update inbox list

vendor/laravel/sanctum/LICENSE.md

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) Taylor Otwell
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

vendor/laravel/sanctum/README.md

@@ -0,0 +1,32 @@
+<p align="center"><img src="https://laravel.com/assets/img/components/logo-sanctum.svg"></p>
+
+<p align="center">
+<a href="https://github.com/laravel/sanctum/actions"><img src="https://github.com/laravel/sanctum/workflows/tests/badge.svg" alt="Build Status"></a>
+<a href="https://packagist.org/packages/laravel/sanctum"><img src="https://poser.pugx.org/laravel/sanctum/d/total.svg" alt="Total Downloads"></a>
+<a href="https://packagist.org/packages/laravel/sanctum"><img src="https://poser.pugx.org/laravel/sanctum/v/stable.svg" alt="Latest Stable Version"></a>
+<a href="https://packagist.org/packages/laravel/sanctum"><img src="https://poser.pugx.org/laravel/sanctum/license.svg" alt="License"></a>
+</p>
+
+## Introduction
+
+Laravel Sanctum provides a featherweight authentication system for SPAs and simple APIs.
+
+## Official Documentation
+
+Documentation for Sanctum can be found on the [Laravel website](https://laravel.com/docs/master/sanctum).
+
+## Contributing
+
+Thank you for considering contributing to Sanctum! The contribution guide can be found in the [Laravel documentation](https://laravel.com/docs/contributions).
+
+## Code of Conduct
+
+In order to ensure that the Laravel community is welcoming to all, please review and abide by the [Code of Conduct](https://laravel.com/docs/contributions#code-of-conduct).
+
+## Security Vulnerabilities
+
+Please review [our security policy](https://github.com/laravel/sanctum/security/policy) on how to report security vulnerabilities.
+
+## License
+
+Laravel Sanctum is open-sourced software licensed under the [MIT license](LICENSE.md).

vendor/laravel/sanctum/composer.json

@@ -0,0 +1,53 @@
+{
+    "name": "laravel/sanctum",
+    "description": "Laravel Sanctum provides a featherweight authentication system for SPAs and simple APIs.",
+    "keywords": ["laravel", "sanctum", "auth"],
+    "license": "MIT",
+    "support": {
+        "issues": "https://github.com/laravel/sanctum/issues",
+        "source": "https://github.com/laravel/sanctum"
+    },
+    "authors": [
+        {
+            "name": "Taylor Otwell",
+            "email": "taylor@laravel.com"
+        }
+    ],
+    "require": {
+        "php": "^7.2",
+        "ext-json": "*",
+        "illuminate/contracts": "^6.9|^7.0",
+        "illuminate/database": "^6.9|^7.0",
+        "illuminate/support": "^6.9|^7.0"
+    },
+    "require-dev": {
+        "mockery/mockery": "^1.0",
+        "orchestra/testbench": "^4.0|^5.0",
+        "phpunit/phpunit": "^8.0"
+    },
+    "autoload": {
+        "psr-4": {
+            "Laravel\\Sanctum\\": "src/"
+        }
+    },
+    "autoload-dev": {
+        "psr-4": {
+            "Laravel\\Sanctum\\Tests\\": "tests/"
+        }
+    },
+    "extra": {
+        "branch-alias": {
+            "dev-master": "1.x-dev"
+        },
+        "laravel": {
+            "providers": [
+                "Laravel\\Sanctum\\SanctumServiceProvider"
+            ]
+        }
+    },
+    "config": {
+        "sort-packages": true
+    },
+    "minimum-stability": "dev",
+    "prefer-stable": true
+}

vendor/laravel/sanctum/config/sanctum.php

@@ -0,0 +1,47 @@
+<?php
+
+return [
+
+    /*
+    |--------------------------------------------------------------------------
+    | Stateful Domains
+    |--------------------------------------------------------------------------
+    |
+    | Requests from the following domains / hosts will receive stateful API
+    | authentication cookies. Typically, these should include your local
+    | and production domains which access your API via a frontend SPA.
+    |
+    */
+
+    'stateful' => explode(',', env('SANCTUM_STATEFUL_DOMAINS', 'localhost,127.0.0.1,127.0.0.1:8000,::1')),
+
+    /*
+    |--------------------------------------------------------------------------
+    | Expiration Minutes
+    |--------------------------------------------------------------------------
+    |
+    | This value controls the number of minutes until an issued token will be
+    | considered expired. If this value is null, personal access tokens do
+    | not expire. This won't tweak the lifetime of first-party sessions.
+    |
+    */
+
+    'expiration' => null,
+
+    /*
+    |--------------------------------------------------------------------------
+    | Sanctum Middleware
+    |--------------------------------------------------------------------------
+    |
+    | When authenticating your first-party SPA with Sanctum you may need to
+    | customize some of the middleware Sanctum uses while processing the
+    | request. You may change the middleware listed below as required.
+    |
+    */
+
+    'middleware' => [
+        'verify_csrf_token' => App\Http\Middleware\VerifyCsrfToken::class,
+        'encrypt_cookies' => App\Http\Middleware\EncryptCookies::class,
+    ],
+
+];

vendor/laravel/sanctum/database/migrations/2019_12_14_000001_create_personal_access_tokens_table.php

@@ -0,0 +1,36 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+class CreatePersonalAccessTokensTable extends Migration
+{
+    /**
+     * Run the migrations.
+     *
+     * @return void
+     */
+    public function up()
+    {
+        Schema::create('personal_access_tokens', function (Blueprint $table) {
+            $table->bigIncrements('id');
+            $table->morphs('tokenable');
+            $table->string('name');
+            $table->string('token', 64)->unique();
+            $table->text('abilities')->nullable();
+            $table->timestamp('last_used_at')->nullable();
+            $table->timestamps();
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     *
+     * @return void
+     */
+    public function down()
+    {
+        Schema::dropIfExists('personal_access_tokens');
+    }
+}

vendor/laravel/sanctum/src/Contracts/HasAbilities.php

@@ -0,0 +1,22 @@
+<?php
+
+namespace Laravel\Sanctum\Contracts;
+
+interface HasAbilities
+{
+    /**
+     * Determine if the token has a given ability.
+     *
+     * @param  string  $ability
+     * @return bool
+     */
+    public function can($ability);
+
+    /**
+     * Determine if the token is missing a given ability.
+     *
+     * @param  string  $ability
+     * @return bool
+     */
+    public function cant($ability);
+}

vendor/laravel/sanctum/src/Guard.php

@@ -0,0 +1,107 @@
+<?php
+
+namespace Laravel\Sanctum;
+
+use Illuminate\Contracts\Auth\Factory as AuthFactory;
+use Illuminate\Http\Request;
+
+class Guard
+{
+    /**
+     * The authentication factory implementation.
+     *
+     * @var \Illuminate\Contracts\Auth\Factory
+     */
+    protected $auth;
+
+    /**
+     * The number of minutes tokens should be allowed to remain valid.
+     *
+     * @var int
+     */
+    protected $expiration;
+
+    /**
+     * The provider name.
+     *
+     * @var string
+     */
+    protected $provider;
+
+    /**
+     * Create a new guard instance.
+     *
+     * @param  \Illuminate\Contracts\Auth\Factory  $auth
+     * @param  int  $expiration
+     * @param  string  $provider
+     * @return void
+     */
+    public function __construct(AuthFactory $auth, $expiration = null, $provider = null)
+    {
+        $this->auth = $auth;
+        $this->expiration = $expiration;
+        $this->provider = $provider;
+    }
+
+    /**
+     * Retrieve the authenticated user for the incoming request.
+     *
+     * @param  \Illuminate\Http\Request  $request
+     * @return mixed
+     */
+    public function __invoke(Request $request)
+    {
+        if ($user = $this->auth->guard(config('sanctum.guard', 'web'))->user()) {
+            return $this->supportsTokens($user)
+                        ? $user->withAccessToken(new TransientToken)
+                        : $user;
+        }
+
+        if ($token = $request->bearerToken()) {
+            $model = Sanctum::$personalAccessTokenModel;
+
+            $accessToken = $model::findToken($token);
+
+            if (! $accessToken ||
+                ($this->expiration &&
+                 $accessToken->created_at->lte(now()->subMinutes($this->expiration))) ||
+                ! $this->hasValidProvider($accessToken->tokenable)) {
+                return;
+            }
+
+            return $this->supportsTokens($accessToken->tokenable) ? $accessToken->tokenable->withAccessToken(
+                tap($accessToken->forceFill(['last_used_at' => now()]))->save()
+            ) : null;
+        }
+    }
+
+    /**
+     * Determine if the tokenable model supports API tokens.
+     *
+     * @param  mixed  $tokenable
+     * @return bool
+     */
+    protected function supportsTokens($tokenable = null)
+    {
+        return $tokenable && in_array(HasApiTokens::class, class_uses_recursive(
+            get_class($tokenable)
+        ));
+    }
+
+    /**
+     * Determine if the tokenable model matches the provider's model type.
+     *
+     * @param  \Illuminate\Database\Eloquent\Model  $tokenable
+     * @return bool
+     */
+    protected function hasValidProvider($tokenable)
+    {
+        if (is_null($this->provider)) {
+            return true;
+        }
+
+        $model = config("auth.providers.{$this->provider}.model");
+
+        return $tokenable instanceof $model;
+    }
+}

vendor/laravel/sanctum/src/HasApiTokens.php

@@ -0,0 +1,77 @@
+<?php
+
+namespace Laravel\Sanctum;
+
+use Illuminate\Support\Str;
+
+trait HasApiTokens
+{
+    /**
+     * The access token the user is using for the current request.
+     *
+     * @var \Laravel\Sanctum\Contracts\HasAbilities
+     */
+    protected $accessToken;
+
+    /**
+     * Get the access tokens that belong to model.
+     *
+     * @return \Illuminate\Database\Eloquent\Relations\MorphMany
+     */
+    public function tokens()
+    {
+        return $this->morphMany(Sanctum::$personalAccessTokenModel, 'tokenable');
+    }
+
+    /**
+     * Determine if the current API token has a given scope.
+     *
+     * @param  string  $ability
+     * @return bool
+     */
+    public function tokenCan(string $ability)
+    {
+        return $this->accessToken ? $this->accessToken->can($ability) : false;
+    }
+
+    /**
+     * Create a new personal access token for the user.
+     *
+     * @param  string  $name
+     * @param  array  $abilities
+     * @return \Laravel\Sanctum\NewAccessToken
+     */
+    public function createToken(string $name, array $abilities = ['*'])
+    {
+        $token = $this->tokens()->create([
+            'name' => $name,
+            'token' => hash('sha256', $plainTextToken = Str::random(80)),
+            'abilities' => $abilities,
+        ]);
+
+        return new NewAccessToken($token, $token->id.'|'.$plainTextToken);
+    }
+
+    /**
+     * Get the access token currently associated with the user.
+     *
+     * @return \Laravel\Sanctum\Contracts\HasAbilities
+     */
+    public function currentAccessToken()
+    {
+        return $this->accessToken;
+    }
+
+    /**
+     * Set the current access token for the user.
+     *
+     * @param  \Laravel\Sanctum\Contracts\HasAbilities  $accessToken
+     * @return $this
+     */
+    public function withAccessToken($accessToken)
+    {
+        $this->accessToken = $accessToken;
+
+        return $this;
+    }
+}

vendor/laravel/sanctum/src/Http/Controllers/CsrfCookieController.php

@@ -0,0 +1,18 @@
+<?php
+
+namespace Laravel\Sanctum\Http\Controllers;
+
+use Illuminate\Http\Response;
+
+class CsrfCookieController
+{
+    /**
+     * Return an empty response simply to trigger the storage of the CSRF cookie in the browser.
+     *
+     * @return \Illuminate\Http\Response
+     */
+    public function show()
+    {
+        return new Response('', 204);
+    }
+}

vendor/laravel/sanctum/src/Http/Middleware/EnsureFrontendRequestsAreStateful.php

@@ -0,0 +1,68 @@
+<?php
+
+namespace Laravel\Sanctum\Http\Middleware;
+
+use Illuminate\Routing\Pipeline;
+use Illuminate\Support\Collection;
+use Illuminate\Support\Str;
+
+class EnsureFrontendRequestsAreStateful
+{
+    /**
+     * Handle the incoming requests.
+     *
+     * @param  \Illuminate\Http\Request  $request
+     * @param  callable  $next
+     * @return \Illuminate\Http\Response
+     */
+    public function handle($request, $next)
+    {
+        $this->configureSecureCookieSessions();
+
+        return (new Pipeline(app()))->send($request)->through(static::fromFrontend($request) ? [
+            function ($request, $next) {
+                $request->attributes->set('sanctum', true);
+
+                return $next($request);
+            },
+            config('sanctum.middleware.encrypt_cookies', \Illuminate\Cookie\Middleware\EncryptCookies::class),
+            \Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse::class,
+            \Illuminate\Session\Middleware\StartSession::class,
+            config('sanctum.middleware.verify_csrf_token', \Illuminate\Foundation\Http\Middleware\VerifyCsrfToken::class),
+        ] : [])->then(function ($request) use ($next) {
+            return $next($request);
+        });
+    }
+
+    /**
+     * Configure secure cookie sessions.
+     *
+     * @return void
+     */
+    protected function configureSecureCookieSessions()
+    {
+        config([
+            'session.http_only' => true,
+            'session.same_site' => 'lax',
+        ]);
+    }
+
+    /**
+     * Determine if the given request is from the first-party application frontend.
+     *
+     * @param  \Illuminate\Http\Request  $request
+     * @return bool
+     */
+    public static function fromFrontend($request)
+    {
+        $referer = Str::replaceFirst('https://', '', $request->headers->get('referer'));
+        $referer = Str::replaceFirst('http://', '', $referer);
+        $referer = Str::endsWith($referer, '/') ? $referer : "{$referer}/";
+
+        $stateful = array_filter(config('sanctum.stateful', []));
+
+        return Str::is(Collection::make($stateful)->map(function ($uri) {
+            return trim($uri).'/*';
+        })->all(), $referer);
+    }
+}

vendor/laravel/sanctum/src/NewAccessToken.php

@@ -0,0 +1,60 @@
+<?php
+
+namespace Laravel\Sanctum;
+
+use Illuminate\Contracts\Support\Arrayable;
+use Illuminate\Contracts\Support\Jsonable;
+
+class NewAccessToken implements Arrayable, Jsonable
+{
+    /**
+     * The access token instance.
+     *
+     * @var \Laravel\Sanctum\PersonalAccessToken
+     */
+    public $accessToken;
+
+    /**
+     * The plain text version of the token.
+     *
+     * @var string
+     */
+    public $plainTextToken;
+
+    /**
+     * Create a new access token result.
+     *
+     * @param  \Laravel\Sanctum\PersonalAccessToken  $accessToken
+     * @param  string  $plainTextToken
+     * @return void
+     */
+    public function __construct(PersonalAccessToken $accessToken, string $plainTextToken)
+    {
+        $this->accessToken = $accessToken;
+        $this->plainTextToken = $plainTextToken;
+    }
+
+    /**
+     * Get the instance as an array.
+     *
+     * @return array
+     */
+    public function toArray()
+    {
+        return [
+            'accessToken' => $this->accessToken,
+            'plainTextToken' => $this->plainTextToken,
+        ];
+    }
+
+    /**
+     * Convert the object to its JSON representation.
+     *
+     * @param  int  $options
+     * @return string
+     */
+    public function toJson($options = 0)
+    {
+        return json_encode($this->toArray(), $options);
+    }
+}

vendor/laravel/sanctum/src/PersonalAccessToken.php

@@ -0,0 +1,91 @@
+<?php
+
+namespace Laravel\Sanctum;
+
+use Illuminate\Database\Eloquent\Model;
+use Laravel\Sanctum\Contracts\HasAbilities;
+
+class PersonalAccessToken extends Model implements HasAbilities
+{
+    /**
+     * The attributes that should be cast to native types.
+     *
+     * @var array
+     */
+    protected $casts = [
+        'abilities' => 'json',
+        'last_used_at' => 'datetime',
+    ];
+
+    /**
+     * The attributes that are mass assignable.
+     *
+     * @var array
+     */
+    protected $fillable = [
+        'name',
+        'token',
+        'abilities',
+    ];
+
+    /**
+     * The attributes that should be hidden for serialization.
+     *
+     * @var array
+     */
+    protected $hidden = [
+        'token',
+    ];
+
+    /**
+     * Get the tokenable model that the access token belongs to.
+     *
+     * @return \Illuminate\Database\Eloquent\Relations\MorphTo
+     */
+    public function tokenable()
+    {
+        return $this->morphTo('tokenable');
+    }
+
+    /**
+     * Find the token instance matching the given token.
+     *
+     * @param  string  $token
+     * @return static
+     */
+    public static function findToken($token)
+    {
+        if (strpos($token, '|') === false) {
+            return static::where('token', hash('sha256', $token))->first();
+        }
+
+        [$id, $token] = explode('|', $token, 2);
+
+        if ($instance = static::find($id)) {
+            return hash_equals($instance->token, hash('sha256', $token)) ? $instance : null;
+        }
+    }
+
+    /**
+     * Determine if the token has a given ability.
+     *
+     * @param  string  $ability
+     * @return bool
+     */
+    public function can($ability)
+    {
+        return in_array('*', $this->abilities) ||
+               array_key_exists($ability, array_flip($this->abilities));
+    }
+
+    /**
+     * Determine if the token is missing a given ability.
+     *
+     * @param  string  $ability
+     * @return bool
+     */
+    public function cant($ability)
+    {
+        return ! $this->can($ability);
+    }
+}

vendor/laravel/sanctum/src/Sanctum.php

@@ -0,0 +1,98 @@
+<?php
+
+namespace Laravel\Sanctum;
+
+use Mockery;
+
+class Sanctum
+{
+    /**
+     * The personal access client model class name.
+     *
+     * @var string
+     */
+    public static $personalAccessTokenModel = 'Laravel\\Sanctum\\PersonalAccessToken';
+
+    /**
+     * Indicates if Sanctum's migrations will be run.
+     *
+     * @var bool
+     */
+    public static $runsMigrations = true;
+
+    /**
+     * Set the current user for the application with the given abilities.
+     *
+     * @param  \Illuminate\Contracts\Auth\Authenticatable|\Laravel\Sanctum\HasApiTokens  $user
+     * @param  array  $abilities
+     * @param  string  $guard
+     * @return \Illuminate\Contracts\Auth\Authenticatable
+     */
+    public static function actingAs($user, $abilities = [], $guard = 'sanctum')
+    {
+        $token = Mockery::mock(self::personalAccessTokenModel())->shouldIgnoreMissing(false);
+
+        if (in_array('*', $abilities)) {
+            $token->shouldReceive('can')->withAnyArgs()->andReturn(true);
+        } else {
+            foreach ($abilities as $ability) {
+                $token->shouldReceive('can')->with($ability)->andReturn(true);
+            }
+        }
+
+        $user->withAccessToken($token);
+
+        if (isset($user->wasRecentlyCreated) && $user->wasRecentlyCreated) {
+            $user->wasRecentlyCreated = false;
+        }
+
+        app('auth')->guard($guard)->setUser($user);
+
+        app('auth')->shouldUse($guard);
+
+        return $user;
+    }
+
+    /**
+     * Set the personal access token model name.
+     *
+     * @param  string  $model
+     * @return void
+     */
+    public static function usePersonalAccessTokenModel($model)
+    {
+        static::$personalAccessTokenModel = $model;
+    }
+
+    /**
+     * Determine if Sanctum's migrations should be run.
+     *
+     * @return bool
+     */
+    public static function shouldRunMigrations()
+    {
+        return static::$runsMigrations;
+    }
+
+    /**
+     * Configure Sanctum to not register its migrations.
+     *
+     * @return static
+     */
+    public static function ignoreMigrations()
+    {
+        static::$runsMigrations = false;
+
+        return new static;
+    }
+
+    /**
+     * Get the token model class name.
+     *
+     * @return string
+     */
+    public static function personalAccessTokenModel()
+    {
+        return static::$personalAccessTokenModel;
+    }
+}

vendor/laravel/sanctum/src/SanctumServiceProvider.php

@@ -0,0 +1,132 @@
+<?php
+
+namespace Laravel\Sanctum;
+
+use Illuminate\Auth\RequestGuard;
+use Illuminate\Contracts\Http\Kernel;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\Support\Facades\Route;
+use Illuminate\Support\ServiceProvider;
+use Laravel\Sanctum\Http\Controllers\CsrfCookieController;
+use Laravel\Sanctum\Http\Middleware\EnsureFrontendRequestsAreStateful;
+
+class SanctumServiceProvider extends ServiceProvider
+{
+    /**
+     * Register any application services.
+     *
+     * @return void
+     */
+    public function register()
+    {
+        config([
+            'auth.guards.sanctum' => array_merge([
+                'driver' => 'sanctum',
+                'provider' => null,
+            ], config('auth.guards.sanctum', [])),
+        ]);
+
+        if (! $this->app->configurationIsCached()) {
+            $this->mergeConfigFrom(__DIR__.'/../config/sanctum.php', 'sanctum');
+        }
+    }
+
+    /**
+     * Bootstrap any application services.
+     *
+     * @return void
+     */
+    public function boot()
+    {
+        if ($this->app->runningInConsole()) {
+            $this->registerMigrations();
+
+            $this->publishes([
+                __DIR__.'/../database/migrations' => database_path('migrations'),
+            ], 'sanctum-migrations');
+
+            $this->publishes([
+                __DIR__.'/../config/sanctum.php' => config_path('sanctum.php'),
+            ], 'sanctum-config');
+        }
+
+        $this->defineRoutes();
+        $this->configureGuard();
+        $this->configureMiddleware();
+    }
+
+    /**
+     * Register Sanctum's migration files.
+     *
+     * @return void
+     */
+    protected function registerMigrations()
+    {
+        if (Sanctum::shouldRunMigrations()) {
+            return $this->loadMigrationsFrom(__DIR__.'/../database/migrations');
+        }
+    }
+
+    /**
+     * Define the Sanctum routes.
+     *
+     * @return void
+     */
+    protected function defineRoutes()
+    {
+        if ($this->app->routesAreCached() || config('sanctum.routes') === false) {
+            return;
+        }
+
+        Route::group(['prefix' => config('sanctum.prefix', 'sanctum')], function () {
+            Route::get(
+                '/csrf-cookie',
+                CsrfCookieController::class.'@show'
+            )->middleware('web');
+        });
+    }
+
+    /**
+     * Configure the Sanctum authentication guard.
+     *
+     * @return void
+     */
+    protected function configureGuard()
+    {
+        Auth::resolved(function ($auth) {
+            $auth->extend('sanctum', function ($app, $name, array $config) use ($auth) {
+                return tap($this->createGuard($auth, $config), function ($guard) {
+                    $this->app->refresh('request', $guard, 'setRequest');
+                });
+            });
+        });
+    }
+
+    /**
+     * Register the guard.
+     *
+     * @param \Illuminate\Contracts\Auth\Factory  $auth
+     * @param array $config
+     * @return RequestGuard
+     */
+    protected function createGuard($auth, $config)
+    {
+        return new RequestGuard(
+            new Guard($auth, config('sanctum.expiration'), $config['provider']),
+            $this->app['request'],
+            $auth->createUserProvider()
+        );
+    }
+
+    /**
+     * Configure the Sanctum middleware and priority.
+     *
+     * @return void
+     */
+    protected function configureMiddleware()
+    {
+        $kernel = $this->app->make(Kernel::class);
+
+        $kernel->prependToMiddlewarePriority(EnsureFrontendRequestsAreStateful::class);
+    }
+}

vendor/laravel/sanctum/src/TransientToken.php

@@ -0,0 +1,30 @@
+<?php
+
+namespace Laravel\Sanctum;
+
+use Laravel\Sanctum\Contracts\HasAbilities;
+
+class TransientToken implements HasAbilities
+{
+    /**
+     * Determine if the token has a given ability.
+     *
+     * @param  string  $ability
+     * @return bool
+     */
+    public function can($ability)
+    {
+        return true;
+    }
+
+    /**
+     * Determine if the token is missing a given ability.
+     *
+     * @param  string  $ability
+     * @return bool
+     */
+    public function cant($ability)
+    {
+        return false;
+    }
+}