[brandonkelly]

Summary

Craft 5.12 adds OAuth (MCP and authenticated GraphQL), with JWT access tokens signed by oauth-private.key. Craft 6 validates the same tokens with Laravel Passport (craftcms/cms#20154 keeps the token tables compatible). Passport only accepts them if it finds the same signing keys.

Craft 5.12 writes                    Passport reads
@storage/oauth-private.key           storage_path('oauth-private.key')
@storage/oauth-public.key            storage_path('oauth-public.key')

@storage = CRAFT_STORAGE_PATH ?? <project>/storage
storage_path() = <project>/storage   (bootstrap/app.php from this tool)

By default the two match, so nothing needs to move. When CRAFT_STORAGE_PATH points somewhere else, Craft 6 ignores it for storage_path(), so this PR adds a step:

• Moving OAuth signing keys: moves oauth-private.key and oauth-public.key from CRAFT_STORAGE_PATH into storage/ with mode 0600, which Passport's permission check requires. Existing files in storage/ are never overwritten.
• Next steps:
  • When the step moved keys, the tool reminds you to do the same in other environments, since the tool only runs locally.
  • When the project sets CRAFT_OAUTH_PRIVATE_KEY/CRAFT_OAUTH_PUBLIC_KEY or uses privateKey/publicKey in config/oauth.php, it suggests PASSPORT_PRIVATE_KEY/PASSPORT_PUBLIC_KEY. Craft 6 has no OAuth config of its own, and Passport expects the key contents, not a path. The tool doesn't rewrite these variables, because PEM values can span several lines in .env.

Evidence

• test_it_moves_oauth_keys_into_laravel_storage: a project with CRAFT_STORAGE_PATH=craft-storage and keys there ends up with storage/oauth-*.key (0600) and both Next Steps.
  • Before: with the step removed, this test fails (storage/oauth-private.key doesn't exist).
  • After: OK (3 tests, 62 assertions), and PHPStan reports no errors.
• The existing test now also asserts that a default project gets neither suggestion.