[11.x] Fix scope inheritance when using Passport::actingAs() (#1551)

* Fix scope inheritance when using Passport::actingAs()

* Update Passport.php

Co-authored-by: Taylor Otwell <[email protected]>

Author: axlon

src/Passport.php

@@ -364,11 +364,9 @@ public static function ignoreCsrfToken($ignoreCsrfToken = true)
      */
     public static function actingAs($user, $scopes = [], $guard = 'api')
     {
-        $token = Mockery::mock(self::tokenModel())->shouldIgnoreMissing(false);
+        $token = app(self::tokenModel());
 
-        foreach ($scopes as $scope) {
-            $token->shouldReceive('can')->with($scope)->andReturn(true);
-        }
+        $token->scopes = $scopes;
 
         $user->withAccessToken($token);
 

tests/Feature/ActingAsTest.php

@@ -4,6 +4,7 @@
 
 use Illuminate\Contracts\Routing\Registrar;
 use Illuminate\Foundation\Auth\User;
+use Illuminate\Support\Facades\Route;
 use Laravel\Passport\HasApiTokens;
 use Laravel\Passport\Http\Middleware\CheckForAnyScope;
 use Laravel\Passport\Http\Middleware\CheckScopes;
@@ -64,6 +65,40 @@ public function testActingAsWhenTheRouteIsProtectedByCheckForAnyScopeMiddleware(
         $response->assertSuccessful();
         $response->assertSee('bar');
     }
+
+    public function testActingAsWhenTheRouteIsProtectedByCheckScopesMiddlewareWithInheritance()
+    {
+        Passport::$withInheritedScopes = true;
+
+        $this->withoutExceptionHandling();
+
+        Route::middleware(CheckScopes::class.':foo:bar,baz:qux')->get('/foo', function () {
+            return 'bar';
+        });
+
+        Passport::actingAs(new PassportUser(), ['foo', 'baz']);
+
+        $response = $this->get('/foo');
+        $response->assertSuccessful();
+        $response->assertSee('bar');
+    }
+
+    public function testActingAsWhenTheRouteIsProtectedByCheckForAnyScopeMiddlewareWithInheritance()
+    {
+        Passport::$withInheritedScopes = true;
+
+        $this->withoutExceptionHandling();
+
+        Route::middleware(CheckForAnyScope::class.':foo:baz,baz:qux')->get('/foo', function () {
+            return 'bar';
+        });
+
+        Passport::actingAs(new PassportUser(), ['foo']);
+
+        $response = $this->get('/foo');
+        $response->assertSuccessful();
+        $response->assertSee('bar');
+    }
 }
 
 class PassportUser extends User