pigui/oauth
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

new funcionality

Browse Source
This commit is contained in:
Josep
2026-07-27 17:20:02 +02:00
parent c2b5291a74
commit c5ce8a7a36
101 changed files with 6889 additions and 176 deletions
Download Patch File Download Diff File Expand all files Collapse all files

39
app/Http/Controllers/OAuth/AuthorizationEventController.php Normal file
View File

@@ -0,0 +1,39 @@
<?php
namespace App\Http\Controllers\OAuth;
use App\Http\Controllers\Controller;
use App\Models\OAuthAuthorizationEvent;
use Illuminate\Http\Request;
use Illuminate\Validation\Rule;
class AuthorizationEventController extends Controller
{
/**
* Registra un paso del funnel de autorización OAuth (intento, aprobación
* o denegación) desde la pantalla de consentimiento (Authorize.vue).
* Es solo para analíticas: no participa en el flujo real de OAuth, que
* sigue resuelto enteramente por las rutas nativas de Passport.
*/
public function store(Request $request)
{
$data = $request->validate([
'client_id' => ['required', 'string', Rule::exists('oauth_clients', 'id')],
'outcome' => ['required', Rule::in(['attempted', 'approved', 'denied'])],
'scopes' => ['array'],
'scopes.*' => ['string'],
]);
OAuthAuthorizationEvent::create([
'user_id' => $request->user()->id,
'client_id' => $data['client_id'],
'outcome' => $data['outcome'],
'scopes' => $data['scopes'] ?? [],
'ip_address' => $request->ip(),
'user_agent' => $request->userAgent(),
'created_at' => now(),
]);
return response()->noContent();
}
}

4
app/Http/Controllers/OAuth/AuthorizedAppController.php
View File

@@ -3,6 +3,7 @@
namespace App\Http\Controllers\OAuth;
use App\Http\Controllers\Controller;
use App\Support\TokenRevocation;
use Illuminate\Http\Request;
class AuthorizedAppController extends Controller
@@ -28,8 +29,7 @@ class AuthorizedAppController extends Controller
abort_unless($token, 404);
$token->revoke();
$token->refreshToken?->revoke();
TokenRevocation::revoke($token);
return response()->noContent();
}

41
app/Http/Controllers/OAuth/ClientController.php
View File

@@ -3,6 +3,9 @@
namespace App\Http\Controllers\OAuth;
use App\Http\Controllers\Controller;
use App\Models\AuditLog;
use App\Support\ClientSecretRotation;
use App\Support\TokenRevocation;
use Illuminate\Http\Request;
use Illuminate\Support\Str;
use Illuminate\Validation\Rule;
@@ -55,6 +58,11 @@ class ClientController extends Controller
'revoked' => false,
]);
AuditLog::record($request, 'client.created', 'client', $client->id, $client->name, [
'grant_type' => $data['grant_type'],
'confidential' => $confidential,
]);
return response()->json([
'client' => $client,
'plain_secret' => $client->plainSecret,
@@ -82,6 +90,28 @@ class ClientController extends Controller
return response()->json($client);
}
/**
* Rotate a confidential client's secret. The previous secret keeps
* working for a grace period so deployed integrations don't break
* instantly (see App\Support\ClientSecretRotation).
*/
public function rotateSecret(Request $request, Client $client)
{
abort_unless($client->owner_id === $request->user()->id, 404);
abort_unless($client->confidential(), 422, __('messages.client_not_confidential'));
$plainSecret = ClientSecretRotation::rotate($client);
AuditLog::record($request, 'client.secret_rotated', 'client', $client->id, $client->name, [
'previous_secret_expires_at' => $client->previous_secret_expires_at,
]);
return response()->json([
'plain_secret' => $plainSecret,
'previous_secret_expires_at' => $client->previous_secret_expires_at,
]);
}
/**
* Revoke (soft-delete) a client and its tokens.
*/
@@ -89,8 +119,17 @@ class ClientController extends Controller
{
abort_unless($client->owner_id === $request->user()->id, 404);
$tokens = $client->tokens()->where('revoked', false)->get();
$client->update(['revoked' => true]);
$client->tokens()->update(['revoked' => true]);
foreach ($tokens as $token) {
TokenRevocation::revoke($token);
}
AuditLog::record($request, 'client.revoked', 'client', $client->id, $client->name, [
'tokens_revoked' => $tokens->count(),
]);
return response()->noContent();
}

124
app/Http/Controllers/OAuth/WebhookController.php Normal file
View File

@@ -0,0 +1,124 @@
<?php
namespace App\Http\Controllers\OAuth;
use App\Http\Controllers\Controller;
use App\Jobs\SendWebhookJob;
use App\Models\AuditLog;
use App\Models\WebhookDelivery;
use App\Models\WebhookEndpoint;
use App\Rules\SafeWebhookUrl;
use App\Support\WebhookEndpoints;
use Illuminate\Http\Request;
use Illuminate\Support\Str;
use Illuminate\Validation\Rule;
use Laravel\Passport\Client;
class WebhookController extends Controller
{
/**
* List the webhook endpoints registered for one of the user's own clients.
*/
public function index(Request $request, Client $client)
{
abort_unless($client->owner_id === $request->user()->id, 404);
return response()->json(
WebhookEndpoint::where('client_id', $client->id)
->latest('created_at')
->get()
->map(fn (WebhookEndpoint $endpoint) => WebhookEndpoints::present($endpoint))
);
}
/**
* Register a new webhook endpoint for one of the user's own clients.
*/
public function store(Request $request, Client $client)
{
abort_unless($client->owner_id === $request->user()->id, 404);
$data = $request->validate([
'url' => ['required', 'url', 'max:2048', new SafeWebhookUrl()],
'events' => ['required', 'array', 'min:1'],
'events.*' => [Rule::in(WebhookEndpoints::EVENTS)],
]);
$secret = Str::random(40);
$endpoint = WebhookEndpoint::create([
'client_id' => $client->id,
'url' => $data['url'],
'secret' => $secret,
'events' => $data['events'],
'active' => true,
]);
AuditLog::record($request, 'client.webhook_created', 'client', $client->id, $client->name, [
'url' => $data['url'],
'events' => $data['events'],
]);
return response()->json([
...WebhookEndpoints::present($endpoint),
'secret' => $secret,
], 201);
}
public function update(Request $request, Client $client, WebhookEndpoint $webhook)
{
abort_unless($client->owner_id === $request->user()->id, 404);
abort_unless($webhook->client_id === $client->id, 404);
$data = $request->validate([
'url' => ['sometimes', 'url', 'max:2048', new SafeWebhookUrl()],
'events' => ['sometimes', 'array', 'min:1'],
'events.*' => [Rule::in(WebhookEndpoints::EVENTS)],
'active' => ['sometimes', 'boolean'],
]);
$webhook->update($data);
return response()->json(WebhookEndpoints::present($webhook->fresh()));
}
public function destroy(Request $request, Client $client, WebhookEndpoint $webhook)
{
abort_unless($client->owner_id === $request->user()->id, 404);
abort_unless($webhook->client_id === $client->id, 404);
AuditLog::record($request, 'client.webhook_deleted', 'client', $client->id, $client->name, [
'url' => $webhook->url,
]);
$webhook->delete();
return response()->noContent();
}
/**
* Historial paginado de intentos de entrega de un webhook.
*/
public function deliveries(Request $request, Client $client, WebhookEndpoint $webhook)
{
abort_unless($client->owner_id === $request->user()->id, 404);
abort_unless($webhook->client_id === $client->id, 404);
return response()->json(WebhookDelivery::paginatedFor($webhook, $request));
}
/**
* Reintento manual de una entrega puntual — vuelve a encolar el mismo
* registro (acumula el intento en su historial, no crea uno nuevo).
*/
public function retryDelivery(Request $request, Client $client, WebhookEndpoint $webhook, WebhookDelivery $delivery)
{
abort_unless($client->owner_id === $request->user()->id, 404);
abort_unless($webhook->client_id === $client->id, 404);
abort_unless($delivery->webhook_endpoint_id === $webhook->id, 404);
SendWebhookJob::dispatch($delivery);
return response()->json(['queued' => true]);
}
}