Jonny Barnes
d5706b5f8f
Tokens now store a hashed row in micropub_tokens instead of being self-contained signed JWTs, so a leaked or unwanted token can actually be revoked. Since revocation already requires a DB lookup on every request, JWT's stateless-verification benefit was gone anyway, so this also drops the lcobucci/jwt dependency entirely. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014625MfkGZ7GVdbqKme4a8L
34 lines
755 B
PHP
34 lines
755 B
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace App\Models;
|
|
|
|
use Illuminate\Database\Eloquent\Attributes\Fillable;
|
|
use Illuminate\Database\Eloquent\Attributes\Table;
|
|
use Illuminate\Database\Eloquent\Casts\Attribute;
|
|
use Illuminate\Database\Eloquent\Model;
|
|
|
|
#[Table('micropub_tokens')]
|
|
#[Fillable(['token_hash', 'client_id', 'me', 'scope'])]
|
|
class MicropubToken extends Model
|
|
{
|
|
protected function casts(): array
|
|
{
|
|
return [
|
|
'revoked_at' => 'datetime',
|
|
];
|
|
}
|
|
|
|
public function revoke(): void
|
|
{
|
|
$this->forceFill(['revoked_at' => now()])->save();
|
|
}
|
|
|
|
protected function isRevoked(): Attribute
|
|
{
|
|
return Attribute::make(
|
|
get: fn () => $this->revoked_at !== null,
|
|
);
|
|
}
|
|
}
|