fix: personal access tokens failed with a 500 in production

Passport needs a "personal access client" to issue personal access tokens,
and only the seeder created it (production runs migrations, not the seeder),
so createToken threw "Personal access client not found".

- New idempotent command passport:ensure-personal-client, run by the
  container entrypoint after the migrations.
- The tokens page now shows an error when the server fails instead of
  doing nothing (es, en, ca).
- Tests: the command creates the client once; tokens can be created.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Dockerfile

@@ -72,5 +72,5 @@ CMD ["php-fpm"]
 # ---- 4. Nginx (static assets + reverse proxy to php-fpm) ----
 #
 FROM nginx:1.27-alpine AS nginx
-COPY --from=frontend /app/public /var/www/html/public
+COPY --from=app /var/www/html/public /var/www/html/public
 COPY docker/nginx/default.conf /etc/nginx/conf.d/default.conf

bootstrap/app.php

@@ -15,6 +15,17 @@ return Application::configure(basePath: dirname(__DIR__))
     )
     ->withMiddleware(function (Middleware $middleware): void {
         $middleware->web(append: [SetLocale::class]);
+
+        // Detrás de Traefik/nginx (Dokploy): la IP del proxy inmediato (el
+        // contenedor nginx) es dinámica, así que confiamos en cualquier origen
+        // para que Laravel respete X-Forwarded-Proto y genere URLs/assets https.
+        $middleware->trustProxies(
+            at: '*',
+            headers: Request::HEADER_X_FORWARDED_FOR |
+                Request::HEADER_X_FORWARDED_HOST |
+                Request::HEADER_X_FORWARDED_PORT |
+                Request::HEADER_X_FORWARDED_PROTO,
+        );
     })
     ->withExceptions(function (Exceptions $exceptions): void {
         $exceptions->shouldRenderJsonWhen(

docker-compose.yml

@@ -1,5 +1,41 @@
 name: oauth-iam
 
+x-app-env: &app-env
+    APP_NAME: ${APP_NAME}
+    APP_ENV: ${APP_ENV}
+    APP_KEY: ${APP_KEY}
+    APP_DEBUG: ${APP_DEBUG}
+    APP_URL: ${APP_URL}
+    APP_LOCALE: ${APP_LOCALE}
+    APP_FALLBACK_LOCALE: ${APP_FALLBACK_LOCALE}
+    APP_FAKER_LOCALE: ${APP_FAKER_LOCALE}
+    LOG_CHANNEL: ${LOG_CHANNEL}
+    LOG_STACK: ${LOG_STACK}
+    LOG_LEVEL: ${LOG_LEVEL}
+    DB_CONNECTION: ${DB_CONNECTION}
+    DB_HOST: ${DB_HOST}
+    DB_PORT: ${DB_PORT}
+    DB_DATABASE: ${DB_DATABASE}
+    DB_USERNAME: ${DB_USERNAME}
+    DB_PASSWORD: ${DB_PASSWORD}
+    SESSION_DRIVER: ${SESSION_DRIVER}
+    SESSION_LIFETIME: ${SESSION_LIFETIME}
+    SESSION_ENCRYPT: ${SESSION_ENCRYPT}
+    SESSION_SECURE_COOKIE: ${SESSION_SECURE_COOKIE}
+    SESSION_DOMAIN: ${SESSION_DOMAIN}
+    CACHE_STORE: ${CACHE_STORE}
+    QUEUE_CONNECTION: ${QUEUE_CONNECTION}
+    REDIS_CLIENT: ${REDIS_CLIENT}
+    REDIS_HOST: ${REDIS_HOST}
+    REDIS_PORT: ${REDIS_PORT}
+    REDIS_PASSWORD: ${REDIS_PASSWORD}
+    FILESYSTEM_DISK: ${FILESYSTEM_DISK}
+    MAIL_MAILER: ${MAIL_MAILER}
+    MAIL_FROM_ADDRESS: ${MAIL_FROM_ADDRESS}
+    MAIL_FROM_NAME: ${MAIL_FROM_NAME}
+    L5_SWAGGER_GENERATE_ALWAYS: ${L5_SWAGGER_GENERATE_ALWAYS}
+    VITE_APP_NAME: ${VITE_APP_NAME}
+
 services:
     app:
         build:
@@ -8,8 +44,8 @@ services:
         image: oauth-iam-app:latest
         restart: unless-stopped
         environment:
+            <<: *app-env
             CONTAINER_ROLE: app
-        env_file: .env.production
         volumes:
             - app_storage:/var/www/html/storage
         depends_on:
@@ -31,7 +67,7 @@ services:
         image: oauth-iam-app:latest
         restart: unless-stopped
         command: php artisan queue:work redis --sleep=3 --tries=3 --max-time=3600
-        env_file: .env
+        environment: *app-env
         volumes:
             - app_storage:/var/www/html/storage
         depends_on:
@@ -47,7 +83,7 @@ services:
         image: oauth-iam-app:latest
         restart: unless-stopped
         command: php artisan schedule:work
-        env_file: .env.production
+        environment: *app-env
         volumes:
             - app_storage:/var/www/html/storage
         depends_on:
@@ -61,9 +97,6 @@ services:
             context: .
             target: nginx
         restart: unless-stopped
-        ports:
-            - "80:80"
-            # - "443:443"
         volumes:
             - ./docker/nginx/certs:/etc/nginx/certs:ro
         depends_on:

docker/nginx/default.conf

@@ -28,6 +28,7 @@ server {
         fastcgi_index index.php;
         fastcgi_param SCRIPT_FILENAME /var/www/html/public$fastcgi_script_name;
         include fastcgi_params;
+        fastcgi_param HTTP_AUTHORIZATION $http_authorization;
         fastcgi_read_timeout 60;
         fastcgi_hide_header X-Powered-By;
     }
@@ -63,6 +64,7 @@ server {
 #         fastcgi_index index.php;
 #         fastcgi_param SCRIPT_FILENAME /var/www/html/public$fastcgi_script_name;
 #         include fastcgi_params;
+#         fastcgi_param HTTP_AUTHORIZATION $http_authorization;
 #         fastcgi_read_timeout 60;
 #     }
 # }

docker/php/entrypoint.sh

@@ -14,6 +14,9 @@ if [ "$CONTAINER_ROLE" = "app" ]; then
     echo "Aplicando migraciones..."
     su-exec www-data php artisan migrate --force
 
+    echo "Comprobando el cliente de Personal Access Tokens..."
+    su-exec www-data php artisan passport:ensure-personal-client
+
     echo "Cacheando configuración, rutas y vistas..."
     su-exec www-data php artisan config:cache
     su-exec www-data php artisan route:cache

resources/js/i18n/ca.ts

@@ -23,6 +23,7 @@ const ca: MessageSchema = {
         edit: 'Editar',
         delete: 'Esborrar',
         none: '(cap)',
+        unexpectedError: "Alguna cosa ha fallat. Torna-ho a provar d'aquí a una estona.",
     },
     login: {
         title: 'Entrar',

resources/js/i18n/en.ts

@@ -23,6 +23,7 @@ const en: MessageSchema = {
         edit: 'Edit',
         delete: 'Delete',
         none: '(none)',
+        unexpectedError: 'Something went wrong. Please try again in a moment.',
     },
     login: {
         title: 'Sign in',

resources/js/i18n/es.ts

@@ -21,6 +21,7 @@ const es = {
         edit: 'Editar',
         delete: 'Borrar',
         none: '(ninguno)',
+        unexpectedError: 'Algo salió mal. Probá de nuevo en un momento.',
     },
     login: {
         title: 'Ingresar',

resources/js/pages/Tokens.vue

@@ -14,6 +14,7 @@ const newToken = ref<string | null>(null);
 
 const form = reactive<{ name: string; scopes: string[] }>({ name: '', scopes: [] });
 const errors = ref<Record<string, string[]>>({});
+const failed = ref(false);
 
 async function load(): Promise<void> {
     loading.value = true;
@@ -29,6 +30,7 @@ async function load(): Promise<void> {
 async function create(): Promise<void> {
     creating.value = true;
     errors.value = {};
+    failed.value = false;
     newToken.value = null;
 
     try {
@@ -39,6 +41,8 @@ async function create(): Promise<void> {
         await load();
     } catch (e: any) {
         errors.value = e.response?.data?.errors ?? {};
+        // Sin errores de validación (p. ej. un 500): avisar en vez de no hacer nada.
+        failed.value = !e.response?.data?.errors;
     } finally {
         creating.value = false;
     }
@@ -84,6 +88,8 @@ onMounted(load);
                 </div>
             </div>
 
+            <p v-if="failed" class="field__error">{{ t('common.unexpectedError') }}</p>
+
             <div>
                 <button type="submit" :disabled="creating" class="btn btn--primary">
                     {{ creating ? t('common.creating') : t('tokens.create') }}

routes/console.php

@@ -2,7 +2,23 @@
 
 use Illuminate\Foundation\Inspiring;
 use Illuminate\Support\Facades\Artisan;
+use Laravel\Passport\ClientRepository;
 
 Artisan::command('inspire', function () {
     $this->comment(Inspiring::quote());
 })->purpose('Display an inspiring quote');
+
+// Sin este cliente, Passport no puede emitir Personal Access Tokens (createToken lanza
+// "Personal access client not found"). Idempotente: lo ejecuta el entrypoint en cada
+// arranque, porque en producción no se corre el seeder.
+Artisan::command('passport:ensure-personal-client', function (ClientRepository $clients) {
+    $provider = config('auth.guards.api.provider');
+
+    try {
+        $clients->personalAccessClient($provider);
+        $this->info('Personal access client: ya existe.');
+    } catch (RuntimeException) {
+        $clients->createPersonalAccessGrantClient('Personal Access Client', $provider);
+        $this->info('Personal access client: creado.');
+    }
+})->purpose('Crea el cliente de Personal Access Tokens si no existe');

tests/Feature/PersonalAccessTokenTest.php

@@ -0,0 +1,46 @@
+<?php
+
+namespace Tests\Feature;
+
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Laravel\Passport\Client;
+use Tests\TestCase;
+
+class PersonalAccessTokenTest extends TestCase
+{
+    use RefreshDatabase;
+
+    private function personalClients(): int
+    {
+        return Client::query()->get()
+            ->filter(fn (Client $client) => $client->hasGrantType('personal_access'))
+            ->count();
+    }
+
+    public function test_ensure_command_creates_the_personal_access_client_once(): void
+    {
+        $this->assertSame(0, $this->personalClients());
+
+        $this->artisan('passport:ensure-personal-client')->assertSuccessful();
+        $this->artisan('passport:ensure-personal-client')->assertSuccessful();
+
+        $this->assertSame(1, $this->personalClients());
+    }
+
+    public function test_users_can_create_personal_access_tokens_once_the_client_exists(): void
+    {
+        $this->artisan('passport:ensure-personal-client')->assertSuccessful();
+        $user = User::factory()->approved()->create();
+
+        $response = $this->actingAs($user)->postJson('/web-api/personal-access-tokens', [
+            'name' => 'MCP TaskStream',
+            'scopes' => ['users:read'],
+        ]);
+
+        $response->assertCreated()->assertJsonStructure(['access_token']);
+        $this->actingAs($user)->getJson('/web-api/personal-access-tokens')
+            ->assertOk()
+            ->assertJsonFragment(['name' => 'MCP TaskStream']);
+    }
+}