oauth/app/Http/Controllers/OAuth/ClientController.php

<?php

namespace App\Http\Controllers\OAuth;

use App\Http\Controllers\Controller;
use App\Models\AuditLog;
use App\Support\ClientSecretRotation;
use App\Support\TokenRevocation;
use Illuminate\Http\Request;
use Illuminate\Support\Str;
use Illuminate\Validation\Rule;
use Laravel\Passport\Client;

class ClientController extends Controller
{
    /**
     * List the OAuth clients owned by the authenticated user.
     */
    public function index(Request $request)
    {
        return response()->json(
            $request->user()->oauthApps()->where('revoked', false)->orderByDesc('created_at')->get()
        );
    }

    /**
     * Create a new OAuth client (authorization_code+PKCE, client_credentials or password).
     */
    public function store(Request $request)
    {
        $data = $request->validate([
            'name' => ['required', 'string', 'max:255'],
            'grant_type' => ['required', Rule::in(['authorization_code', 'client_credentials', 'password'])],
            'redirect_uris' => ['required_if:grant_type,authorization_code', 'array'],
            'redirect_uris.*' => ['url'],
            'confidential' => ['boolean'],
        ]);

        $confidential = $request->boolean('confidential', true);

        $grantTypes = match ($data['grant_type']) {
            'authorization_code' => ['authorization_code', 'refresh_token'],
            'password' => ['password', 'refresh_token'],
            'client_credentials' => ['client_credentials'],
        };

        // client_credentials always needs a secret: there is no user present to prove identity.
        if ($data['grant_type'] === 'client_credentials') {
            $confidential = true;
        }

        $client = $request->user()->oauthApps()->create([
            'name' => $data['name'],
            'secret' => $confidential ? Str::random(40) : null,
            'provider' => null,
            'redirect_uris' => $data['redirect_uris'] ?? [],
            'grant_types' => $grantTypes,
            'revoked' => false,
        ]);

        AuditLog::record($request, 'client.created', 'client', $client->id, $client->name, [
            'grant_type' => $data['grant_type'],
            'confidential' => $confidential,
        ]);

        return response()->json([
            'client' => $client,
            'plain_secret' => $client->plainSecret,
        ], 201);
    }

    /**
     * Update an existing client's name/redirect URIs.
     */
    public function update(Request $request, Client $client)
    {
        abort_unless($client->owner_id === $request->user()->id, 404);

        $data = $request->validate([
            'name' => ['required', 'string', 'max:255'],
            'redirect_uris' => ['array'],
            'redirect_uris.*' => ['url'],
        ]);

        $client->update([
            'name' => $data['name'],
            'redirect_uris' => $data['redirect_uris'] ?? $client->redirect_uris,
        ]);

        return response()->json($client);
    }

    /**
     * Rotate a confidential client's secret. The previous secret keeps
     * working for a grace period so deployed integrations don't break
     * instantly (see App\Support\ClientSecretRotation).
     */
    public function rotateSecret(Request $request, Client $client)
    {
        abort_unless($client->owner_id === $request->user()->id, 404);
        abort_unless($client->confidential(), 422, __('messages.client_not_confidential'));

        $plainSecret = ClientSecretRotation::rotate($client);

        AuditLog::record($request, 'client.secret_rotated', 'client', $client->id, $client->name, [
            'previous_secret_expires_at' => $client->previous_secret_expires_at,
        ]);

        return response()->json([
            'plain_secret' => $plainSecret,
            'previous_secret_expires_at' => $client->previous_secret_expires_at,
        ]);
    }

    /**
     * Revoke (soft-delete) a client and its tokens.
     */
    public function destroy(Request $request, Client $client)
    {
        abort_unless($client->owner_id === $request->user()->id, 404);

        $tokens = $client->tokens()->where('revoked', false)->get();

        $client->update(['revoked' => true]);

        foreach ($tokens as $token) {
            TokenRevocation::revoke($token);
        }

        AuditLog::record($request, 'client.revoked', 'client', $client->id, $client->name, [
            'tokens_revoked' => $tokens->count(),
        ]);

        return response()->noContent();
    }
}