pigui/oauth
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

new funcionality

Browse Source
This commit is contained in:
Josep
2026-07-27 17:20:02 +02:00
parent c2b5291a74
commit c5ce8a7a36
101 changed files with 6889 additions and 176 deletions
Download Patch File Download Diff File Expand all files Collapse all files

51
app/Http/Controllers/Api/ClientController.php
View File

@@ -3,7 +3,10 @@
namespace App\Http\Controllers\Api;
use App\Http\Controllers\Controller;
use App\Models\AuditLog;
use App\Models\User;
use App\Support\ClientSecretRotation;
use App\Support\TokenRevocation;
use Illuminate\Http\Request;
use Illuminate\Routing\Controllers\HasMiddleware;
use Illuminate\Routing\Controllers\Middleware;
@@ -30,7 +33,7 @@ class ClientController extends Controller implements HasMiddleware
{
return [
new Middleware(CheckToken::using('account:read'), only: ['index']),
new Middleware(CheckToken::using('account:write'), only: ['store', 'update', 'destroy']),
new Middleware(CheckToken::using('account:write'), only: ['store', 'update', 'destroy', 'rotateSecret']),
];
}
@@ -107,6 +110,11 @@ class ClientController extends Controller implements HasMiddleware
'revoked' => false,
]);
AuditLog::record($request, 'client.created', 'client', $client->id, $client->name, [
'grant_type' => $data['grant_type'],
'confidential' => $confidential,
]);
return response()->json([
'client' => $client,
'plain_secret' => $client->plainSecret,
@@ -142,6 +150,36 @@ class ClientController extends Controller implements HasMiddleware
return response()->json($client);
}
#[OA\Post(
path: '/clients/{client}/rotate-secret',
summary: 'Rotar el secret de un client confidencial (el anterior sigue valiendo por 48hs)',
description: 'El secret anterior no se corta al instante: sigue siendo válido durante un periodo de gracia (48hs), para no romper integraciones ya desplegadas que todavía no se actualizaron al secret nuevo.',
security: [['oauth2' => ['account:write']]],
tags: ['Account'],
parameters: [new OA\Parameter(name: 'client', in: 'path', required: true, schema: new OA\Schema(type: 'string'))],
responses: [
new OA\Response(response: 200, description: 'Secret rotado (incluye plain_secret una sola vez)'),
new OA\Response(response: 404, description: 'No es tuyo o no existe'),
new OA\Response(response: 422, description: 'El cliente no es confidencial (no tiene secret)'),
]
)]
public function rotateSecret(Request $request, Client $client)
{
abort_unless($client->owner_id === $this->requireUser($request)->id, 404);
abort_unless($client->confidential(), 422, __('messages.client_not_confidential'));
$plainSecret = ClientSecretRotation::rotate($client);
AuditLog::record($request, 'client.secret_rotated', 'client', $client->id, $client->name, [
'previous_secret_expires_at' => $client->previous_secret_expires_at,
]);
return response()->json([
'plain_secret' => $plainSecret,
'previous_secret_expires_at' => $client->previous_secret_expires_at,
]);
}
#[OA\Delete(
path: '/clients/{client}',
summary: 'Revocar uno de tus clientes OAuth (y sus tokens)',
@@ -157,8 +195,17 @@ class ClientController extends Controller implements HasMiddleware
{
abort_unless($client->owner_id === $this->requireUser($request)->id, 404);
$tokens = $client->tokens()->where('revoked', false)->get();
$client->update(['revoked' => true]);
$client->tokens()->update(['revoked' => true]);
foreach ($tokens as $token) {
TokenRevocation::revoke($token);
}
AuditLog::record($request, 'client.revoked', 'client', $client->id, $client->name, [
'tokens_revoked' => $tokens->count(),
]);
return response()->noContent();
}