99 lines
3.8 KiB
PHP
99 lines
3.8 KiB
PHP
<?php
|
|
|
|
namespace App\Http\Controllers\Api;
|
|
|
|
use App\Http\Controllers\Controller;
|
|
use App\Models\AuditLog;
|
|
use App\Models\User;
|
|
use App\Support\UserSessions;
|
|
use Illuminate\Http\Request;
|
|
use Illuminate\Routing\Controllers\HasMiddleware;
|
|
use Illuminate\Routing\Controllers\Middleware;
|
|
use Laravel\Passport\Http\Middleware\CheckToken;
|
|
use OpenApi\Attributes as OA;
|
|
|
|
class UserSessionController extends Controller implements HasMiddleware
|
|
{
|
|
public static function middleware(): array
|
|
{
|
|
return [
|
|
new Middleware(CheckToken::using('users:read'), only: ['index']),
|
|
new Middleware(CheckToken::using('users:write'), only: ['destroy', 'destroyAll']),
|
|
];
|
|
}
|
|
|
|
#[OA\Get(
|
|
path: '/users/{user}/sessions',
|
|
summary: 'Tokens OAuth activos de un usuario ("sesiones")',
|
|
description: 'Requiere el permiso users.view (o un token client_credentials, servicio de confianza).',
|
|
security: [['oauth2' => ['users:read']]],
|
|
tags: ['Users'],
|
|
parameters: [new OA\Parameter(name: 'user', in: 'path', required: true, schema: new OA\Schema(type: 'integer'))],
|
|
responses: [
|
|
new OA\Response(response: 200, description: 'Listado de tokens activos'),
|
|
new OA\Response(response: 403, description: 'Sin permiso users.view'),
|
|
]
|
|
)]
|
|
public function index(Request $request, User $user)
|
|
{
|
|
$actor = $request->user('api');
|
|
abort_if($actor && ! $actor->can('users.view'), 403);
|
|
|
|
return response()->json(UserSessions::active($user));
|
|
}
|
|
|
|
#[OA\Delete(
|
|
path: '/users/{user}/sessions/{tokenId}',
|
|
summary: 'Revocar un token OAuth activo de un usuario',
|
|
description: 'Requiere el permiso users.update (o un token client_credentials, servicio de confianza).',
|
|
security: [['oauth2' => ['users:write']]],
|
|
tags: ['Users'],
|
|
parameters: [
|
|
new OA\Parameter(name: 'user', in: 'path', required: true, schema: new OA\Schema(type: 'integer')),
|
|
new OA\Parameter(name: 'tokenId', in: 'path', required: true, schema: new OA\Schema(type: 'string')),
|
|
],
|
|
responses: [
|
|
new OA\Response(response: 204, description: 'Token revocado'),
|
|
new OA\Response(response: 403, description: 'Sin permiso users.update'),
|
|
new OA\Response(response: 404, description: 'El token no existe o no pertenece a ese usuario'),
|
|
]
|
|
)]
|
|
public function destroy(Request $request, User $user, string $tokenId)
|
|
{
|
|
$actor = $request->user('api');
|
|
abort_if($actor && ! $actor->can('users.update'), 403);
|
|
|
|
abort_unless(UserSessions::revoke($user, $tokenId), 404);
|
|
|
|
AuditLog::record($request, 'user.session_revoked', 'user', $user->id, $user->email);
|
|
|
|
return response()->noContent();
|
|
}
|
|
|
|
#[OA\Delete(
|
|
path: '/users/{user}/sessions',
|
|
summary: 'Revocar todos los tokens OAuth activos de un usuario',
|
|
description: 'Requiere el permiso users.update (o un token client_credentials, servicio de confianza).',
|
|
security: [['oauth2' => ['users:write']]],
|
|
tags: ['Users'],
|
|
parameters: [new OA\Parameter(name: 'user', in: 'path', required: true, schema: new OA\Schema(type: 'integer'))],
|
|
responses: [
|
|
new OA\Response(response: 204, description: 'Todos los tokens revocados'),
|
|
new OA\Response(response: 403, description: 'Sin permiso users.update'),
|
|
]
|
|
)]
|
|
public function destroyAll(Request $request, User $user)
|
|
{
|
|
$actor = $request->user('api');
|
|
abort_if($actor && ! $actor->can('users.update'), 403);
|
|
|
|
$count = UserSessions::revokeAll($user);
|
|
|
|
AuditLog::record($request, 'user.sessions_revoked_all', 'user', $user->id, $user->email, [
|
|
'count' => $count,
|
|
]);
|
|
|
|
return response()->noContent();
|
|
}
|
|
}
|