From 8d0979cb73832a475f2e9c3c0c9cb09411dbda36 Mon Sep 17 00:00:00 2001
From: Jan-Niclas Loosen <janniclas@loosen-it.de>
Date: Sat, 26 Sep 2026 05:05:27 +0200
Subject: [PATCH] fix: connections only manageable for users the admin may edit

---
 src/Admin/ConnectionRepository.php            | 10 +++++++++-
 tests/Unit/Admin/ConnectionRepositoryTest.php | 18 ++++++++++++++++++
 2 files changed, 27 insertions(+), 1 deletion(-)

diff --git a/src/Admin/ConnectionRepository.php b/src/Admin/ConnectionRepository.php
index 1bb1dff..8cd39ea 100644
--- a/src/Admin/ConnectionRepository.php
+++ b/src/Admin/ConnectionRepository.php
@@ -87,9 +87,17 @@ class ConnectionRepository
         return \WP_Application_Passwords::delete_application_password($userId, $uuid) === true;
     }
 
-    /** Whether the current administrator may see and revoke this user's connections. */
+    /**
+     * Whether the current administrator may see and revoke this user's connections: only for
+     * users they may edit (edit_user, as for application passwords in the profile), and on
+     * multisite only members of this site, super admins only for other super admins.
+     */
     private function manageable(int $userId): bool
     {
+        if (! current_user_can('edit_user', $userId)) {
+            return false;
+        }
+
         if (! is_multisite()) {
             return true;
         }
diff --git a/tests/Unit/Admin/ConnectionRepositoryTest.php b/tests/Unit/Admin/ConnectionRepositoryTest.php
index 49718d2..99ac544 100644
--- a/tests/Unit/Admin/ConnectionRepositoryTest.php
+++ b/tests/Unit/Admin/ConnectionRepositoryTest.php
@@ -29,6 +29,7 @@ final class ConnectionRepositoryTest extends TestCase
             ],
         ];
         Functions\when('is_multisite')->justReturn(false);
+        Functions\when('current_user_can')->justReturn(true);
         Functions\when('get_userdata')->alias(
             static fn (int $id): object => (object) ['user_login' => 'user' . $id]
         );
@@ -145,4 +146,21 @@ final class ConnectionRepositoryTest extends TestCase
         self::assertArrayHasKey('uuid-5', WP_Application_Passwords::$items[5]);
         self::assertTrue($repository->revoke(3, 'uuid-1'));
     }
+
+    public function testListsAndRevokesOnlyConnectionsOfUsersTheAdminMayEdit(): void
+    {
+        Functions\when('current_user_can')->alias(
+            static fn (string $cap, ...$args): bool => ! ($cap === 'edit_user' && $args === [4])
+        );
+        $db = $this->db([
+            ['3', 'mcp_refresh_jti_uuid-1'],
+            ['4', 'mcp_refresh_jti_uuid-4'],
+        ]);
+        $repository = new ConnectionRepository($db);
+
+        self::assertSame(['uuid-1'], array_column($repository->all(), 'uuid'));
+        self::assertFalse($repository->revoke(4, 'uuid-4'));
+        self::assertArrayHasKey('uuid-4', WP_Application_Passwords::$items[4]);
+        self::assertTrue($repository->revoke(3, 'uuid-1'));
+    }
 }