Jonny Barnes
d5706b5f8f
Tokens now store a hashed row in micropub_tokens instead of being self-contained signed JWTs, so a leaked or unwanted token can actually be revoked. Since revocation already requires a DB lookup on every request, JWT's stateless-verification benefit was gone anyway, so this also drops the lcobucci/jwt dependency entirely. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014625MfkGZ7GVdbqKme4a8L
40 lines
1,011 B
PHP
40 lines
1,011 B
PHP
<?php
|
|
|
|
namespace Tests;
|
|
|
|
use App\Services\TokenService;
|
|
|
|
trait TestToken
|
|
{
|
|
public function getToken(): string
|
|
{
|
|
return $this->app->make(TokenService::class)->getNewToken([
|
|
'client_id' => 'https://quill.p3k.io',
|
|
'me' => 'http://jonnybarnes.localhost',
|
|
'scope' => 'create update',
|
|
]);
|
|
}
|
|
|
|
public function getTokenWithIncorrectScope(): string
|
|
{
|
|
return $this->app->make(TokenService::class)->getNewToken([
|
|
'client_id' => 'https://quill.p3k.io',
|
|
'me' => 'https://jonnybarnes.localhost',
|
|
'scope' => 'view',
|
|
]);
|
|
}
|
|
|
|
public function getTokenWithNoScope(): string
|
|
{
|
|
return $this->app->make(TokenService::class)->getNewToken([
|
|
'client_id' => 'https://quill.p3k.io',
|
|
'me' => 'https://jonnybarnes.localhost',
|
|
'scope' => '',
|
|
]);
|
|
}
|
|
|
|
public function getInvalidToken(): string
|
|
{
|
|
return bin2hex(random_bytes(32));
|
|
}
|
|
}
|