Issue machine tokens with limited permissions and an expiry

A token acts as the person who made it, within the permissions it was given
and those they still hold, checked on every request. Permission checks now go
through one gate rule, since spatie's answered first and never asked the
token.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

app/Auth/PireonTokenGuard.php

@@ -5,6 +5,7 @@ declare(strict_types=1);
 namespace App\Auth;
 
 use App\Actions\Auth\SyncPireonUser;
+use App\Models\ApiToken;
 use App\Models\User;
 use App\Services\Pireon\PireonClient;
 use App\Services\Pireon\PireonException;
@@ -35,7 +36,16 @@ class PireonTokenGuard
     {
         $token = $request->bearerToken();
 
-        if (blank($token) || ! $this->client->isConfigured()) {
+        if (blank($token)) {
+            return null;
+        }
+
+        // Ours, not the identity server's: checked here and never sent there.
+        if (str_starts_with($token, ApiToken::PREFIX)) {
+            return $this->machine($token);
+        }
+
+        if (! $this->client->isConfigured()) {
             return null;
         }
 
@@ -52,6 +62,21 @@ class PireonTokenGuard
         return $user->is_active ? $user : null;
     }
 
+    protected function machine(string $plain): ?User
+    {
+        $token = ApiToken::findUsable($plain);
+        $user = $token?->user;
+
+        // A person switched off here takes their tokens with them.
+        if ($user === null || ! $user->is_active) {
+            return null;
+        }
+
+        $token->touchLastUsed();
+
+        return $user->withAccessToken($token);
+    }
+
     protected function resolveIdentity(string $token): ?PireonIdentity
     {
         $key = 'pireon:introspect:'.hash('sha256', $token);