jonny/jonnybarnes.uk
Watch
1
0
Fork
You've already forked jonnybarnes.uk
 0
Code Issues 9 Pull requests Projects Releases 25 Packages Wiki Activity Actions

Replace JWT Micropub tokens with revocable opaque tokens

Browse source 
Tokens now store a hashed row in micropub_tokens instead of being
self-contained signed JWTs, so a leaked or unwanted token can actually
be revoked. Since revocation already requires a DB lookup on every
request, JWT's stateless-verification benefit was gone anyway, so this
also drops the lcobucci/jwt dependency entirely.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014625MfkGZ7GVdbqKme4a8L
This commit is contained in:
Jonny Barnes 2026-08-13 16:07:07 +01:00
commit d5706b5f8f
Signed by: jonny
SSH key fingerprint: SHA256:CTuSlns5U7qlD9jqHvtnVmfYV3Zwl2Z7WnJ4/dqOaL8
10 changed files with 124 additions and 181 deletions
Download patch file Download diff file Expand all files Collapse all files

52
tests/TestToken.php
View file

@ -2,53 +2,39 @@
namespace Tests;
use DateTimeImmutable;
use Lcobucci\JWT\Configuration;
use App\Services\TokenService;
trait TestToken
{
public function getToken(): string
{
$config = $this->app->make(Configuration::class);
return $config->builder()
->issuedAt(new DateTimeImmutable)
->withClaim('client_id', 'https://quill.p3k.io')
->withClaim('me', 'http://jonnybarnes.localhost')
->withClaim('scope', ['create', 'update'])
->getToken($config->signer(), $config->signingKey())
->toString();
return $this->app->make(TokenService::class)->getNewToken([
'client_id' => 'https://quill.p3k.io',
'me' => 'http://jonnybarnes.localhost',
'scope' => 'create update',
]);
}
public function getTokenWithIncorrectScope(): string
{
$config = $this->app->make(Configuration::class);
return $config->builder()
->issuedAt(new DateTimeImmutable)
->withClaim('client_id', 'https://quill.p3k.io')
->withClaim('me', 'https://jonnybarnes.localhost')
->withClaim('scope', 'view')
->getToken($config->signer(), $config->signingKey())
->toString();
return $this->app->make(TokenService::class)->getNewToken([
'client_id' => 'https://quill.p3k.io',
'me' => 'https://jonnybarnes.localhost',
'scope' => 'view',
]);
}
public function getTokenWithNoScope()
public function getTokenWithNoScope(): string
{
$config = $this->app->make(Configuration::class);
return $config->builder()
->issuedAt(new DateTimeImmutable)
->withClaim('client_id', 'https://quill.p3k.io')
->withClaim('me', 'https://jonnybarnes.localhost')
->getToken($config->signer(), $config->signingKey())
->toString();
return $this->app->make(TokenService::class)->getNewToken([
'client_id' => 'https://quill.p3k.io',
'me' => 'https://jonnybarnes.localhost',
'scope' => '',
]);
}
public function getInvalidToken()
public function getInvalidToken(): string
{
$token = $this->getToken();
return substr($token, 0, -5);
return bin2hex(random_bytes(32));
}
}