fix: personal access tokens failed with a 500 in production

Passport needs a "personal access client" to issue personal access tokens,
and only the seeder created it (production runs migrations, not the seeder),
so createToken threw "Personal access client not found".

- New idempotent command passport:ensure-personal-client, run by the
  container entrypoint after the migrations.
- The tokens page now shows an error when the server fails instead of
  doing nothing (es, en, ca).
- Tests: the command creates the client once; tokens can be created.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docker/php/entrypoint.sh

@@ -14,6 +14,9 @@ if [ "$CONTAINER_ROLE" = "app" ]; then
     echo "Aplicando migraciones..."
     su-exec www-data php artisan migrate --force
 
+    echo "Comprobando el cliente de Personal Access Tokens..."
+    su-exec www-data php artisan passport:ensure-personal-client
+
     echo "Cacheando configuración, rutas y vistas..."
     su-exec www-data php artisan config:cache
     su-exec www-data php artisan route:cache

resources/js/i18n/ca.ts

@@ -23,6 +23,7 @@ const ca: MessageSchema = {
         edit: 'Editar',
         delete: 'Esborrar',
         none: '(cap)',
+        unexpectedError: "Alguna cosa ha fallat. Torna-ho a provar d'aquí a una estona.",
     },
     login: {
         title: 'Entrar',

resources/js/i18n/en.ts

@@ -23,6 +23,7 @@ const en: MessageSchema = {
         edit: 'Edit',
         delete: 'Delete',
         none: '(none)',
+        unexpectedError: 'Something went wrong. Please try again in a moment.',
     },
     login: {
         title: 'Sign in',

resources/js/i18n/es.ts

@@ -21,6 +21,7 @@ const es = {
         edit: 'Editar',
         delete: 'Borrar',
         none: '(ninguno)',
+        unexpectedError: 'Algo salió mal. Probá de nuevo en un momento.',
     },
     login: {
         title: 'Ingresar',

resources/js/pages/Tokens.vue

@@ -14,6 +14,7 @@ const newToken = ref<string | null>(null);
 
 const form = reactive<{ name: string; scopes: string[] }>({ name: '', scopes: [] });
 const errors = ref<Record<string, string[]>>({});
+const failed = ref(false);
 
 async function load(): Promise<void> {
     loading.value = true;
@@ -29,6 +30,7 @@ async function load(): Promise<void> {
 async function create(): Promise<void> {
     creating.value = true;
     errors.value = {};
+    failed.value = false;
     newToken.value = null;
 
     try {
@@ -39,6 +41,8 @@ async function create(): Promise<void> {
         await load();
     } catch (e: any) {
         errors.value = e.response?.data?.errors ?? {};
+        // Sin errores de validación (p. ej. un 500): avisar en vez de no hacer nada.
+        failed.value = !e.response?.data?.errors;
     } finally {
         creating.value = false;
     }
@@ -84,6 +88,8 @@ onMounted(load);
                 </div>
             </div>
 
+            <p v-if="failed" class="field__error">{{ t('common.unexpectedError') }}</p>
+
             <div>
                 <button type="submit" :disabled="creating" class="btn btn--primary">
                     {{ creating ? t('common.creating') : t('tokens.create') }}

routes/console.php

@@ -2,7 +2,23 @@
 
 use Illuminate\Foundation\Inspiring;
 use Illuminate\Support\Facades\Artisan;
+use Laravel\Passport\ClientRepository;
 
 Artisan::command('inspire', function () {
     $this->comment(Inspiring::quote());
 })->purpose('Display an inspiring quote');
+
+// Sin este cliente, Passport no puede emitir Personal Access Tokens (createToken lanza
+// "Personal access client not found"). Idempotente: lo ejecuta el entrypoint en cada
+// arranque, porque en producción no se corre el seeder.
+Artisan::command('passport:ensure-personal-client', function (ClientRepository $clients) {
+    $provider = config('auth.guards.api.provider');
+
+    try {
+        $clients->personalAccessClient($provider);
+        $this->info('Personal access client: ya existe.');
+    } catch (RuntimeException) {
+        $clients->createPersonalAccessGrantClient('Personal Access Client', $provider);
+        $this->info('Personal access client: creado.');
+    }
+})->purpose('Crea el cliente de Personal Access Tokens si no existe');

tests/Feature/PersonalAccessTokenTest.php

@@ -0,0 +1,46 @@
+<?php
+
+namespace Tests\Feature;
+
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Laravel\Passport\Client;
+use Tests\TestCase;
+
+class PersonalAccessTokenTest extends TestCase
+{
+    use RefreshDatabase;
+
+    private function personalClients(): int
+    {
+        return Client::query()->get()
+            ->filter(fn (Client $client) => $client->hasGrantType('personal_access'))
+            ->count();
+    }
+
+    public function test_ensure_command_creates_the_personal_access_client_once(): void
+    {
+        $this->assertSame(0, $this->personalClients());
+
+        $this->artisan('passport:ensure-personal-client')->assertSuccessful();
+        $this->artisan('passport:ensure-personal-client')->assertSuccessful();
+
+        $this->assertSame(1, $this->personalClients());
+    }
+
+    public function test_users_can_create_personal_access_tokens_once_the_client_exists(): void
+    {
+        $this->artisan('passport:ensure-personal-client')->assertSuccessful();
+        $user = User::factory()->approved()->create();
+
+        $response = $this->actingAs($user)->postJson('/web-api/personal-access-tokens', [
+            'name' => 'MCP TaskStream',
+            'scopes' => ['users:read'],
+        ]);
+
+        $response->assertCreated()->assertJsonStructure(['access_token']);
+        $this->actingAs($user)->getJson('/web-api/personal-access-tokens')
+            ->assertOk()
+            ->assertJsonFragment(['name' => 'MCP TaskStream']);
+    }
+}