oauth/app/Http/Controllers/Api/AuthorizedAppController.php

<?php

namespace App\Http\Controllers\Api;

use App\Http\Controllers\Controller;
use App\Models\User;
use Illuminate\Http\Request;
use Illuminate\Routing\Controllers\HasMiddleware;
use Illuminate\Routing\Controllers\Middleware;
use Laravel\Passport\Http\Middleware\CheckToken;
use OpenApi\Attributes as OA;

class AuthorizedAppController extends Controller implements HasMiddleware
{
    public static function middleware(): array
    {
        return [
            new Middleware(CheckToken::using('account:read'), only: ['index']),
            new Middleware(CheckToken::using('account:write'), only: ['destroy']),
        ];
    }

    #[OA\Get(
        path: '/authorized-apps',
        summary: 'Listar apps de terceros a las que le diste acceso a tu cuenta',
        security: [['oauth2' => ['account:read']]],
        tags: ['Account'],
        responses: [new OA\Response(response: 200, description: 'Listado de tokens/apps autorizadas')]
    )]
    public function index(Request $request)
    {
        $user = $this->requireUser($request);

        $tokens = $user->tokens()
            ->where('revoked', false)
            ->with('client')
            ->get()
            ->reject(fn ($token) => $token->client->revoked || $token->client->hasGrantType('personal_access'))
            ->values();

        return response()->json($tokens);
    }

    #[OA\Delete(
        path: '/authorized-apps/{tokenId}',
        summary: 'Revocar el acceso de una app de terceros',
        security: [['oauth2' => ['account:write']]],
        tags: ['Account'],
        parameters: [new OA\Parameter(name: 'tokenId', in: 'path', required: true, schema: new OA\Schema(type: 'string'))],
        responses: [
            new OA\Response(response: 204, description: 'Acceso revocado'),
            new OA\Response(response: 404, description: 'No existe o no es tuyo'),
        ]
    )]
    public function destroy(Request $request, string $tokenId)
    {
        $token = $this->requireUser($request)->tokens()->where('id', $tokenId)->first();

        abort_unless($token, 404);

        $token->revoke();
        $token->refreshToken?->revoke();

        return response()->noContent();
    }

    private function requireUser(Request $request): User
    {
        return $request->user('api') ?? abort(422, __('messages.self_service_requires_user'));
    }
}