<?php

namespace App\Http\Controllers\OAuth;

use App\Http\Controllers\Controller;
use App\Support\TokenRevocation;
use Illuminate\Http\Request;

class AuthorizedAppController extends Controller
{
    /**
     * List third-party apps (non first-party clients) the user has granted access to.
     */
    public function index(Request $request)
    {
        $tokens = $request->user()->tokens()
            ->where('revoked', false)
            ->with('client')
            ->get()
            ->reject(fn ($token) => $token->client->revoked || $token->client->hasGrantType('personal_access'))
            ->values();

        return response()->json($tokens);
    }

    public function destroy(Request $request, string $tokenId)
    {
        $token = $request->user()->tokens()->where('id', $tokenId)->first();

        abort_unless($token, 404);

        TokenRevocation::revoke($token);

        return response()->noContent();
    }
}