fix: enforce Sanctum API token abilities on Api controllers

app/Http/Controllers/Api/DeliveryController.php

@@ -16,6 +16,8 @@ class DeliveryController extends Controller
      */
     public function index(Request $request): JsonResponse
     {
+        $this->authorizeAbility($request, 'read');
+
         $validator = Validator::make($request->all(), [
             'status' => ['nullable', 'string', Rule::in(['pending', 'retrying', 'success', 'failed'])],
             'from_date' => ['nullable', 'date'],
@@ -70,6 +72,8 @@ public function index(Request $request): JsonResponse
      */
     public function show(Request $request, Delivery $delivery): JsonResponse
     {
+        $this->authorizeAbility($request, 'read');
+
         // Load the event with trashed included: a soft-deleted parent event
         // must not make an existing delivery's ownership check (or its
         // history) silently disappear.
@@ -88,6 +92,8 @@ public function show(Request $request, Delivery $delivery): JsonResponse
      */
     public function stats(Request $request): JsonResponse
     {
+        $this->authorizeAbility($request, 'read');
+
         $baseQuery = Delivery::query()
             ->whereHas('event', function ($q) use ($request) {
                 $q->withTrashed()->where('user_id', $request->user()->id);

app/Http/Controllers/Api/EndpointController.php

@@ -17,6 +17,8 @@ class EndpointController extends Controller
      */
     public function index(Request $request): JsonResponse
     {
+        $this->authorizeAbility($request, 'read');
+
         $endpoints = $request->user()->endpoints()
             ->with('events')
             ->paginate(15);
@@ -29,6 +31,8 @@ public function index(Request $request): JsonResponse
      */
     public function store(Request $request): JsonResponse
     {
+        $this->authorizeAbility($request, 'create');
+
         $validator = Validator::make($request->all(), [
             'name' => 'required|string|max:255',
             'url' => ['required', 'url', 'max:2048', new SafeWebhookUrl()],
@@ -58,6 +62,8 @@ public function store(Request $request): JsonResponse
      */
     public function show(Request $request, Endpoint $endpoint): JsonResponse
     {
+        $this->authorizeAbility($request, 'read');
+
         if ($endpoint->user_id !== $request->user()->id) {
             return response()->json(['message' => 'Not Found'], 404);
         }
@@ -72,6 +78,8 @@ public function show(Request $request, Endpoint $endpoint): JsonResponse
      */
     public function update(Request $request, Endpoint $endpoint): JsonResponse
     {
+        $this->authorizeAbility($request, 'update');
+
         if ($endpoint->user_id !== $request->user()->id) {
             return response()->json(['message' => 'Not Found'], 404);
         }
@@ -100,6 +108,8 @@ public function update(Request $request, Endpoint $endpoint): JsonResponse
      */
     public function regenerateSecret(Request $request, Endpoint $endpoint): JsonResponse
     {
+        $this->authorizeAbility($request, 'update');
+
         if ($endpoint->user_id !== $request->user()->id) {
             return response()->json(['message' => 'Not Found'], 404);
         }
@@ -117,6 +127,8 @@ public function regenerateSecret(Request $request, Endpoint $endpoint): JsonResp
      */
     public function destroy(Request $request, Endpoint $endpoint): JsonResponse
     {
+        $this->authorizeAbility($request, 'delete');
+
         if ($endpoint->user_id !== $request->user()->id) {
             return response()->json(['message' => 'Not Found'], 404);
         }

app/Http/Controllers/Api/EventController.php

@@ -17,6 +17,8 @@ class EventController extends Controller
      */
     public function index(Request $request): JsonResponse
     {
+        $this->authorizeAbility($request, 'read');
+
         $events = $request->user()->events()
             ->with(['endpoints', 'deliveries' => function ($query) {
                 $query->latest()->limit(5);
@@ -31,6 +33,8 @@ public function index(Request $request): JsonResponse
      */
     public function store(Request $request): JsonResponse
     {
+        $this->authorizeAbility($request, 'create');
+
         $validator = Validator::make($request->all(), [
             'name' => [
                 'required', 'string', 'max:255',
@@ -71,6 +75,8 @@ public function store(Request $request): JsonResponse
      */
     public function show(Request $request, Event $event): JsonResponse
     {
+        $this->authorizeAbility($request, 'read');
+
         if ($event->user_id !== $request->user()->id) {
             return response()->json(['message' => 'Not Found'], 404);
         }
@@ -88,6 +94,8 @@ public function show(Request $request, Event $event): JsonResponse
      */
     public function update(Request $request, Event $event): JsonResponse
     {
+        $this->authorizeAbility($request, 'update');
+
         if ($event->user_id !== $request->user()->id) {
             return response()->json(['message' => 'Not Found'], 404);
         }
@@ -132,6 +140,8 @@ public function update(Request $request, Event $event): JsonResponse
      */
     public function destroy(Request $request, Event $event): JsonResponse
     {
+        $this->authorizeAbility($request, 'delete');
+
         if ($event->user_id !== $request->user()->id) {
             return response()->json(['message' => 'Not Found'], 404);
         }

app/Http/Controllers/Api/WebhookController.php

@@ -18,6 +18,8 @@ class WebhookController extends Controller
      */
     public function trigger(Request $request, string $eventName): JsonResponse
     {
+        $this->authorizeAbility($request, 'create');
+
         $validator = Validator::make($request->all(), [
             'payload' => ['required', 'array', new WebhookPayloadSize()],
         ]);
@@ -128,6 +130,8 @@ private function dispatchDelivery(Delivery $delivery): void
      */
     public function retryDelivery(Request $request, Delivery $delivery): JsonResponse
     {
+        $this->authorizeAbility($request, 'update');
+
         // Load the event with trashed included: a soft-deleted parent event
         // must not turn this ownership check into a crash on a null relation.
         $event = $delivery->event()->withTrashed()->first();

app/Http/Controllers/Controller.php

@@ -2,7 +2,29 @@
 
 namespace App\Http\Controllers;
 
+use Illuminate\Http\Request;
+
 abstract class Controller
 {
-    //
+    /**
+     * Ensure the current request's Sanctum access token is scoped to the
+     * given ability before proceeding.
+     *
+     * Session-authenticated requests (the Inertia/web UI, and tests using
+     * actingAs()) carry Sanctum's TransientToken, whose can() always
+     * returns true, so this only restricts requests actually made with a
+     * personal access token that was scoped to a limited set of
+     * abilities. Without this check, a token restricted to "read" in the
+     * API Tokens UI silently retained full create/update/delete access,
+     * since `auth:sanctum` alone only verifies the token is valid, not
+     * what it's scoped to do.
+     */
+    protected function authorizeAbility(Request $request, string $ability): void
+    {
+        abort_unless(
+            $request->user()->tokenCan($ability),
+            403,
+            "This action requires the \"{$ability}\" API token ability."
+        );
+    }
 }

tests/Feature/ApiEventNameUniquenessScopeTest.php

@@ -5,6 +5,7 @@
 use App\Models\Event;
 use App\Models\User;
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use Laravel\Sanctum\Sanctum;
 use Tests\TestCase;
 
 class ApiEventNameUniquenessScopeTest extends TestCase
@@ -16,12 +17,12 @@ public function test_two_users_can_create_events_with_the_same_name_via_api(): v
         $userA = User::factory()->withPersonalTeam()->create();
         $userB = User::factory()->withPersonalTeam()->create();
 
-        $this->actingAs($userA)
-            ->postJson('/api/v1/events', ['name' => 'order.created'])
+        Sanctum::actingAs($userA, ['*']);
+        $this->postJson('/api/v1/events', ['name' => 'order.created'])
             ->assertStatus(201);
 
-        $this->actingAs($userB)
-            ->postJson('/api/v1/events', ['name' => 'order.created'])
+        Sanctum::actingAs($userB, ['*']);
+        $this->postJson('/api/v1/events', ['name' => 'order.created'])
             ->assertStatus(201);
 
         $this->assertDatabaseHas('events', ['user_id' => $userA->id, 'name' => 'order.created']);
@@ -32,12 +33,12 @@ public function test_same_user_cannot_create_duplicate_event_name_via_api(): voi
     {
         $user = User::factory()->withPersonalTeam()->create();
 
-        $this->actingAs($user)
-            ->postJson('/api/v1/events', ['name' => 'order.created'])
+        Sanctum::actingAs($user, ['*']);
+        $this->postJson('/api/v1/events', ['name' => 'order.created'])
             ->assertStatus(201);
 
-        $this->actingAs($user)
-            ->postJson('/api/v1/events', ['name' => 'order.created'])
+        Sanctum::actingAs($user, ['*']);
+        $this->postJson('/api/v1/events', ['name' => 'order.created'])
             ->assertStatus(422)
             ->assertJsonValidationErrors('name');
 
@@ -52,8 +53,8 @@ public function test_user_can_rename_event_to_a_name_used_by_another_user_via_ap
         Event::factory()->for($userA)->create(['name' => 'order.created']);
         $eventB = Event::factory()->for($userB)->create(['name' => 'order.updated']);
 
-        $this->actingAs($userB)
-            ->putJson("/api/v1/events/{$eventB->id}", ['name' => 'order.created'])
+        Sanctum::actingAs($userB, ['*']);
+        $this->putJson("/api/v1/events/{$eventB->id}", ['name' => 'order.created'])
             ->assertStatus(200);
 
         $this->assertDatabaseHas('events', ['id' => $eventB->id, 'name' => 'order.created']);
@@ -66,8 +67,8 @@ public function test_user_cannot_rename_event_to_a_name_they_already_use_via_api
         Event::factory()->for($user)->create(['name' => 'order.created']);
         $second = Event::factory()->for($user)->create(['name' => 'order.updated']);
 
-        $this->actingAs($user)
-            ->putJson("/api/v1/events/{$second->id}", ['name' => 'order.created'])
+        Sanctum::actingAs($user, ['*']);
+        $this->putJson("/api/v1/events/{$second->id}", ['name' => 'order.created'])
             ->assertStatus(422)
             ->assertJsonValidationErrors('name');
     }