new funcionality

2026-07-27 17:20:02 +02:00
parent c2b5291a74
commit c5ce8a7a36
101 changed files with 6889 additions and 176 deletions
--- a/app/Http/Controllers/Api/UserSessionController.php
+++ b/app/Http/Controllers/Api/UserSessionController.php
@@ -0,0 +1,98 @@
+<?php
+
+namespace App\Http\Controllers\Api;
+
+use App\Http\Controllers\Controller;
+use App\Models\AuditLog;
+use App\Models\User;
+use App\Support\UserSessions;
+use Illuminate\Http\Request;
+use Illuminate\Routing\Controllers\HasMiddleware;
+use Illuminate\Routing\Controllers\Middleware;
+use Laravel\Passport\Http\Middleware\CheckToken;
+use OpenApi\Attributes as OA;
+
+class UserSessionController extends Controller implements HasMiddleware
+{
+    public static function middleware(): array
+    {
+        return [
+            new Middleware(CheckToken::using('users:read'), only: ['index']),
+            new Middleware(CheckToken::using('users:write'), only: ['destroy', 'destroyAll']),
+        ];
+    }
+
+    #[OA\Get(
+        path: '/users/{user}/sessions',
+        summary: 'Tokens OAuth activos de un usuario ("sesiones")',
+        description: 'Requiere el permiso users.view (o un token client_credentials, servicio de confianza).',
+        security: [['oauth2' => ['users:read']]],
+        tags: ['Users'],
+        parameters: [new OA\Parameter(name: 'user', in: 'path', required: true, schema: new OA\Schema(type: 'integer'))],
+        responses: [
+            new OA\Response(response: 200, description: 'Listado de tokens activos'),
+            new OA\Response(response: 403, description: 'Sin permiso users.view'),
+        ]
+    )]
+    public function index(Request $request, User $user)
+    {
+        $actor = $request->user('api');
+        abort_if($actor && ! $actor->can('users.view'), 403);
+
+        return response()->json(UserSessions::active($user));
+    }
+
+    #[OA\Delete(
+        path: '/users/{user}/sessions/{tokenId}',
+        summary: 'Revocar un token OAuth activo de un usuario',
+        description: 'Requiere el permiso users.update (o un token client_credentials, servicio de confianza).',
+        security: [['oauth2' => ['users:write']]],
+        tags: ['Users'],
+        parameters: [
+            new OA\Parameter(name: 'user', in: 'path', required: true, schema: new OA\Schema(type: 'integer')),
+            new OA\Parameter(name: 'tokenId', in: 'path', required: true, schema: new OA\Schema(type: 'string')),
+        ],
+        responses: [
+            new OA\Response(response: 204, description: 'Token revocado'),
+            new OA\Response(response: 403, description: 'Sin permiso users.update'),
+            new OA\Response(response: 404, description: 'El token no existe o no pertenece a ese usuario'),
+        ]
+    )]
+    public function destroy(Request $request, User $user, string $tokenId)
+    {
+        $actor = $request->user('api');
+        abort_if($actor && ! $actor->can('users.update'), 403);
+
+        abort_unless(UserSessions::revoke($user, $tokenId), 404);
+
+        AuditLog::record($request, 'user.session_revoked', 'user', $user->id, $user->email);
+
+        return response()->noContent();
+    }
+
+    #[OA\Delete(
+        path: '/users/{user}/sessions',
+        summary: 'Revocar todos los tokens OAuth activos de un usuario',
+        description: 'Requiere el permiso users.update (o un token client_credentials, servicio de confianza).',
+        security: [['oauth2' => ['users:write']]],
+        tags: ['Users'],
+        parameters: [new OA\Parameter(name: 'user', in: 'path', required: true, schema: new OA\Schema(type: 'integer'))],
+        responses: [
+            new OA\Response(response: 204, description: 'Todos los tokens revocados'),
+            new OA\Response(response: 403, description: 'Sin permiso users.update'),
+        ]
+    )]
+    public function destroyAll(Request $request, User $user)
+    {
+        $actor = $request->user('api');
+        abort_if($actor && ! $actor->can('users.update'), 403);
+
+        $count = UserSessions::revokeAll($user);
+
+        AuditLog::record($request, 'user.sessions_revoked_all', 'user', $user->id, $user->email, [
+            'count' => $count,
+        ]);
+
+        return response()->noContent();
+    }
+}