fix: connections only manageable for users the admin may edit

src/Admin/ConnectionRepository.php

@@ -87,9 +87,17 @@ class ConnectionRepository
         return \WP_Application_Passwords::delete_application_password($userId, $uuid) === true;
     }
 
-    /** Whether the current administrator may see and revoke this user's connections. */
+    /**
+     * Whether the current administrator may see and revoke this user's connections: only for
+     * users they may edit (edit_user, as for application passwords in the profile), and on
+     * multisite only members of this site, super admins only for other super admins.
+     */
     private function manageable(int $userId): bool
     {
+        if (! current_user_can('edit_user', $userId)) {
+            return false;
+        }
+
         if (! is_multisite()) {
             return true;
         }

tests/Unit/Admin/ConnectionRepositoryTest.php

@@ -29,6 +29,7 @@ final class ConnectionRepositoryTest extends TestCase
             ],
         ];
         Functions\when('is_multisite')->justReturn(false);
+        Functions\when('current_user_can')->justReturn(true);
         Functions\when('get_userdata')->alias(
             static fn (int $id): object => (object) ['user_login' => 'user' . $id]
         );
@@ -145,4 +146,21 @@ final class ConnectionRepositoryTest extends TestCase
         self::assertArrayHasKey('uuid-5', WP_Application_Passwords::$items[5]);
         self::assertTrue($repository->revoke(3, 'uuid-1'));
     }
+
+    public function testListsAndRevokesOnlyConnectionsOfUsersTheAdminMayEdit(): void
+    {
+        Functions\when('current_user_can')->alias(
+            static fn (string $cap, ...$args): bool => ! ($cap === 'edit_user' && $args === [4])
+        );
+        $db = $this->db([
+            ['3', 'mcp_refresh_jti_uuid-1'],
+            ['4', 'mcp_refresh_jti_uuid-4'],
+        ]);
+        $repository = new ConnectionRepository($db);
+
+        self::assertSame(['uuid-1'], array_column($repository->all(), 'uuid'));
+        self::assertFalse($repository->revoke(4, 'uuid-4'));
+        self::assertArrayHasKey('uuid-4', WP_Application_Passwords::$items[4]);
+        self::assertTrue($repository->revoke(3, 'uuid-1'));
+    }
 }