new funcionality

app/Http/Controllers/OAuth/ClientController.php

@@ -3,6 +3,9 @@
 namespace App\Http\Controllers\OAuth;
 
 use App\Http\Controllers\Controller;
+use App\Models\AuditLog;
+use App\Support\ClientSecretRotation;
+use App\Support\TokenRevocation;
 use Illuminate\Http\Request;
 use Illuminate\Support\Str;
 use Illuminate\Validation\Rule;
@@ -55,6 +58,11 @@ class ClientController extends Controller
             'revoked' => false,
         ]);
 
+        AuditLog::record($request, 'client.created', 'client', $client->id, $client->name, [
+            'grant_type' => $data['grant_type'],
+            'confidential' => $confidential,
+        ]);
+
         return response()->json([
             'client' => $client,
             'plain_secret' => $client->plainSecret,
@@ -82,6 +90,28 @@ class ClientController extends Controller
         return response()->json($client);
     }
 
+    /**
+     * Rotate a confidential client's secret. The previous secret keeps
+     * working for a grace period so deployed integrations don't break
+     * instantly (see App\Support\ClientSecretRotation).
+     */
+    public function rotateSecret(Request $request, Client $client)
+    {
+        abort_unless($client->owner_id === $request->user()->id, 404);
+        abort_unless($client->confidential(), 422, __('messages.client_not_confidential'));
+
+        $plainSecret = ClientSecretRotation::rotate($client);
+
+        AuditLog::record($request, 'client.secret_rotated', 'client', $client->id, $client->name, [
+            'previous_secret_expires_at' => $client->previous_secret_expires_at,
+        ]);
+
+        return response()->json([
+            'plain_secret' => $plainSecret,
+            'previous_secret_expires_at' => $client->previous_secret_expires_at,
+        ]);
+    }
+
     /**
      * Revoke (soft-delete) a client and its tokens.
      */
@@ -89,8 +119,17 @@ class ClientController extends Controller
     {
         abort_unless($client->owner_id === $request->user()->id, 404);
 
+        $tokens = $client->tokens()->where('revoked', false)->get();
+
         $client->update(['revoked' => true]);
-        $client->tokens()->update(['revoked' => true]);
+
+        foreach ($tokens as $token) {
+            TokenRevocation::revoke($token);
+        }
+
+        AuditLog::record($request, 'client.revoked', 'client', $client->id, $client->name, [
+            'tokens_revoked' => $tokens->count(),
+        ]);
 
         return response()->noContent();
     }