Replace JWT Micropub tokens with revocable opaque tokens

Tokens now store a hashed row in micropub_tokens instead of being
self-contained signed JWTs, so a leaked or unwanted token can actually
be revoked. Since revocation already requires a DB lookup on every
request, JWT's stateless-verification benefit was gone anyway, so this
also drops the lcobucci/jwt dependency entirely.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014625MfkGZ7GVdbqKme4a8L

app/Http/Controllers/MicropubController.php

@@ -15,7 +15,6 @@ use App\Services\Micropub\MicropubHandlerRegistry;
 use Illuminate\Database\Eloquent\ModelNotFoundException;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
-use Lcobucci\JWT\Token;
 
 class MicropubController extends Controller
 {
@@ -135,7 +134,7 @@ class MicropubController extends Controller
         }
 
         // the default response is just to return the token data
-        /** @var Token $tokenData */
+        /** @var array $tokenData */
         $tokenData = $request->input('token_data');
 
         return response()->json([

app/Http/Middleware/VerifyMicropubToken.php

@@ -5,13 +5,9 @@ declare(strict_types=1);
 namespace App\Http\Middleware;
 
 use App\Http\Responses\MicropubResponses;
+use App\Models\MicropubToken;
 use Closure;
 use Illuminate\Http\Request;
-use Lcobucci\JWT\Configuration;
-use Lcobucci\JWT\Encoding\CannotDecodeContent;
-use Lcobucci\JWT\Token;
-use Lcobucci\JWT\Token\InvalidTokenStructure;
-use Lcobucci\JWT\Validation\RequiredConstraintsViolated;
 use Symfony\Component\HttpFoundation\Response;
 
 class VerifyMicropubToken
@@ -39,15 +35,17 @@ class VerifyMicropubToken
             ], 401);
         }
 
-        try {
-            $tokenData = $this->validateToken($rawToken);
-        } catch (RequiredConstraintsViolated|InvalidTokenStructure|CannotDecodeContent) {
+        $token = MicropubToken::where('token_hash', hash('sha256', $rawToken))
+            ->whereNull('revoked_at')
+            ->first();
+
+        if (! $token) {
             $micropubResponses = new MicropubResponses;
 
             return $micropubResponses->invalidTokenResponse();
         }
 
-        if ($tokenData->claims()->has('scope') === false) {
+        if ($token->scope === '') {
             $micropubResponses = new MicropubResponses;
 
             return $micropubResponses->tokenHasNoScopeResponse();
@@ -56,26 +54,10 @@ class VerifyMicropubToken
         return $next($request->merge([
             'access_token' => $rawToken,
             'token_data' => [
-                'me' => $tokenData->claims()->get('me'),
-                'scope' => $tokenData->claims()->get('scope'),
-                'client_id' => $tokenData->claims()->get('client_id'),
+                'me' => $token->me,
+                'scope' => $token->scope,
+                'client_id' => $token->client_id,
             ],
         ]));
     }
-
-    /**
-     * Check the token signature is valid.
-     */
-    private function validateToken(string $bearerToken): Token
-    {
-        $config = resolve(Configuration::class);
-
-        $token = $config->parser()->parse($bearerToken);
-
-        $constraints = $config->validationConstraints();
-
-        $config->validator()->assert($token, ...$constraints);
-
-        return $token;
-    }
 }