From 4b2aef7e57751ab35d1eb7d4e6aa918efec10690 Mon Sep 17 00:00:00 2001
From: gabrielzigo <gabriel.zigo@petitpress.sk>
Date: Thu, 20 Aug 2026 13:51:06 +0200
Subject: [PATCH 1/4] Add never-expiring personal access tokens with a
 per-token MCP rate limit

---
 CHANGELOG.md                                  | 12 ++++
 README.md                                     | 11 +++-
 composer.json                                 |  2 +-
 .../CreatePersonalAccessTokenCommand.php      | 60 ++++++++++++++++++-
 .../Cache/PersonalAccessTokenAuthCache.php    | 36 +++++++----
 .../Facade/PersonalAccessTokenFacade.php      | 11 ++++
 .../Model/CachedPersonalAccessToken.php       | 27 +++++++++
 .../PersonalAccessTokenRepository.php         |  2 +-
 src/Entity/AbstractPersonalAccessToken.php    | 24 ++++++--
 .../PersonalAccessTokenAuthenticator.php      | 53 +++++++++-------
 .../PersonalAccessTokenAuthCacheTest.php      | 45 ++++++++++----
 .../Facade/PersonalAccessTokenFacadeTest.php  | 39 +++++++++++-
 .../PersonalAccessTokenAuthenticatorTest.php  | 20 +++++--
 13 files changed, 281 insertions(+), 61 deletions(-)
 create mode 100644 src/Domain/PersonalAccessToken/Model/CachedPersonalAccessToken.php

diff --git a/CHANGELOG.md b/CHANGELOG.md
index aeff0c1..5fe26d6 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,15 @@
+## [Unreleased]
+
+### Features
+* `AbstractPersonalAccessToken::expiresAt` is nullable — `NULL` means the token never expires (active in `findOneActiveByTokenHash()`, skipped by `anzu:personal-access-token:notify-expiring`); new `isNeverExpiring()`. New `rateLimit` column (`?int`, not serialized) — a per-token MCP rate limit overriding the configured default. Hosts must add a migration: `expires_at DATETIME DEFAULT NULL`, `rate_limit INT UNSIGNED DEFAULT NULL`.
+* `anzu:personal-access-token:create` gained `--never-expires` (mutually exclusive with `--expires-at`) and `--rate-limit=N`; `PersonalAccessTokenFacade::create()` gained `?int $rateLimit` and `bool $neverExpires`. The management API keeps creating expiring tokens without a rate limit.
+* `PersonalAccessTokenAuthenticator` sets `McpRateLimiter::TOKEN_ATTRIBUTE_KEY` (`pat_<id>`) and `McpRateLimiter::TOKEN_ATTRIBUTE_LIMIT` on the security token; `PersonalAccessTokenAuthCache` caches a `CachedPersonalAccessToken` (token id, user id, rate limit) under a new key prefix instead of the bare user id.
+
+### Changes
+* BC change: `anzusystems/common-bundle` requirement raised to `^11.5` (the authenticator uses `McpRateLimiter::TOKEN_ATTRIBUTE_*`).
+* BC change: `AbstractPersonalAccessToken::getExpiresAt()` returns `?DateTimeImmutable`, `setExpiresAt()` accepts `null`; `PersonalAccessTokenAuthCache::getUserId()/storeUserId()` replaced by `getToken()/storeToken()`.
+* A cached token whose user entity no longer exists now fails authentication instead of falling back to the database lookup.
+
 ## [6.0.0](https://github.com/anzusystems/auth-bundle/compare/5.0.0...6.0.0) (2026-07-22)
 
 ### Features
diff --git a/README.md b/README.md
index 33516be..439b4e0 100644
--- a/README.md
+++ b/README.md
@@ -71,7 +71,7 @@ $routes
 
 ## Personal access tokens
 
-Opt-in personal access token (PAT) authentication: an sha256-hashed bearer token bound to a user, with expiration,
+Opt-in personal access token (PAT) authentication: an sha256-hashed bearer token bound to a user, with optional expiration,
 revocation, cached authentication, expiry notifications and management API. Disabled by default — a project that does
 not enable it needs no schema or configuration changes after a bundle upgrade.
 
@@ -130,13 +130,20 @@ $routes
     ->prefix('/api/adm/v1');
 ```
 
+The authenticator sets the `McpRateLimiter::TOKEN_ATTRIBUTE_KEY` (`pat_<id>`) and `McpRateLimiter::TOKEN_ATTRIBUTE_LIMIT`
+(the token's `rateLimit`) attributes on the security token, so the common-bundle MCP rate limiter (`anzusystems/common-bundle`
+`>=11.5`) buckets requests per personal access token and honours the per-token limit.
+
 Authorization uses the `auth_personalAccessToken_(create|read|revoke)` permissions (see
 `AnzuSystems\AuthBundle\Security\PersonalAccessTokenPermission`); creation additionally requires the role
 configured via `create_role` (default `ROLE_MCP`).
 
 Console commands:
 
-* `anzu:personal-access-token:create <userId> --name=<label> [--expires-at=...]` — prints the plaintext token once.
+* `anzu:personal-access-token:create <userId> --name=<label> [--expires-at=...] [--never-expires] [--rate-limit=N]` —
+  prints the plaintext token once. `--never-expires` creates a token with `expiresAt = NULL` (skipped by the expiry
+  notifications, mutually exclusive with `--expires-at`); `--rate-limit` stores a per-token MCP rate limit overriding
+  the configured default (`null` = default). Both are command-only — the management API never sets them.
 * `anzu:personal-access-token:notify-expiring` — daily cron; notifies owners of tokens expiring in 7 days or 1 day
   through `PersonalAccessTokenExpiryNotifierInterface` (no-op by default — alias your own implementation). The
   final-notice windows of consecutive runs overlap, so the implementation must be idempotent per
diff --git a/composer.json b/composer.json
index 3a6ff0c..b08b5ad 100644
--- a/composer.json
+++ b/composer.json
@@ -18,7 +18,7 @@
         "php": ">=8.4",
         "ext-json": "*",
         "ext-redis": "*",
-        "anzusystems/common-bundle": "^9.4|^10.0|^11.0|^12.0",
+        "anzusystems/common-bundle": "^11.5",
         "doctrine/common": "^3.3",
         "lcobucci/clock": "^3.0",
         "lcobucci/jwt": "^5.5",
diff --git a/src/Command/CreatePersonalAccessTokenCommand.php b/src/Command/CreatePersonalAccessTokenCommand.php
index 61c338e..598391c 100644
--- a/src/Command/CreatePersonalAccessTokenCommand.php
+++ b/src/Command/CreatePersonalAccessTokenCommand.php
@@ -31,6 +31,11 @@ final class CreatePersonalAccessTokenCommand extends Command
     private const string ARG_USER_ID = 'userId';
     private const string OPTION_NAME = 'name';
     private const string OPTION_EXPIRES_AT = 'expires-at';
+    private const string OPTION_NEVER_EXPIRES = 'never-expires';
+    private const string OPTION_RATE_LIMIT = 'rate-limit';
+    private const string EXPIRES_AT_NEVER = 'never';
+    private const string RATE_LIMIT_DEFAULT = 'default';
+    private const int RATE_LIMIT_MIN = 1;
     private const string DATETIME_FORMAT = 'Y-m-d H:i:s';
 
     /**
@@ -54,6 +59,16 @@ protected function configure(): void
                 AbstractPersonalAccessToken::DEFAULT_EXPIRES_AT_DATE,
                 AbstractPersonalAccessToken::MAX_EXPIRES_AT_DATE,
             ))
+            ->addOption(self::OPTION_NEVER_EXPIRES, null, InputOption::VALUE_NONE, sprintf(
+                'Create a token without expiration (mutually exclusive with --%s).',
+                self::OPTION_EXPIRES_AT,
+            ))
+            ->addOption(
+                self::OPTION_RATE_LIMIT,
+                null,
+                InputOption::VALUE_REQUIRED,
+                'Requests per rate limit interval overriding the configured default, e.g. 600.',
+            )
         ;
     }
 
@@ -80,6 +95,28 @@ protected function execute(InputInterface $input, OutputInterface $output): int
             return self::FAILURE;
         }
 
+        $neverExpires = (bool) $input->getOption(self::OPTION_NEVER_EXPIRES);
+        if ($neverExpires && StringHelper::isNotEmpty((string) $input->getOption(self::OPTION_EXPIRES_AT))) {
+            $output->writeln(sprintf(
+                '<error>Options --%s and --%s are mutually exclusive.</error>',
+                self::OPTION_EXPIRES_AT,
+                self::OPTION_NEVER_EXPIRES,
+            ));
+
+            return self::FAILURE;
+        }
+
+        $rateLimit = $this->resolveRateLimitOption($input);
+        if (false === $rateLimit) {
+            $output->writeln(sprintf(
+                '<error>Invalid --%s value "%s", provide a positive integer.</error>',
+                self::OPTION_RATE_LIMIT,
+                (string) $input->getOption(self::OPTION_RATE_LIMIT),
+            ));
+
+            return self::FAILURE;
+        }
+
         try {
             $expiresAt = $this->resolveExpiresAtOption($input);
         } catch (Exception) {
@@ -97,6 +134,8 @@ protected function execute(InputInterface $input, OutputInterface $output): int
                 user: $user,
                 name: $name,
                 expiresAt: $expiresAt,
+                rateLimit: $rateLimit,
+                neverExpires: $neverExpires,
             );
         } catch (ValidationException $exception) {
             $output->writeln(sprintf(
@@ -110,13 +149,30 @@ protected function execute(InputInterface $input, OutputInterface $output): int
         $output->writeln(sprintf('Token (shown only once): <info>%s</info>', $result->token));
         $output->writeln(sprintf(
             'Expires at: %s',
-            $result->personalAccessToken->getExpiresAt()
-                ->format(self::DATETIME_FORMAT)
+            $result->personalAccessToken->getExpiresAt()?->format(self::DATETIME_FORMAT) ?? self::EXPIRES_AT_NEVER,
+        ));
+        $output->writeln(sprintf(
+            'Rate limit: %s',
+            $result->personalAccessToken->getRateLimit() ?? self::RATE_LIMIT_DEFAULT,
         ));
 
         return self::SUCCESS;
     }
 
+    private function resolveRateLimitOption(InputInterface $input): int|false|null
+    {
+        $rateLimitOption = $input->getOption(self::OPTION_RATE_LIMIT);
+        if (null === $rateLimitOption) {
+            return null;
+        }
+
+        return filter_var($rateLimitOption, FILTER_VALIDATE_INT, [
+            'options' => [
+                'min_range' => self::RATE_LIMIT_MIN,
+            ],
+        ]);
+    }
+
     private function resolveExpiresAtOption(InputInterface $input): ?DateTimeImmutable
     {
         $expiresAtOption = $input->getOption(self::OPTION_EXPIRES_AT);
diff --git a/src/Domain/PersonalAccessToken/Cache/PersonalAccessTokenAuthCache.php b/src/Domain/PersonalAccessToken/Cache/PersonalAccessTokenAuthCache.php
index d1eb7e3..5372227 100644
--- a/src/Domain/PersonalAccessToken/Cache/PersonalAccessTokenAuthCache.php
+++ b/src/Domain/PersonalAccessToken/Cache/PersonalAccessTokenAuthCache.php
@@ -4,6 +4,7 @@
 
 namespace AnzuSystems\AuthBundle\Domain\PersonalAccessToken\Cache;
 
+use AnzuSystems\AuthBundle\Domain\PersonalAccessToken\Model\CachedPersonalAccessToken;
 use AnzuSystems\Contracts\AnzuApp;
 use DateTimeImmutable;
 use Psr\Cache\CacheItemInterface;
@@ -13,7 +14,7 @@
 {
     public const int USER_ID_EXPIRE_TIME = 300;
 
-    private const string CACHE_KEY_PREFIX = 'pat_auth_user_id';
+    private const string CACHE_KEY_PREFIX = 'pat_auth_token';
     private const string VERSION_KEY_PREFIX = 'pat_auth_version';
     private const int VERSION_INITIAL = 1;
     private const int VERSION_INCREMENT = 1;
@@ -29,29 +30,33 @@ public function getInvalidationVersion(string $tokenHash): int
         return $this->readVersion($this->patAuthCache->getItem($this->getVersionKey($tokenHash)));
     }
 
-    public function getUserId(string $tokenHash, int $version): ?int
+    public function getToken(string $tokenHash, int $version): ?CachedPersonalAccessToken
     {
         $cacheItem = $this->patAuthCache->getItem($this->getCacheKey($tokenHash, $version));
         if (false === $cacheItem->isHit()) {
             return null;
         }
-        $userId = $cacheItem->get();
-        if (is_int($userId)) {
-            return $userId;
+        $token = $cacheItem->get();
+        if ($token instanceof CachedPersonalAccessToken) {
+            return $token;
         }
 
         return null;
     }
 
-    public function storeUserId(string $tokenHash, int $version, int $userId, DateTimeImmutable $expiresAt): void
-    {
-        $secondsToExpiry = $expiresAt->getTimestamp() - AnzuApp::date()->getTimestamp();
-        if ($secondsToExpiry <= 0) {
+    public function storeToken(
+        string $tokenHash,
+        int $version,
+        CachedPersonalAccessToken $token,
+        ?DateTimeImmutable $expiresAt,
+    ): void {
+        $expireTime = $this->resolveExpireTime($expiresAt);
+        if ($expireTime <= 0) {
             return;
         }
         $cacheItem = $this->patAuthCache->getItem($this->getCacheKey($tokenHash, $version));
-        $cacheItem->set($userId);
-        $cacheItem->expiresAfter(min(self::USER_ID_EXPIRE_TIME, $secondsToExpiry));
+        $cacheItem->set($token);
+        $cacheItem->expiresAfter($expireTime);
         $this->patAuthCache->save($cacheItem);
     }
 
@@ -63,6 +68,15 @@ public function invalidate(string $tokenHash): void
         $this->patAuthCache->save($cacheItem);
     }
 
+    private function resolveExpireTime(?DateTimeImmutable $expiresAt): int
+    {
+        if (null === $expiresAt) {
+            return self::USER_ID_EXPIRE_TIME;
+        }
+
+        return min(self::USER_ID_EXPIRE_TIME, $expiresAt->getTimestamp() - AnzuApp::date()->getTimestamp());
+    }
+
     private function readVersion(CacheItemInterface $cacheItem): int
     {
         if (false === $cacheItem->isHit()) {
diff --git a/src/Domain/PersonalAccessToken/Facade/PersonalAccessTokenFacade.php b/src/Domain/PersonalAccessToken/Facade/PersonalAccessTokenFacade.php
index 3f90e2a..0811e0a 100644
--- a/src/Domain/PersonalAccessToken/Facade/PersonalAccessTokenFacade.php
+++ b/src/Domain/PersonalAccessToken/Facade/PersonalAccessTokenFacade.php
@@ -12,6 +12,7 @@
 use AnzuSystems\CommonBundle\Validator\Validator;
 use AnzuSystems\Contracts\Entity\AnzuUser;
 use DateTimeImmutable;
+use InvalidArgumentException;
 use Random\RandomException;
 
 final readonly class PersonalAccessTokenFacade
@@ -32,22 +33,32 @@ public function __construct(
     /**
      * @throws ValidationException
      * @throws RandomException
+     * @throws InvalidArgumentException
      */
     public function create(
         AnzuUser $user,
         string $name,
         ?DateTimeImmutable $expiresAt = null,
+        ?int $rateLimit = null,
+        bool $neverExpires = false,
     ): PersonalAccessTokenCreateResult {
+        if ($neverExpires && $expiresAt instanceof DateTimeImmutable) {
+            throw new InvalidArgumentException('A never expiring personal access token cannot have an expiration date.');
+        }
         $plainToken = AbstractPersonalAccessToken::TOKEN_PREFIX . bin2hex(random_bytes(self::TOKEN_BYTES_LENGTH));
         $personalAccessToken = new $this->entityClass();
         $personalAccessToken
             ->setUser($user)
             ->setName($name)
             ->setTokenHash(AbstractPersonalAccessToken::hashToken($plainToken))
+            ->setRateLimit($rateLimit)
         ;
         if ($expiresAt instanceof DateTimeImmutable) {
             $personalAccessToken->setExpiresAt($expiresAt);
         }
+        if ($neverExpires) {
+            $personalAccessToken->setExpiresAt(null);
+        }
         $this->validator->validate($personalAccessToken);
         $this->manager->create($personalAccessToken);
 
diff --git a/src/Domain/PersonalAccessToken/Model/CachedPersonalAccessToken.php b/src/Domain/PersonalAccessToken/Model/CachedPersonalAccessToken.php
new file mode 100644
index 0000000..761b991
--- /dev/null
+++ b/src/Domain/PersonalAccessToken/Model/CachedPersonalAccessToken.php
@@ -0,0 +1,27 @@
+<?php
+
+declare(strict_types=1);
+
+namespace AnzuSystems\AuthBundle\Domain\PersonalAccessToken\Model;
+
+use AnzuSystems\AuthBundle\Entity\AbstractPersonalAccessToken;
+
+final readonly class CachedPersonalAccessToken
+{
+    public function __construct(
+        public int $personalAccessTokenId,
+        public int $userId,
+        public ?int $rateLimit,
+    ) {
+    }
+
+    public static function fromEntity(AbstractPersonalAccessToken $personalAccessToken): self
+    {
+        return new self(
+            (int) $personalAccessToken->getId(),
+            (int) $personalAccessToken->getUser()
+                ->getId(),
+            $personalAccessToken->getRateLimit(),
+        );
+    }
+}
diff --git a/src/Domain/PersonalAccessToken/Repository/PersonalAccessTokenRepository.php b/src/Domain/PersonalAccessToken/Repository/PersonalAccessTokenRepository.php
index 6998353..7033558 100644
--- a/src/Domain/PersonalAccessToken/Repository/PersonalAccessTokenRepository.php
+++ b/src/Domain/PersonalAccessToken/Repository/PersonalAccessTokenRepository.php
@@ -38,7 +38,7 @@ public function findOneActiveByTokenHash(string $tokenHash): ?AbstractPersonalAc
         return $this->createQueryBuilder('personalAccessToken')
             ->where('personalAccessToken.tokenHash = :tokenHash')
             ->andWhere('personalAccessToken.revokedAt IS NULL')
-            ->andWhere('personalAccessToken.expiresAt > :now')
+            ->andWhere('personalAccessToken.expiresAt IS NULL OR personalAccessToken.expiresAt > :now')
             ->setParameter('tokenHash', $tokenHash)
             ->setParameter('now', AnzuApp::date())
             ->getQuery()
diff --git a/src/Entity/AbstractPersonalAccessToken.php b/src/Entity/AbstractPersonalAccessToken.php
index 3f251c3..82bcf14 100644
--- a/src/Entity/AbstractPersonalAccessToken.php
+++ b/src/Entity/AbstractPersonalAccessToken.php
@@ -48,11 +48,15 @@ abstract class AbstractPersonalAccessToken implements IdentifiableInterface, Tim
     #[ORM\Column(type: Types::STRING, length: self::TOKEN_HASH_LENGTH)]
     protected string $tokenHash = '';
 
-    #[ORM\Column(type: Types::DATETIME_IMMUTABLE)]
+    #[ORM\Column(type: Types::DATETIME_IMMUTABLE, nullable: true)]
     #[Serialize]
     #[Assert\GreaterThan(value: 'now', message: ValidationException::ERROR_FIELD_RANGE_MIN)]
     #[Assert\LessThanOrEqual(value: self::MAX_EXPIRES_AT_DATE, message: ValidationException::ERROR_FIELD_RANGE_MAX)]
-    protected DateTimeImmutable $expiresAt;
+    protected ?DateTimeImmutable $expiresAt;
+
+    #[ORM\Column(type: Types::INTEGER, nullable: true, options: ['unsigned' => true])]
+    #[Assert\Positive(message: ValidationException::ERROR_FIELD_RANGE_MIN)]
+    protected ?int $rateLimit = null;
 
     #[ORM\Column(type: Types::DATETIME_IMMUTABLE, nullable: true)]
     #[Serialize]
@@ -117,18 +121,30 @@ public function setTokenHash(string $tokenHash): static
         return $this;
     }
 
-    public function getExpiresAt(): DateTimeImmutable
+    public function getExpiresAt(): ?DateTimeImmutable
     {
         return $this->expiresAt;
     }
 
-    public function setExpiresAt(DateTimeImmutable $expiresAt): static
+    public function setExpiresAt(?DateTimeImmutable $expiresAt): static
     {
         $this->expiresAt = $expiresAt;
 
         return $this;
     }
 
+    public function getRateLimit(): ?int
+    {
+        return $this->rateLimit;
+    }
+
+    public function setRateLimit(?int $rateLimit): static
+    {
+        $this->rateLimit = $rateLimit;
+
+        return $this;
+    }
+
     public function getRevokedAt(): ?DateTimeImmutable
     {
         return $this->revokedAt;
diff --git a/src/Security/Authentication/PersonalAccessTokenAuthenticator.php b/src/Security/Authentication/PersonalAccessTokenAuthenticator.php
index 414484d..6c63463 100644
--- a/src/Security/Authentication/PersonalAccessTokenAuthenticator.php
+++ b/src/Security/Authentication/PersonalAccessTokenAuthenticator.php
@@ -6,8 +6,10 @@
 
 use AnzuSystems\AuthBundle\Domain\PersonalAccessToken\Cache\PersonalAccessTokenAuthCache;
 use AnzuSystems\AuthBundle\Domain\PersonalAccessToken\Manager\PersonalAccessTokenManager;
+use AnzuSystems\AuthBundle\Domain\PersonalAccessToken\Model\CachedPersonalAccessToken;
 use AnzuSystems\AuthBundle\Domain\PersonalAccessToken\Repository\PersonalAccessTokenRepository;
 use AnzuSystems\AuthBundle\Entity\AbstractPersonalAccessToken;
+use AnzuSystems\CommonBundle\Mcp\McpRateLimiter;
 use AnzuSystems\Contracts\AnzuApp;
 use AnzuSystems\Contracts\Entity\AnzuUser;
 use DateTimeImmutable;
@@ -30,6 +32,8 @@ final class PersonalAccessTokenAuthenticator extends AbstractAuthenticator imple
     private const string BEARER_PREFIX = 'Bearer ';
     private const string WWW_AUTHENTICATE_HEADER = 'WWW-Authenticate';
     private const string WWW_AUTHENTICATE_SCHEME = 'Bearer';
+    private const string PASSPORT_ATTRIBUTE_TOKEN = 'personal_access_token';
+    private const string RATE_LIMIT_KEY_PREFIX = 'pat_';
 
     /**
      * @param class-string<AnzuUser> $userEntityClass
@@ -60,14 +64,37 @@ public function authenticate(Request $request): Passport
         );
         $tokenHash = AbstractPersonalAccessToken::hashToken($plainToken);
         $cacheVersion = $this->authCache->getInvalidationVersion($tokenHash);
-        $user = $this->findCachedUser($tokenHash, $cacheVersion) ?? $this->authenticateAgainstDatabase($tokenHash, $cacheVersion);
+        $cachedToken = $this->authCache->getToken($tokenHash, $cacheVersion)
+            ?? $this->authenticateAgainstDatabase($tokenHash, $cacheVersion);
+        $user = $this->entityManager->find($this->userEntityClass, $cachedToken->userId);
+        if (false === ($user instanceof AnzuUser)) {
+            throw new AuthenticationException(sprintf('User (%d) not found!', $cachedToken->userId));
+        }
         if (false === $user->isEnabled()) {
             throw new AuthenticationException(sprintf('User (%d) is not active or is disabled!', (int) $user->getId()));
         }
 
-        return new SelfValidatingPassport(
+        $passport = new SelfValidatingPassport(
             new UserBadge((string) $user->getId(), static fn (): AnzuUser => $user)
         );
+        $passport->setAttribute(self::PASSPORT_ATTRIBUTE_TOKEN, $cachedToken);
+
+        return $passport;
+    }
+
+    public function createToken(Passport $passport, string $firewallName): TokenInterface
+    {
+        $token = parent::createToken($passport, $firewallName);
+        $cachedToken = $passport->getAttribute(self::PASSPORT_ATTRIBUTE_TOKEN);
+        if ($cachedToken instanceof CachedPersonalAccessToken) {
+            $token->setAttribute(
+                McpRateLimiter::TOKEN_ATTRIBUTE_KEY,
+                self::RATE_LIMIT_KEY_PREFIX . $cachedToken->personalAccessTokenId,
+            );
+            $token->setAttribute(McpRateLimiter::TOKEN_ATTRIBUTE_LIMIT, $cachedToken->rateLimit);
+        }
+
+        return $token;
     }
 
     public function onAuthenticationSuccess(Request $request, TokenInterface $token, string $firewallName): ?Response
@@ -85,21 +112,7 @@ public function start(Request $request, ?AuthenticationException $authException
         return $this->createUnauthorizedResponse();
     }
 
-    private function findCachedUser(string $tokenHash, int $cacheVersion): ?AnzuUser
-    {
-        $userId = $this->authCache->getUserId($tokenHash, $cacheVersion);
-        if (null === $userId) {
-            return null;
-        }
-        $user = $this->entityManager->find($this->userEntityClass, $userId);
-        if ($user instanceof AnzuUser) {
-            return $user;
-        }
-
-        return null;
-    }
-
-    private function authenticateAgainstDatabase(string $tokenHash, int $cacheVersion): AnzuUser
+    private function authenticateAgainstDatabase(string $tokenHash, int $cacheVersion): CachedPersonalAccessToken
     {
         try {
             $personalAccessToken = $this->personalAccessTokenRepo->findOneActiveByTokenHash($tokenHash);
@@ -109,11 +122,11 @@ private function authenticateAgainstDatabase(string $tokenHash, int $cacheVersio
         if (null === $personalAccessToken) {
             throw new AuthenticationException('Invalid personal access token!');
         }
-        $user = $personalAccessToken->getUser();
         $this->updateLastUsedAtThrottled($personalAccessToken);
-        $this->authCache->storeUserId($tokenHash, $cacheVersion, (int) $user->getId(), $personalAccessToken->getExpiresAt());
+        $cachedToken = CachedPersonalAccessToken::fromEntity($personalAccessToken);
+        $this->authCache->storeToken($tokenHash, $cacheVersion, $cachedToken, $personalAccessToken->getExpiresAt());
 
-        return $user;
+        return $cachedToken;
     }
 
     private function createUnauthorizedResponse(): JsonResponse
diff --git a/tests/Domain/PersonalAccessToken/Cache/PersonalAccessTokenAuthCacheTest.php b/tests/Domain/PersonalAccessToken/Cache/PersonalAccessTokenAuthCacheTest.php
index 1c1e55d..6b85ea1 100644
--- a/tests/Domain/PersonalAccessToken/Cache/PersonalAccessTokenAuthCacheTest.php
+++ b/tests/Domain/PersonalAccessToken/Cache/PersonalAccessTokenAuthCacheTest.php
@@ -5,6 +5,7 @@
 namespace AnzuSystems\AuthBundle\Tests\Domain\PersonalAccessToken\Cache;
 
 use AnzuSystems\AuthBundle\Domain\PersonalAccessToken\Cache\PersonalAccessTokenAuthCache;
+use AnzuSystems\AuthBundle\Domain\PersonalAccessToken\Model\CachedPersonalAccessToken;
 use AnzuSystems\Contracts\AnzuApp;
 use PHPUnit\Framework\TestCase;
 use Symfony\Component\Cache\Adapter\ArrayAdapter;
@@ -12,7 +13,9 @@
 final class PersonalAccessTokenAuthCacheTest extends TestCase
 {
     private const string TOKEN_HASH = 'pat_auth_cache_test_token_hash';
+    private const int PERSONAL_ACCESS_TOKEN_ID = 7;
     private const int USER_ID = 42;
+    private const int RATE_LIMIT = 600;
     private const string FUTURE_EXPIRY = '+1 hour';
 
     private PersonalAccessTokenAuthCache $cache;
@@ -34,42 +37,60 @@ protected function setUp(): void
         $this->cache = new PersonalAccessTokenAuthCache(new ArrayAdapter());
     }
 
-    public function testGetUserIdReturnsNullOnMiss(): void
+    public function testGetTokenReturnsNullOnMiss(): void
     {
-        self::assertNull($this->cache->getUserId(self::TOKEN_HASH, $this->cache->getInvalidationVersion(self::TOKEN_HASH)));
+        self::assertNull($this->cache->getToken(self::TOKEN_HASH, $this->cache->getInvalidationVersion(self::TOKEN_HASH)));
     }
 
-    public function testStoredUserIdWithFutureExpiryIsReturned(): void
+    public function testStoredTokenWithFutureExpiryIsReturned(): void
     {
         $version = $this->cache->getInvalidationVersion(self::TOKEN_HASH);
-        $this->cache->storeUserId(self::TOKEN_HASH, $version, self::USER_ID, AnzuApp::date(self::FUTURE_EXPIRY));
+        $this->cache->storeToken(self::TOKEN_HASH, $version, $this->createToken(), AnzuApp::date(self::FUTURE_EXPIRY));
 
-        self::assertSame(self::USER_ID, $this->cache->getUserId(self::TOKEN_HASH, $version));
+        $cached = $this->cache->getToken(self::TOKEN_HASH, $version);
+
+        self::assertNotNull($cached);
+        self::assertSame(self::PERSONAL_ACCESS_TOKEN_ID, $cached->personalAccessTokenId);
+        self::assertSame(self::USER_ID, $cached->userId);
+        self::assertSame(self::RATE_LIMIT, $cached->rateLimit);
+    }
+
+    public function testNeverExpiringTokenIsStored(): void
+    {
+        $version = $this->cache->getInvalidationVersion(self::TOKEN_HASH);
+        $this->cache->storeToken(self::TOKEN_HASH, $version, $this->createToken(), null);
+
+        self::assertNotNull($this->cache->getToken(self::TOKEN_HASH, $version));
     }
 
     public function testExpiredTokenIsNeverStored(): void
     {
         $version = $this->cache->getInvalidationVersion(self::TOKEN_HASH);
-        $this->cache->storeUserId(self::TOKEN_HASH, $version, self::USER_ID, AnzuApp::date('-1 second'));
+        $this->cache->storeToken(self::TOKEN_HASH, $version, $this->createToken(), AnzuApp::date('-1 second'));
 
-        self::assertNull($this->cache->getUserId(self::TOKEN_HASH, $version));
+        self::assertNull($this->cache->getToken(self::TOKEN_HASH, $version));
     }
 
-    public function testInvalidateRejectsCachedUser(): void
+    public function testInvalidateRejectsCachedToken(): void
     {
         $version = $this->cache->getInvalidationVersion(self::TOKEN_HASH);
-        $this->cache->storeUserId(self::TOKEN_HASH, $version, self::USER_ID, AnzuApp::date(self::FUTURE_EXPIRY));
+        $this->cache->storeToken(self::TOKEN_HASH, $version, $this->createToken(), AnzuApp::date(self::FUTURE_EXPIRY));
         $this->cache->invalidate(self::TOKEN_HASH);
 
-        self::assertNull($this->cache->getUserId(self::TOKEN_HASH, $this->cache->getInvalidationVersion(self::TOKEN_HASH)));
+        self::assertNull($this->cache->getToken(self::TOKEN_HASH, $this->cache->getInvalidationVersion(self::TOKEN_HASH)));
     }
 
     public function testStaleWriteWithPreInvalidationVersionIsUnreadable(): void
     {
         $staleVersion = $this->cache->getInvalidationVersion(self::TOKEN_HASH);
         $this->cache->invalidate(self::TOKEN_HASH);
-        $this->cache->storeUserId(self::TOKEN_HASH, $staleVersion, self::USER_ID, AnzuApp::date(self::FUTURE_EXPIRY));
+        $this->cache->storeToken(self::TOKEN_HASH, $staleVersion, $this->createToken(), AnzuApp::date(self::FUTURE_EXPIRY));
+
+        self::assertNull($this->cache->getToken(self::TOKEN_HASH, $this->cache->getInvalidationVersion(self::TOKEN_HASH)));
+    }
 
-        self::assertNull($this->cache->getUserId(self::TOKEN_HASH, $this->cache->getInvalidationVersion(self::TOKEN_HASH)));
+    private function createToken(): CachedPersonalAccessToken
+    {
+        return new CachedPersonalAccessToken(self::PERSONAL_ACCESS_TOKEN_ID, self::USER_ID, self::RATE_LIMIT);
     }
 }
diff --git a/tests/Domain/PersonalAccessToken/Facade/PersonalAccessTokenFacadeTest.php b/tests/Domain/PersonalAccessToken/Facade/PersonalAccessTokenFacadeTest.php
index 10986d8..22515f6 100644
--- a/tests/Domain/PersonalAccessToken/Facade/PersonalAccessTokenFacadeTest.php
+++ b/tests/Domain/PersonalAccessToken/Facade/PersonalAccessTokenFacadeTest.php
@@ -7,6 +7,7 @@
 use AnzuSystems\AuthBundle\Domain\PersonalAccessToken\Cache\PersonalAccessTokenAuthCache;
 use AnzuSystems\AuthBundle\Domain\PersonalAccessToken\Facade\PersonalAccessTokenFacade;
 use AnzuSystems\AuthBundle\Domain\PersonalAccessToken\Manager\PersonalAccessTokenManager;
+use AnzuSystems\AuthBundle\Domain\PersonalAccessToken\Model\CachedPersonalAccessToken;
 use AnzuSystems\AuthBundle\Entity\AbstractPersonalAccessToken;
 use AnzuSystems\AuthBundle\Tests\Data\Entity\PersonalAccessToken;
 use AnzuSystems\CommonBundle\Domain\User\CurrentAnzuUserProvider;
@@ -15,6 +16,7 @@
 use AnzuSystems\Contracts\Entity\AnzuUser;
 use DateTimeImmutable;
 use Doctrine\ORM\EntityManagerInterface;
+use InvalidArgumentException;
 use PHPUnit\Framework\TestCase;
 use Symfony\Component\Cache\Adapter\ArrayAdapter;
 use Symfony\Component\Validator\ConstraintViolationList;
@@ -23,6 +25,8 @@
 final class PersonalAccessTokenFacadeTest extends TestCase
 {
     private const int USER_ID = 42;
+    private const int PERSONAL_ACCESS_TOKEN_ID = 7;
+    private const int RATE_LIMIT = 600;
 
     private PersonalAccessTokenAuthCache $authCache;
     private PersonalAccessTokenFacade $facade;
@@ -94,6 +98,32 @@ public function testCreateRespectsExplicitExpiresAt(): void
         $result = $this->facade->create($this->createConfiguredMock(AnzuUser::class, []), 'test-token', $expiresAt);
 
         self::assertSame($expiresAt, $result->personalAccessToken->getExpiresAt());
+        self::assertNull($result->personalAccessToken->getRateLimit());
+    }
+
+    public function testCreateNeverExpiringTokenWithRateLimit(): void
+    {
+        $result = $this->facade->create(
+            $this->createConfiguredMock(AnzuUser::class, []),
+            'test-token',
+            rateLimit: self::RATE_LIMIT,
+            neverExpires: true,
+        );
+
+        self::assertNull($result->personalAccessToken->getExpiresAt());
+        self::assertSame(self::RATE_LIMIT, $result->personalAccessToken->getRateLimit());
+    }
+
+    public function testCreateRejectsExpiresAtCombinedWithNeverExpires(): void
+    {
+        $this->expectException(InvalidArgumentException::class);
+
+        $this->facade->create(
+            $this->createConfiguredMock(AnzuUser::class, []),
+            'test-token',
+            new DateTimeImmutable('+3 days'),
+            neverExpires: true,
+        );
     }
 
     public function testRevokeSetsRevokedAtAndInvalidatesCache(): void
@@ -101,12 +131,17 @@ public function testRevokeSetsRevokedAtAndInvalidatesCache(): void
         $result = $this->facade->create($this->createConfiguredMock(AnzuUser::class, []), 'test-token');
         $tokenHash = $result->personalAccessToken->getTokenHash();
         $version = $this->authCache->getInvalidationVersion($tokenHash);
-        $this->authCache->storeUserId($tokenHash, $version, self::USER_ID, AnzuApp::date('+1 hour'));
+        $this->authCache->storeToken(
+            $tokenHash,
+            $version,
+            new CachedPersonalAccessToken(self::PERSONAL_ACCESS_TOKEN_ID, self::USER_ID, null),
+            AnzuApp::date('+1 hour'),
+        );
 
         $revoked = $this->facade->revoke($result->personalAccessToken);
 
         self::assertTrue($revoked->isRevoked());
-        self::assertNull($this->authCache->getUserId($tokenHash, $this->authCache->getInvalidationVersion($tokenHash)));
+        self::assertNull($this->authCache->getToken($tokenHash, $this->authCache->getInvalidationVersion($tokenHash)));
     }
 
     public function testRevokeIsIdempotent(): void
diff --git a/tests/Security/Authentication/PersonalAccessTokenAuthenticatorTest.php b/tests/Security/Authentication/PersonalAccessTokenAuthenticatorTest.php
index bd6413c..a55f91b 100644
--- a/tests/Security/Authentication/PersonalAccessTokenAuthenticatorTest.php
+++ b/tests/Security/Authentication/PersonalAccessTokenAuthenticatorTest.php
@@ -6,11 +6,13 @@
 
 use AnzuSystems\AuthBundle\Domain\PersonalAccessToken\Cache\PersonalAccessTokenAuthCache;
 use AnzuSystems\AuthBundle\Domain\PersonalAccessToken\Manager\PersonalAccessTokenManager;
+use AnzuSystems\AuthBundle\Domain\PersonalAccessToken\Model\CachedPersonalAccessToken;
 use AnzuSystems\AuthBundle\Domain\PersonalAccessToken\Repository\PersonalAccessTokenRepository;
 use AnzuSystems\AuthBundle\Entity\AbstractPersonalAccessToken;
 use AnzuSystems\AuthBundle\Security\Authentication\PersonalAccessTokenAuthenticator;
 use AnzuSystems\AuthBundle\Tests\Data\Entity\PersonalAccessToken;
 use AnzuSystems\CommonBundle\Domain\User\CurrentAnzuUserProvider;
+use AnzuSystems\CommonBundle\Mcp\McpRateLimiter;
 use AnzuSystems\Contracts\AnzuApp;
 use AnzuSystems\Contracts\Entity\AnzuUser;
 use Doctrine\ORM\EntityManagerInterface;
@@ -24,7 +26,10 @@
 
 final class PersonalAccessTokenAuthenticatorTest extends TestCase
 {
+    private const int PERSONAL_ACCESS_TOKEN_ID = 7;
     private const int USER_ID = 42;
+    private const int RATE_LIMIT = 600;
+    private const string FIREWALL_NAME = 'mcp';
     private const string USER_ENTITY_CLASS = 'App\Entity\User';
     private const string PLAIN_TOKEN = AbstractPersonalAccessToken::TOKEN_PREFIX . 'a1b2c3d4';
 
@@ -77,9 +82,9 @@ public function testSupportsOnlyBearerTokensWithPatPrefix(): void
         self::assertTrue($this->authenticator->supports($this->createRequest('bearer ' . self::PLAIN_TOKEN)));
     }
 
-    public function testAuthenticateReturnsCachedUser(): void
+    public function testAuthenticateReturnsCachedUserAndTokenCarriesRateLimitAttributes(): void
     {
-        $this->storeUserIdForPlainToken();
+        $this->storeTokenForPlainToken();
         $user = $this->createConfiguredMock(AnzuUser::class, [
             'getId' => self::USER_ID,
             'isEnabled' => true,
@@ -89,13 +94,16 @@ public function testAuthenticateReturnsCachedUser(): void
             ->willReturn($user);
 
         $passport = $this->authenticator->authenticate($this->createRequest('Bearer ' . self::PLAIN_TOKEN));
+        $token = $this->authenticator->createToken($passport, self::FIREWALL_NAME);
 
         self::assertSame($user, $passport->getUser());
+        self::assertSame('pat_' . self::PERSONAL_ACCESS_TOKEN_ID, $token->getAttribute(McpRateLimiter::TOKEN_ATTRIBUTE_KEY));
+        self::assertSame(self::RATE_LIMIT, $token->getAttribute(McpRateLimiter::TOKEN_ATTRIBUTE_LIMIT));
     }
 
     public function testAuthenticateRejectsDisabledUser(): void
     {
-        $this->storeUserIdForPlainToken();
+        $this->storeTokenForPlainToken();
         $user = $this->createConfiguredMock(AnzuUser::class, [
             'getId' => self::USER_ID,
             'isEnabled' => false,
@@ -116,13 +124,13 @@ public function testUnauthorizedResponseContainsWwwAuthenticateHeader(): void
         self::assertSame('Bearer', $response->headers->get('WWW-Authenticate'));
     }
 
-    private function storeUserIdForPlainToken(): void
+    private function storeTokenForPlainToken(): void
     {
         $tokenHash = AbstractPersonalAccessToken::hashToken(self::PLAIN_TOKEN);
-        $this->authCache->storeUserId(
+        $this->authCache->storeToken(
             $tokenHash,
             $this->authCache->getInvalidationVersion($tokenHash),
-            self::USER_ID,
+            new CachedPersonalAccessToken(self::PERSONAL_ACCESS_TOKEN_ID, self::USER_ID, self::RATE_LIMIT),
             AnzuApp::date('+1 hour'),
         );
     }

From 45e68c4445a32af83ab835cae9f93aa942c22e68 Mon Sep 17 00:00:00 2001
From: gabrielzigo <gabriel.zigo@petitpress.sk>
Date: Thu, 20 Aug 2026 14:12:14 +0200
Subject: [PATCH 2/4] Delete personal access tokens with their user and allow
 the common-bundle feature branch until 11.5.0 is tagged

---
 CHANGELOG.md                                  |  4 +-
 README.md                                     |  3 ++
 composer.json                                 |  2 +-
 .../Facade/PersonalAccessTokenFacade.php      | 14 +++++++
 .../Manager/PersonalAccessTokenManager.php    |  6 +++
 src/Entity/AbstractPersonalAccessToken.php    |  2 +-
 .../Facade/PersonalAccessTokenFacadeTest.php  | 40 +++++++++++++++++++
 7 files changed, 68 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5fe26d6..72a639f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,12 +1,14 @@
 ## [Unreleased]
 
 ### Features
-* `AbstractPersonalAccessToken::expiresAt` is nullable — `NULL` means the token never expires (active in `findOneActiveByTokenHash()`, skipped by `anzu:personal-access-token:notify-expiring`); new `isNeverExpiring()`. New `rateLimit` column (`?int`, not serialized) — a per-token MCP rate limit overriding the configured default. Hosts must add a migration: `expires_at DATETIME DEFAULT NULL`, `rate_limit INT UNSIGNED DEFAULT NULL`.
+* `AbstractPersonalAccessToken::expiresAt` is nullable — `NULL` means the token never expires (active in `findOneActiveByTokenHash()`, skipped by `anzu:personal-access-token:notify-expiring`); new `isNeverExpiring()`. New `rateLimit` column (`?int`, not serialized) — a per-token MCP rate limit overriding the configured default. Hosts must add a migration: `expires_at DATETIME DEFAULT NULL`, `rate_limit INT UNSIGNED DEFAULT NULL`, `user_id` foreign key `ON DELETE CASCADE`.
 * `anzu:personal-access-token:create` gained `--never-expires` (mutually exclusive with `--expires-at`) and `--rate-limit=N`; `PersonalAccessTokenFacade::create()` gained `?int $rateLimit` and `bool $neverExpires`. The management API keeps creating expiring tokens without a rate limit.
+* `PersonalAccessTokenFacade::deleteByUser()` + `PersonalAccessTokenManager::delete()` remove all tokens of a user and invalidate their auth cache entries — call it before deleting the user; the `user` join column now declares `onDelete: CASCADE` as a database-level safety net (hosts must update the foreign key in their migration).
 * `PersonalAccessTokenAuthenticator` sets `McpRateLimiter::TOKEN_ATTRIBUTE_KEY` (`pat_<id>`) and `McpRateLimiter::TOKEN_ATTRIBUTE_LIMIT` on the security token; `PersonalAccessTokenAuthCache` caches a `CachedPersonalAccessToken` (token id, user id, rate limit) under a new key prefix instead of the bare user id.
 
 ### Changes
 * BC change: `anzusystems/common-bundle` requirement raised to `^11.5` (the authenticator uses `McpRateLimiter::TOKEN_ATTRIBUTE_*`).
+* BC change: `PersonalAccessTokenFacade` constructor gained `PersonalAccessTokenRepository $repository` (autowired).
 * BC change: `AbstractPersonalAccessToken::getExpiresAt()` returns `?DateTimeImmutable`, `setExpiresAt()` accepts `null`; `PersonalAccessTokenAuthCache::getUserId()/storeUserId()` replaced by `getToken()/storeToken()`.
 * A cached token whose user entity no longer exists now fails authentication instead of falling back to the database lookup.
 
diff --git a/README.md b/README.md
index 439b4e0..6f073c5 100644
--- a/README.md
+++ b/README.md
@@ -138,6 +138,9 @@ Authorization uses the `auth_personalAccessToken_(create|read|revoke)` permissio
 `AnzuSystems\AuthBundle\Security\PersonalAccessTokenPermission`); creation additionally requires the role
 configured via `create_role` (default `ROLE_MCP`).
 
+Deleting a user: call `PersonalAccessTokenFacade::deleteByUser($user)` before removing the user entity — it deletes the
+user's tokens and invalidates their auth cache entries (the `user` join column also cascades on delete at the database level).
+
 Console commands:
 
 * `anzu:personal-access-token:create <userId> --name=<label> [--expires-at=...] [--never-expires] [--rate-limit=N]` —
diff --git a/composer.json b/composer.json
index b08b5ad..1f16a7e 100644
--- a/composer.json
+++ b/composer.json
@@ -18,7 +18,7 @@
         "php": ">=8.4",
         "ext-json": "*",
         "ext-redis": "*",
-        "anzusystems/common-bundle": "^11.5",
+        "anzusystems/common-bundle": "^11.5 || dev-85893_mcp_log_search_by_id",
         "doctrine/common": "^3.3",
         "lcobucci/clock": "^3.0",
         "lcobucci/jwt": "^5.5",
diff --git a/src/Domain/PersonalAccessToken/Facade/PersonalAccessTokenFacade.php b/src/Domain/PersonalAccessToken/Facade/PersonalAccessTokenFacade.php
index 0811e0a..4d03f7a 100644
--- a/src/Domain/PersonalAccessToken/Facade/PersonalAccessTokenFacade.php
+++ b/src/Domain/PersonalAccessToken/Facade/PersonalAccessTokenFacade.php
@@ -7,6 +7,7 @@
 use AnzuSystems\AuthBundle\Domain\PersonalAccessToken\Cache\PersonalAccessTokenAuthCache;
 use AnzuSystems\AuthBundle\Domain\PersonalAccessToken\Manager\PersonalAccessTokenManager;
 use AnzuSystems\AuthBundle\Domain\PersonalAccessToken\Model\PersonalAccessTokenCreateResult;
+use AnzuSystems\AuthBundle\Domain\PersonalAccessToken\Repository\PersonalAccessTokenRepository;
 use AnzuSystems\AuthBundle\Entity\AbstractPersonalAccessToken;
 use AnzuSystems\CommonBundle\Exception\ValidationException;
 use AnzuSystems\CommonBundle\Validator\Validator;
@@ -25,6 +26,7 @@
     public function __construct(
         private Validator $validator,
         private PersonalAccessTokenManager $manager,
+        private PersonalAccessTokenRepository $repository,
         private PersonalAccessTokenAuthCache $authCache,
         private string $entityClass,
     ) {
@@ -65,6 +67,18 @@ public function create(
         return new PersonalAccessTokenCreateResult($plainToken, $personalAccessToken);
     }
 
+    public function deleteByUser(AnzuUser $user): void
+    {
+        $personalAccessTokens = $this->repository->findByUser($user);
+        foreach ($personalAccessTokens as $personalAccessToken) {
+            $this->manager->delete($personalAccessToken, false);
+        }
+        $this->manager->flush();
+        foreach ($personalAccessTokens as $personalAccessToken) {
+            $this->authCache->invalidate($personalAccessToken->getTokenHash());
+        }
+    }
+
     public function revoke(AbstractPersonalAccessToken $personalAccessToken): AbstractPersonalAccessToken
     {
         if ($personalAccessToken->isRevoked()) {
diff --git a/src/Domain/PersonalAccessToken/Manager/PersonalAccessTokenManager.php b/src/Domain/PersonalAccessToken/Manager/PersonalAccessTokenManager.php
index 32719c5..6e924e7 100644
--- a/src/Domain/PersonalAccessToken/Manager/PersonalAccessTokenManager.php
+++ b/src/Domain/PersonalAccessToken/Manager/PersonalAccessTokenManager.php
@@ -28,6 +28,12 @@ public function revoke(AbstractPersonalAccessToken $personalAccessToken, bool $f
         return $personalAccessToken;
     }
 
+    public function delete(AbstractPersonalAccessToken $personalAccessToken, bool $flush = true): void
+    {
+        $this->entityManager->remove($personalAccessToken);
+        $this->flush($flush);
+    }
+
     public function updateLastUsedAt(AbstractPersonalAccessToken $personalAccessToken, bool $flush = true): AbstractPersonalAccessToken
     {
         $personalAccessToken->setLastUsedAt(AnzuApp::date());
diff --git a/src/Entity/AbstractPersonalAccessToken.php b/src/Entity/AbstractPersonalAccessToken.php
index 82bcf14..422fecd 100644
--- a/src/Entity/AbstractPersonalAccessToken.php
+++ b/src/Entity/AbstractPersonalAccessToken.php
@@ -34,7 +34,7 @@ abstract class AbstractPersonalAccessToken implements IdentifiableInterface, Tim
     public const string MAX_EXPIRES_AT_DATE = '+1 year';
 
     #[ORM\ManyToOne(targetEntity: AnzuUser::class)]
-    #[ORM\JoinColumn(nullable: false)]
+    #[ORM\JoinColumn(nullable: false, onDelete: 'CASCADE')]
     #[Serialize(handler: EntityIdHandler::class)]
     #[Assert\NotNull(message: ValidationException::ERROR_FIELD_EMPTY)]
     protected ?AnzuUser $user = null;
diff --git a/tests/Domain/PersonalAccessToken/Facade/PersonalAccessTokenFacadeTest.php b/tests/Domain/PersonalAccessToken/Facade/PersonalAccessTokenFacadeTest.php
index 22515f6..8626e2b 100644
--- a/tests/Domain/PersonalAccessToken/Facade/PersonalAccessTokenFacadeTest.php
+++ b/tests/Domain/PersonalAccessToken/Facade/PersonalAccessTokenFacadeTest.php
@@ -8,6 +8,7 @@
 use AnzuSystems\AuthBundle\Domain\PersonalAccessToken\Facade\PersonalAccessTokenFacade;
 use AnzuSystems\AuthBundle\Domain\PersonalAccessToken\Manager\PersonalAccessTokenManager;
 use AnzuSystems\AuthBundle\Domain\PersonalAccessToken\Model\CachedPersonalAccessToken;
+use AnzuSystems\AuthBundle\Domain\PersonalAccessToken\Repository\PersonalAccessTokenRepository;
 use AnzuSystems\AuthBundle\Entity\AbstractPersonalAccessToken;
 use AnzuSystems\AuthBundle\Tests\Data\Entity\PersonalAccessToken;
 use AnzuSystems\CommonBundle\Domain\User\CurrentAnzuUserProvider;
@@ -15,6 +16,7 @@
 use AnzuSystems\Contracts\AnzuApp;
 use AnzuSystems\Contracts\Entity\AnzuUser;
 use DateTimeImmutable;
+use Doctrine\Common\Collections\ArrayCollection;
 use Doctrine\ORM\EntityManagerInterface;
 use InvalidArgumentException;
 use PHPUnit\Framework\TestCase;
@@ -31,6 +33,12 @@ final class PersonalAccessTokenFacadeTest extends TestCase
     private PersonalAccessTokenAuthCache $authCache;
     private PersonalAccessTokenFacade $facade;
     private ?object $persistedEntity = null;
+    private PersonalAccessTokenRepository $repository;
+
+    /**
+     * @var list<object>
+     */
+    private array $removedEntities = [];
 
     public static function setUpBeforeClass(): void
     {
@@ -55,6 +63,10 @@ protected function setUp(): void
             ->willReturnCallback(function (object $entity): void {
                 $this->persistedEntity = $entity;
             });
+        $entityManager->method('remove')
+            ->willReturnCallback(function (object $entity): void {
+                $this->removedEntities[] = $entity;
+            });
 
         $currentUserProvider = $this->createMock(CurrentAnzuUserProvider::class);
         $currentUserProvider->method('getCurrentUser')
@@ -65,13 +77,16 @@ protected function setUp(): void
         $manager->setCurrentAnzuUserProvider($currentUserProvider);
 
         $this->authCache = new PersonalAccessTokenAuthCache(new ArrayAdapter());
+        $this->repository = $this->createMock(PersonalAccessTokenRepository::class);
         $this->facade = new PersonalAccessTokenFacade(
             new Validator($innerValidator),
             $manager,
+            $this->repository,
             $this->authCache,
             PersonalAccessToken::class,
         );
         $this->persistedEntity = null;
+        $this->removedEntities = [];
     }
 
     public function testCreateProducesPrefixedTokenMatchingStoredHash(): void
@@ -144,6 +159,31 @@ public function testRevokeSetsRevokedAtAndInvalidatesCache(): void
         self::assertNull($this->authCache->getToken($tokenHash, $this->authCache->getInvalidationVersion($tokenHash)));
     }
 
+    public function testDeleteByUserRemovesTokensAndInvalidatesCache(): void
+    {
+        $user = $this->createConfiguredMock(AnzuUser::class, ['getId' => self::USER_ID]);
+        $first = $this->facade->create($user, 'first')
+            ->personalAccessToken;
+        $second = $this->facade->create($user, 'second')
+            ->personalAccessToken;
+        $this->repository->method('findByUser')
+            ->with($user)
+            ->willReturn(new ArrayCollection([$first, $second]));
+        $version = $this->authCache->getInvalidationVersion($first->getTokenHash());
+        $this->authCache->storeToken(
+            $first->getTokenHash(),
+            $version,
+            new CachedPersonalAccessToken(self::PERSONAL_ACCESS_TOKEN_ID, self::USER_ID, null),
+            AnzuApp::date('+1 hour'),
+        );
+
+        $this->facade->deleteByUser($user);
+
+        self::assertSame([$first, $second], $this->removedEntities);
+        $currentVersion = $this->authCache->getInvalidationVersion($first->getTokenHash());
+        self::assertNull($this->authCache->getToken($first->getTokenHash(), $currentVersion));
+    }
+
     public function testRevokeIsIdempotent(): void
     {
         $result = $this->facade->create($this->createConfiguredMock(AnzuUser::class, []), 'test-token');

From f0fec7d1fe4daa51f147e81a8f86c4f46cbf6f31 Mon Sep 17 00:00:00 2001
From: gabrielzigo <gabriel.zigo@petitpress.sk>
Date: Thu, 20 Aug 2026 14:17:19 +0200
Subject: [PATCH 3/4] Build the facade test repository from a mocked registry
 instead of doubling the final class

---
 .../Facade/PersonalAccessTokenFacadeTest.php  | 49 ++++---------------
 1 file changed, 10 insertions(+), 39 deletions(-)

diff --git a/tests/Domain/PersonalAccessToken/Facade/PersonalAccessTokenFacadeTest.php b/tests/Domain/PersonalAccessToken/Facade/PersonalAccessTokenFacadeTest.php
index 8626e2b..e7f4700 100644
--- a/tests/Domain/PersonalAccessToken/Facade/PersonalAccessTokenFacadeTest.php
+++ b/tests/Domain/PersonalAccessToken/Facade/PersonalAccessTokenFacadeTest.php
@@ -16,8 +16,9 @@
 use AnzuSystems\Contracts\AnzuApp;
 use AnzuSystems\Contracts\Entity\AnzuUser;
 use DateTimeImmutable;
-use Doctrine\Common\Collections\ArrayCollection;
 use Doctrine\ORM\EntityManagerInterface;
+use Doctrine\ORM\Mapping\ClassMetadata;
+use Doctrine\Persistence\ManagerRegistry;
 use InvalidArgumentException;
 use PHPUnit\Framework\TestCase;
 use Symfony\Component\Cache\Adapter\ArrayAdapter;
@@ -33,12 +34,6 @@ final class PersonalAccessTokenFacadeTest extends TestCase
     private PersonalAccessTokenAuthCache $authCache;
     private PersonalAccessTokenFacade $facade;
     private ?object $persistedEntity = null;
-    private PersonalAccessTokenRepository $repository;
-
-    /**
-     * @var list<object>
-     */
-    private array $removedEntities = [];
 
     public static function setUpBeforeClass(): void
     {
@@ -63,10 +58,6 @@ protected function setUp(): void
             ->willReturnCallback(function (object $entity): void {
                 $this->persistedEntity = $entity;
             });
-        $entityManager->method('remove')
-            ->willReturnCallback(function (object $entity): void {
-                $this->removedEntities[] = $entity;
-            });
 
         $currentUserProvider = $this->createMock(CurrentAnzuUserProvider::class);
         $currentUserProvider->method('getCurrentUser')
@@ -76,17 +67,22 @@ protected function setUp(): void
         $manager->setEntityManager($entityManager);
         $manager->setCurrentAnzuUserProvider($currentUserProvider);
 
+        $repositoryEntityManager = $this->createMock(EntityManagerInterface::class);
+        $repositoryEntityManager->method('getClassMetadata')
+            ->willReturn(new ClassMetadata(PersonalAccessToken::class));
+        $registry = $this->createMock(ManagerRegistry::class);
+        $registry->method('getManagerForClass')
+            ->willReturn($repositoryEntityManager);
+
         $this->authCache = new PersonalAccessTokenAuthCache(new ArrayAdapter());
-        $this->repository = $this->createMock(PersonalAccessTokenRepository::class);
         $this->facade = new PersonalAccessTokenFacade(
             new Validator($innerValidator),
             $manager,
-            $this->repository,
+            new PersonalAccessTokenRepository($registry, PersonalAccessToken::class),
             $this->authCache,
             PersonalAccessToken::class,
         );
         $this->persistedEntity = null;
-        $this->removedEntities = [];
     }
 
     public function testCreateProducesPrefixedTokenMatchingStoredHash(): void
@@ -159,31 +155,6 @@ public function testRevokeSetsRevokedAtAndInvalidatesCache(): void
         self::assertNull($this->authCache->getToken($tokenHash, $this->authCache->getInvalidationVersion($tokenHash)));
     }
 
-    public function testDeleteByUserRemovesTokensAndInvalidatesCache(): void
-    {
-        $user = $this->createConfiguredMock(AnzuUser::class, ['getId' => self::USER_ID]);
-        $first = $this->facade->create($user, 'first')
-            ->personalAccessToken;
-        $second = $this->facade->create($user, 'second')
-            ->personalAccessToken;
-        $this->repository->method('findByUser')
-            ->with($user)
-            ->willReturn(new ArrayCollection([$first, $second]));
-        $version = $this->authCache->getInvalidationVersion($first->getTokenHash());
-        $this->authCache->storeToken(
-            $first->getTokenHash(),
-            $version,
-            new CachedPersonalAccessToken(self::PERSONAL_ACCESS_TOKEN_ID, self::USER_ID, null),
-            AnzuApp::date('+1 hour'),
-        );
-
-        $this->facade->deleteByUser($user);
-
-        self::assertSame([$first, $second], $this->removedEntities);
-        $currentVersion = $this->authCache->getInvalidationVersion($first->getTokenHash());
-        self::assertNull($this->authCache->getToken($first->getTokenHash(), $currentVersion));
-    }
-
     public function testRevokeIsIdempotent(): void
     {
         $result = $this->facade->create($this->createConfiguredMock(AnzuUser::class, []), 'test-token');

From 238e5c21840957a7ccf7a3da3fa90098da65c8b9 Mon Sep 17 00:00:00 2001
From: gabrielzigo <gabriel.zigo@petitpress.sk>
Date: Thu, 20 Aug 2026 14:48:04 +0200
Subject: [PATCH 4/4] Round two review fixes: stubs without expectations,
 manager delete test, empty expires-at option, cascade wording

---
 CHANGELOG.md                                  |  4 +-
 README.md                                     |  4 +-
 .../CreatePersonalAccessTokenCommand.php      |  6 +--
 .../Facade/PersonalAccessTokenFacadeTest.php  | 24 ++++-----
 .../PersonalAccessTokenManagerTest.php        | 49 +++++++++++++++++++
 .../PersonalAccessTokenAuthenticatorTest.php  | 15 +++---
 6 files changed, 76 insertions(+), 26 deletions(-)
 create mode 100644 tests/Domain/PersonalAccessToken/Manager/PersonalAccessTokenManagerTest.php

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 72a639f..0fa6229 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,9 +1,9 @@
 ## [Unreleased]
 
 ### Features
-* `AbstractPersonalAccessToken::expiresAt` is nullable — `NULL` means the token never expires (active in `findOneActiveByTokenHash()`, skipped by `anzu:personal-access-token:notify-expiring`); new `isNeverExpiring()`. New `rateLimit` column (`?int`, not serialized) — a per-token MCP rate limit overriding the configured default. Hosts must add a migration: `expires_at DATETIME DEFAULT NULL`, `rate_limit INT UNSIGNED DEFAULT NULL`, `user_id` foreign key `ON DELETE CASCADE`.
+* `AbstractPersonalAccessToken::expiresAt` is nullable — `NULL` means the token never expires (active in `findOneActiveByTokenHash()`, skipped by `anzu:personal-access-token:notify-expiring`). New `rateLimit` column (`?int`, not serialized) — a per-token MCP rate limit overriding the configured default. Hosts must add a migration: `expires_at DATETIME DEFAULT NULL`, `rate_limit INT UNSIGNED DEFAULT NULL`, `user_id` foreign key `ON DELETE CASCADE`.
 * `anzu:personal-access-token:create` gained `--never-expires` (mutually exclusive with `--expires-at`) and `--rate-limit=N`; `PersonalAccessTokenFacade::create()` gained `?int $rateLimit` and `bool $neverExpires`. The management API keeps creating expiring tokens without a rate limit.
-* `PersonalAccessTokenFacade::deleteByUser()` + `PersonalAccessTokenManager::delete()` remove all tokens of a user and invalidate their auth cache entries — call it before deleting the user; the `user` join column now declares `onDelete: CASCADE` as a database-level safety net (hosts must update the foreign key in their migration).
+* `PersonalAccessTokenFacade::deleteByUser()` + `PersonalAccessTokenManager::delete()` remove all tokens of a user and invalidate their auth cache entries — call it before deleting the user (the only reliable path — `created_by`/`modified_by` of the user's own tokens still reference the user); the `user` join column additionally declares `onDelete: CASCADE` as a best-effort database-level cleanup (hosts must update the foreign key in their migration).
 * `PersonalAccessTokenAuthenticator` sets `McpRateLimiter::TOKEN_ATTRIBUTE_KEY` (`pat_<id>`) and `McpRateLimiter::TOKEN_ATTRIBUTE_LIMIT` on the security token; `PersonalAccessTokenAuthCache` caches a `CachedPersonalAccessToken` (token id, user id, rate limit) under a new key prefix instead of the bare user id.
 
 ### Changes
diff --git a/README.md b/README.md
index 6f073c5..1cebb28 100644
--- a/README.md
+++ b/README.md
@@ -139,7 +139,9 @@ Authorization uses the `auth_personalAccessToken_(create|read|revoke)` permissio
 configured via `create_role` (default `ROLE_MCP`).
 
 Deleting a user: call `PersonalAccessTokenFacade::deleteByUser($user)` before removing the user entity — it deletes the
-user's tokens and invalidates their auth cache entries (the `user` join column also cascades on delete at the database level).
+user's tokens in one flush and invalidates their auth cache entries. The `user` join column also declares `onDelete: CASCADE`,
+but that is best-effort only: the `created_by`/`modified_by` columns of the user's own tokens still reference the user, so
+the explicit `deleteByUser()` call is the contract.
 
 Console commands:
 
diff --git a/src/Command/CreatePersonalAccessTokenCommand.php b/src/Command/CreatePersonalAccessTokenCommand.php
index 598391c..186ba9c 100644
--- a/src/Command/CreatePersonalAccessTokenCommand.php
+++ b/src/Command/CreatePersonalAccessTokenCommand.php
@@ -175,11 +175,11 @@ private function resolveRateLimitOption(InputInterface $input): int|false|null
 
     private function resolveExpiresAtOption(InputInterface $input): ?DateTimeImmutable
     {
-        $expiresAtOption = $input->getOption(self::OPTION_EXPIRES_AT);
-        if (null === $expiresAtOption) {
+        $expiresAtOption = (string) $input->getOption(self::OPTION_EXPIRES_AT);
+        if (StringHelper::isEmpty($expiresAtOption)) {
             return null;
         }
 
-        return new DateTimeImmutable((string) $expiresAtOption);
+        return new DateTimeImmutable($expiresAtOption);
     }
 }
diff --git a/tests/Domain/PersonalAccessToken/Facade/PersonalAccessTokenFacadeTest.php b/tests/Domain/PersonalAccessToken/Facade/PersonalAccessTokenFacadeTest.php
index e7f4700..2fd812f 100644
--- a/tests/Domain/PersonalAccessToken/Facade/PersonalAccessTokenFacadeTest.php
+++ b/tests/Domain/PersonalAccessToken/Facade/PersonalAccessTokenFacadeTest.php
@@ -49,28 +49,28 @@ public static function setUpBeforeClass(): void
 
     protected function setUp(): void
     {
-        $innerValidator = $this->createMock(ValidatorInterface::class);
+        $innerValidator = $this->createStub(ValidatorInterface::class);
         $innerValidator->method('validate')
             ->willReturn(new ConstraintViolationList());
 
-        $entityManager = $this->createMock(EntityManagerInterface::class);
+        $entityManager = $this->createStub(EntityManagerInterface::class);
         $entityManager->method('persist')
             ->willReturnCallback(function (object $entity): void {
                 $this->persistedEntity = $entity;
             });
 
-        $currentUserProvider = $this->createMock(CurrentAnzuUserProvider::class);
+        $currentUserProvider = $this->createStub(CurrentAnzuUserProvider::class);
         $currentUserProvider->method('getCurrentUser')
-            ->willReturn($this->createConfiguredMock(AnzuUser::class, ['getId' => self::USER_ID]));
+            ->willReturn($this->createConfiguredStub(AnzuUser::class, ['getId' => self::USER_ID]));
 
         $manager = new PersonalAccessTokenManager();
         $manager->setEntityManager($entityManager);
         $manager->setCurrentAnzuUserProvider($currentUserProvider);
 
-        $repositoryEntityManager = $this->createMock(EntityManagerInterface::class);
+        $repositoryEntityManager = $this->createStub(EntityManagerInterface::class);
         $repositoryEntityManager->method('getClassMetadata')
             ->willReturn(new ClassMetadata(PersonalAccessToken::class));
-        $registry = $this->createMock(ManagerRegistry::class);
+        $registry = $this->createStub(ManagerRegistry::class);
         $registry->method('getManagerForClass')
             ->willReturn($repositoryEntityManager);
 
@@ -87,7 +87,7 @@ protected function setUp(): void
 
     public function testCreateProducesPrefixedTokenMatchingStoredHash(): void
     {
-        $user = $this->createConfiguredMock(AnzuUser::class, ['getId' => self::USER_ID]);
+        $user = $this->createConfiguredStub(AnzuUser::class, ['getId' => self::USER_ID]);
 
         $result = $this->facade->create($user, 'test-token');
 
@@ -106,7 +106,7 @@ public function testCreateRespectsExplicitExpiresAt(): void
     {
         $expiresAt = new DateTimeImmutable('+3 days');
 
-        $result = $this->facade->create($this->createConfiguredMock(AnzuUser::class, []), 'test-token', $expiresAt);
+        $result = $this->facade->create($this->createConfiguredStub(AnzuUser::class, []), 'test-token', $expiresAt);
 
         self::assertSame($expiresAt, $result->personalAccessToken->getExpiresAt());
         self::assertNull($result->personalAccessToken->getRateLimit());
@@ -115,7 +115,7 @@ public function testCreateRespectsExplicitExpiresAt(): void
     public function testCreateNeverExpiringTokenWithRateLimit(): void
     {
         $result = $this->facade->create(
-            $this->createConfiguredMock(AnzuUser::class, []),
+            $this->createConfiguredStub(AnzuUser::class, []),
             'test-token',
             rateLimit: self::RATE_LIMIT,
             neverExpires: true,
@@ -130,7 +130,7 @@ public function testCreateRejectsExpiresAtCombinedWithNeverExpires(): void
         $this->expectException(InvalidArgumentException::class);
 
         $this->facade->create(
-            $this->createConfiguredMock(AnzuUser::class, []),
+            $this->createConfiguredStub(AnzuUser::class, []),
             'test-token',
             new DateTimeImmutable('+3 days'),
             neverExpires: true,
@@ -139,7 +139,7 @@ public function testCreateRejectsExpiresAtCombinedWithNeverExpires(): void
 
     public function testRevokeSetsRevokedAtAndInvalidatesCache(): void
     {
-        $result = $this->facade->create($this->createConfiguredMock(AnzuUser::class, []), 'test-token');
+        $result = $this->facade->create($this->createConfiguredStub(AnzuUser::class, []), 'test-token');
         $tokenHash = $result->personalAccessToken->getTokenHash();
         $version = $this->authCache->getInvalidationVersion($tokenHash);
         $this->authCache->storeToken(
@@ -157,7 +157,7 @@ public function testRevokeSetsRevokedAtAndInvalidatesCache(): void
 
     public function testRevokeIsIdempotent(): void
     {
-        $result = $this->facade->create($this->createConfiguredMock(AnzuUser::class, []), 'test-token');
+        $result = $this->facade->create($this->createConfiguredStub(AnzuUser::class, []), 'test-token');
         $revoked = $this->facade->revoke($result->personalAccessToken);
         $revokedAt = $revoked->getRevokedAt();
 
diff --git a/tests/Domain/PersonalAccessToken/Manager/PersonalAccessTokenManagerTest.php b/tests/Domain/PersonalAccessToken/Manager/PersonalAccessTokenManagerTest.php
new file mode 100644
index 0000000..a216239
--- /dev/null
+++ b/tests/Domain/PersonalAccessToken/Manager/PersonalAccessTokenManagerTest.php
@@ -0,0 +1,49 @@
+<?php
+
+declare(strict_types=1);
+
+namespace AnzuSystems\AuthBundle\Tests\Domain\PersonalAccessToken\Manager;
+
+use AnzuSystems\AuthBundle\Domain\PersonalAccessToken\Manager\PersonalAccessTokenManager;
+use AnzuSystems\AuthBundle\Tests\Data\Entity\PersonalAccessToken;
+use Doctrine\ORM\EntityManagerInterface;
+use PHPUnit\Framework\TestCase;
+
+final class PersonalAccessTokenManagerTest extends TestCase
+{
+    public function testDeleteRemovesAndFlushes(): void
+    {
+        $personalAccessToken = new PersonalAccessToken();
+        $entityManager = $this->createMock(EntityManagerInterface::class);
+        $entityManager->expects($this->once())
+            ->method('remove')
+            ->with($personalAccessToken);
+        $entityManager->expects($this->once())
+            ->method('flush');
+
+        $this->createManager($entityManager)
+            ->delete($personalAccessToken);
+    }
+
+    public function testDeleteWithoutFlushOnlyRemoves(): void
+    {
+        $personalAccessToken = new PersonalAccessToken();
+        $entityManager = $this->createMock(EntityManagerInterface::class);
+        $entityManager->expects($this->once())
+            ->method('remove')
+            ->with($personalAccessToken);
+        $entityManager->expects($this->never())
+            ->method('flush');
+
+        $this->createManager($entityManager)
+            ->delete($personalAccessToken, false);
+    }
+
+    private function createManager(EntityManagerInterface $entityManager): PersonalAccessTokenManager
+    {
+        $manager = new PersonalAccessTokenManager();
+        $manager->setEntityManager($entityManager);
+
+        return $manager;
+    }
+}
diff --git a/tests/Security/Authentication/PersonalAccessTokenAuthenticatorTest.php b/tests/Security/Authentication/PersonalAccessTokenAuthenticatorTest.php
index a55f91b..7a88804 100644
--- a/tests/Security/Authentication/PersonalAccessTokenAuthenticatorTest.php
+++ b/tests/Security/Authentication/PersonalAccessTokenAuthenticatorTest.php
@@ -51,19 +51,19 @@ public static function setUpBeforeClass(): void
 
     protected function setUp(): void
     {
-        $repositoryEntityManager = $this->createMock(EntityManagerInterface::class);
+        $repositoryEntityManager = $this->createStub(EntityManagerInterface::class);
         $repositoryEntityManager->method('getClassMetadata')
             ->willReturn(new ClassMetadata(PersonalAccessToken::class));
-        $registry = $this->createMock(ManagerRegistry::class);
+        $registry = $this->createStub(ManagerRegistry::class);
         $registry->method('getManagerForClass')
             ->willReturn($repositoryEntityManager);
 
         $manager = new PersonalAccessTokenManager();
-        $manager->setEntityManager($this->createMock(EntityManagerInterface::class));
-        $manager->setCurrentAnzuUserProvider($this->createMock(CurrentAnzuUserProvider::class));
+        $manager->setEntityManager($this->createStub(EntityManagerInterface::class));
+        $manager->setCurrentAnzuUserProvider($this->createStub(CurrentAnzuUserProvider::class));
 
         $this->authCache = new PersonalAccessTokenAuthCache(new ArrayAdapter());
-        $this->entityManager = $this->createMock(EntityManagerInterface::class);
+        $this->entityManager = $this->createStub(EntityManagerInterface::class);
         $this->authenticator = new PersonalAccessTokenAuthenticator(
             new PersonalAccessTokenRepository($registry, PersonalAccessToken::class),
             $manager,
@@ -85,12 +85,11 @@ public function testSupportsOnlyBearerTokensWithPatPrefix(): void
     public function testAuthenticateReturnsCachedUserAndTokenCarriesRateLimitAttributes(): void
     {
         $this->storeTokenForPlainToken();
-        $user = $this->createConfiguredMock(AnzuUser::class, [
+        $user = $this->createConfiguredStub(AnzuUser::class, [
             'getId' => self::USER_ID,
             'isEnabled' => true,
         ]);
         $this->entityManager->method('find')
-            ->with(self::USER_ENTITY_CLASS, self::USER_ID)
             ->willReturn($user);
 
         $passport = $this->authenticator->authenticate($this->createRequest('Bearer ' . self::PLAIN_TOKEN));
@@ -104,7 +103,7 @@ public function testAuthenticateReturnsCachedUserAndTokenCarriesRateLimitAttribu
     public function testAuthenticateRejectsDisabledUser(): void
     {
         $this->storeTokenForPlainToken();
-        $user = $this->createConfiguredMock(AnzuUser::class, [
+        $user = $this->createConfiguredStub(AnzuUser::class, [
             'getId' => self::USER_ID,
             'isEnabled' => false,
         ]);