Initial commit: OAuth IAM Laravel application

Laravel-based OAuth/IAM service with Passport, Vue 3 frontend, and
Docker Compose setup for local and production deployment.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

app/Http/Controllers/OAuth/AuthorizedAppController.php

@@ -0,0 +1,36 @@
+<?php
+
+namespace App\Http\Controllers\OAuth;
+
+use App\Http\Controllers\Controller;
+use Illuminate\Http\Request;
+
+class AuthorizedAppController extends Controller
+{
+    /**
+     * List third-party apps (non first-party clients) the user has granted access to.
+     */
+    public function index(Request $request)
+    {
+        $tokens = $request->user()->tokens()
+            ->where('revoked', false)
+            ->with('client')
+            ->get()
+            ->reject(fn ($token) => $token->client->revoked || $token->client->hasGrantType('personal_access'))
+            ->values();
+
+        return response()->json($tokens);
+    }
+
+    public function destroy(Request $request, string $tokenId)
+    {
+        $token = $request->user()->tokens()->where('id', $tokenId)->first();
+
+        abort_unless($token, 404);
+
+        $token->revoke();
+        $token->refreshToken?->revoke();
+
+        return response()->noContent();
+    }
+}

app/Http/Controllers/OAuth/ClientController.php

@@ -0,0 +1,97 @@
+<?php
+
+namespace App\Http\Controllers\OAuth;
+
+use App\Http\Controllers\Controller;
+use Illuminate\Http\Request;
+use Illuminate\Support\Str;
+use Illuminate\Validation\Rule;
+use Laravel\Passport\Client;
+
+class ClientController extends Controller
+{
+    /**
+     * List the OAuth clients owned by the authenticated user.
+     */
+    public function index(Request $request)
+    {
+        return response()->json(
+            $request->user()->oauthApps()->where('revoked', false)->orderByDesc('created_at')->get()
+        );
+    }
+
+    /**
+     * Create a new OAuth client (authorization_code+PKCE, client_credentials or password).
+     */
+    public function store(Request $request)
+    {
+        $data = $request->validate([
+            'name' => ['required', 'string', 'max:255'],
+            'grant_type' => ['required', Rule::in(['authorization_code', 'client_credentials', 'password'])],
+            'redirect_uris' => ['required_if:grant_type,authorization_code', 'array'],
+            'redirect_uris.*' => ['url'],
+            'confidential' => ['boolean'],
+        ]);
+
+        $confidential = $request->boolean('confidential', true);
+
+        $grantTypes = match ($data['grant_type']) {
+            'authorization_code' => ['authorization_code', 'refresh_token'],
+            'password' => ['password', 'refresh_token'],
+            'client_credentials' => ['client_credentials'],
+        };
+
+        // client_credentials always needs a secret: there is no user present to prove identity.
+        if ($data['grant_type'] === 'client_credentials') {
+            $confidential = true;
+        }
+
+        $client = $request->user()->oauthApps()->create([
+            'name' => $data['name'],
+            'secret' => $confidential ? Str::random(40) : null,
+            'provider' => null,
+            'redirect_uris' => $data['redirect_uris'] ?? [],
+            'grant_types' => $grantTypes,
+            'revoked' => false,
+        ]);
+
+        return response()->json([
+            'client' => $client,
+            'plain_secret' => $client->plainSecret,
+        ], 201);
+    }
+
+    /**
+     * Update an existing client's name/redirect URIs.
+     */
+    public function update(Request $request, Client $client)
+    {
+        abort_unless($client->owner_id === $request->user()->id, 404);
+
+        $data = $request->validate([
+            'name' => ['required', 'string', 'max:255'],
+            'redirect_uris' => ['array'],
+            'redirect_uris.*' => ['url'],
+        ]);
+
+        $client->update([
+            'name' => $data['name'],
+            'redirect_uris' => $data['redirect_uris'] ?? $client->redirect_uris,
+        ]);
+
+        return response()->json($client);
+    }
+
+    /**
+     * Revoke (soft-delete) a client and its tokens.
+     */
+    public function destroy(Request $request, Client $client)
+    {
+        abort_unless($client->owner_id === $request->user()->id, 404);
+
+        $client->update(['revoked' => true]);
+        $client->tokens()->update(['revoked' => true]);
+
+        return response()->noContent();
+    }
+}

app/Http/Controllers/OAuth/PersonalAccessTokenController.php

@@ -0,0 +1,51 @@
+<?php
+
+namespace App\Http\Controllers\OAuth;
+
+use App\Http\Controllers\Controller;
+use Illuminate\Http\Request;
+use Illuminate\Validation\Rule;
+use Laravel\Passport\Passport;
+use Laravel\Passport\Token;
+
+class PersonalAccessTokenController extends Controller
+{
+    public function index(Request $request)
+    {
+        return response()->json(
+            $request->user()->tokens()
+                ->where('revoked', false)
+                ->whereHas('client', fn ($q) => $q->whereJsonContains('grant_types', 'personal_access'))
+                ->orderByDesc('created_at')
+                ->get(['id', 'name', 'scopes', 'created_at', 'expires_at'])
+        );
+    }
+
+    public function store(Request $request)
+    {
+        $data = $request->validate([
+            'name' => ['required', 'string', 'max:255'],
+            'scopes' => ['array'],
+            'scopes.*' => [Rule::in(Passport::scopeIds())],
+        ]);
+
+        $result = $request->user()->createToken($data['name'], $data['scopes'] ?? []);
+
+        return response()->json([
+            'access_token' => $result->accessToken,
+            'token' => $result->token,
+        ], 201);
+    }
+
+    public function destroy(Request $request, string $tokenId)
+    {
+        /** @var Token|null $token */
+        $token = $request->user()->tokens()->where('id', $tokenId)->first();
+
+        abort_unless($token, 404);
+
+        $token->revoke();
+
+        return response()->noContent();
+    }
+}