -103,7 +112,6 @@ Search Molecules using various attributes. There are two tables invovled in this
 The fields in the *molecules* table can be accessed directly with their column names. The fields in the *properties* table are to be accessed prefixing them with the table name. Ex: **properties.field-name**.
 :::
 
-
 **Request Body Example (application/json):**
 ```json
 {

tests/Feature/ApiTokenPermissionsTest.php

@@ -25,21 +25,24 @@ public function test_api_token_permissions_can_be_updated(): void
         $token = $user->tokens()->create([
             'name' => 'Test Token',
             'token' => Str::random(40),
-            'abilities' => ['create', 'read'],
+            'abilities' => ['read'],
         ]);
 
         Livewire::test(ApiTokenManager::class)
             ->set(['managingPermissionsFor' => $token])
             ->set(['updateApiTokenForm' => [
                 'permissions' => [
+                    'read',
                     'delete',
                     'missing-permission',
                 ],
             ]])
             ->call('updateApiToken');
 
-        $this->assertTrue($user->fresh()->tokens->first()->can('delete'));
-        $this->assertFalse($user->fresh()->tokens->first()->can('read'));
+        $this->assertTrue($user->fresh()->tokens->first()->can('read'));
+        $this->assertFalse($user->fresh()->tokens->first()->can('delete'));
         $this->assertFalse($user->fresh()->tokens->first()->can('missing-permission'));
+        $this->assertFalse($user->fresh()->tokens->first()->can('create'));
+        $this->assertFalse($user->fresh()->tokens->first()->can('update'));
     }
 }

tests/Feature/CreateApiTokenTest.php

@@ -26,14 +26,14 @@ public function test_api_tokens_can_be_created(): void
                 'name' => 'Test Token',
                 'permissions' => [
                     'read',
-                    'update',
                 ],
             ]])
             ->call('createApiToken');
 
         $this->assertCount(1, $user->fresh()->tokens);
         $this->assertEquals('Test Token', $user->fresh()->tokens->first()->name);
         $this->assertTrue($user->fresh()->tokens->first()->can('read'));
+        $this->assertFalse($user->fresh()->tokens->first()->can('update'));
         $this->assertFalse($user->fresh()->tokens->first()->can('delete'));
     }
 }