Merge remote-tracking branch 'origin/main'

app/Jobs/ApiTokenExpirationWarningJob.php

@@ -41,6 +41,10 @@ class ApiTokenExpirationWarningJob implements ShouldBeEncrypted, ShouldQueue, Si
                         continue;
                     }
 
+                    if (! $team->members()->whereKey($token->tokenable_id)->exists()) {
+                        continue;
+                    }
+
                     $warningSentAt = now();
 
                     $team->notify(new ApiTokenExpiringNotification($token));

app/Livewire/Security/ApiTokens.php

@@ -59,7 +59,10 @@ class ApiTokens extends Component
 
     private function getTokens()
     {
-        $this->tokens = auth()->user()->tokens->sortByDesc('created_at');
+        $this->tokens = auth()->user()->tokens()
+            ->where('team_id', currentTeam()->id)
+            ->latest()
+            ->get();
     }
 
     public function updatedPermissions($permissionToUpdate)
@@ -148,7 +151,10 @@ class ApiTokens extends Component
     public function revoke(int $id)
     {
         try {
-            $token = auth()->user()->tokens()->where('id', $id)->firstOrFail();
+            $token = auth()->user()->tokens()
+                ->where('team_id', currentTeam()->id)
+                ->where('id', $id)
+                ->firstOrFail();
             $this->authorize('delete', $token);
             $token->delete();
             $this->getTokens();

app/Policies/ApiTokenPolicy.php

@@ -20,7 +20,7 @@ class ApiTokenPolicy
      */
     public function view(User $user, PersonalAccessToken $token): bool
     {
-        return $user->id === $token->tokenable_id && $token->tokenable_type === User::class;
+        return $this->belongsToUserAndCurrentTeam($user, $token);
     }
 
     /**
@@ -36,7 +36,7 @@ class ApiTokenPolicy
      */
     public function update(User $user, PersonalAccessToken $token): bool
     {
-        return $user->id === $token->tokenable_id && $token->tokenable_type === User::class;
+        return $this->belongsToUserAndCurrentTeam($user, $token);
     }
 
     /**
@@ -44,7 +44,7 @@ class ApiTokenPolicy
      */
     public function delete(User $user, PersonalAccessToken $token): bool
     {
-        return $user->id === $token->tokenable_id && $token->tokenable_type === User::class;
+        return $this->belongsToUserAndCurrentTeam($user, $token);
     }
 
     /**
@@ -86,4 +86,19 @@ class ApiTokenPolicy
     {
         return $user->isAdmin() || $user->isOwner();
     }
+
+    private function belongsToUserAndCurrentTeam(User $user, PersonalAccessToken $token): bool
+    {
+        if ($user->id !== $token->tokenable_id || $token->tokenable_type !== User::class) {
+            return false;
+        }
+
+        $currentTeamId = $user->currentTeam()?->id;
+
+        if ($currentTeamId === null || $token->team_id === null) {
+            return false;
+        }
+
+        return (string) $currentTeamId === (string) $token->team_id;
+    }
 }