Skip to content

Commit 041a795

Browse files
hafezdivandarihafezdivandari
authored
[13.x] Make revoking refresh tokens optional (#1790)
* new revoke refresh token config * add feature tests * add tests * formatting * formatting * add more tests * formatting
1 parent 6fafccc commit 041a795

4 files changed

+185
-0
lines changed

‎src/Passport.php

+5
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,11 @@ class Passport
2222
*/
2323
public static bool $validateKeyPermissions = false;
2424

25+
/**
26+
* Indicates if the refresh token should be revoked after use.
27+
*/
28+
public static bool $revokeRefreshTokenAfterUse = true;
29+
2530
/**
2631
* Indicates if the implicit grant type is enabled.
2732
*/

‎src/PassportServiceProvider.php

+1
Original file line numberDiff line numberDiff line change
@@ -120,6 +120,7 @@ protected function registerAuthorizationServer(): void
120120
$this->app->singleton(AuthorizationServer::class, function () {
121121
return tap($this->makeAuthorizationServer(), function (AuthorizationServer $server) {
122122
$server->setDefaultScope(Passport::$defaultScope);
123+
$server->revokeRefreshTokens(Passport::$revokeRefreshTokenAfterUse);
123124

124125
$server->enableGrantType(
125126
$this->makeAuthCodeGrant(), Passport::tokensExpireIn()

‎tests/Feature/AuthorizationCodeGrantWithPkceTest.php

+14
Original file line numberDiff line numberDiff line change
@@ -83,6 +83,8 @@ public function testIssueAccessToken()
8383
$this->assertSame('Bearer', $json['token_type']);
8484
$this->assertSame(31536000, $json['expires_in']);
8585

86+
$refreshToken = $json['refresh_token'];
87+
8688
Route::get('/foo', fn (Request $request) => $request->user()->token()->toJson())
8789
->middleware('auth:api');
8890

@@ -91,6 +93,18 @@ public function testIssueAccessToken()
9193
$this->assertSame($client->getKey(), $json['oauth_client_id']);
9294
$this->assertEquals($user->getAuthIdentifier(), $json['oauth_user_id']);
9395
$this->assertSame(['create', 'read'], $json['oauth_scopes']);
96+
97+
$newToken = $this->post('/oauth/token', [
98+
'grant_type' => 'refresh_token',
99+
'client_id' => $client->getKey(),
100+
'refresh_token' => $refreshToken,
101+
'scope' => 'create read',
102+
])->assertOK()->json();
103+
104+
$this->assertArrayHasKey('access_token', $newToken);
105+
$this->assertArrayHasKey('refresh_token', $newToken);
106+
$this->assertSame(31536000, $newToken['expires_in']);
107+
$this->assertSame('Bearer', $newToken['token_type']);
94108
}
95109

96110
public function testRequireCodeChallenge()

‎tests/Feature/RefreshTokenGrantTest.php

+165
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,165 @@
1+
<?php
2+
3+
namespace Laravel\Passport\Tests\Feature;
4+
5+
use Illuminate\Http\Request;
6+
use Illuminate\Support\Facades\Route;
7+
use Laravel\Passport\Client;
8+
use Laravel\Passport\Database\Factories\ClientFactory;
9+
use Laravel\Passport\Passport;
10+
use Orchestra\Testbench\Concerns\WithLaravelMigrations;
11+
use Workbench\Database\Factories\UserFactory;
12+
13+
class RefreshTokenGrantTest extends PassportTestCase
14+
{
15+
use WithLaravelMigrations;
16+
17+
protected function setUp(): void
18+
{
19+
parent::setUp();
20+
21+
Passport::tokensCan([
22+
'create' => 'Create',
23+
'read' => 'Read',
24+
'update' => 'Update',
25+
'delete' => 'Delete',
26+
]);
27+
28+
Passport::$revokeRefreshTokenAfterUse = true;
29+
30+
Passport::authorizationView(fn ($params) => $params);
31+
}
32+
33+
public function testRefreshingToken()
34+
{
35+
$client = ClientFactory::new()->create();
36+
37+
$oldToken = $this->getNewAccessToken($client);
38+
39+
$newToken = $this->post('/oauth/token', [
40+
'grant_type' => 'refresh_token',
41+
'client_id' => $client->getKey(),
42+
'client_secret' => $client->plainSecret,
43+
'refresh_token' => $oldToken['refresh_token'],
44+
'scope' => 'read delete',
45+
])->assertOK()->json();
46+
47+
$this->assertArrayHasKey('access_token', $newToken);
48+
$this->assertArrayHasKey('refresh_token', $newToken);
49+
$this->assertSame(31536000, $newToken['expires_in']);
50+
$this->assertSame('Bearer', $newToken['token_type']);
51+
52+
Route::get('/foo', fn (Request $request) => $request->user()->token()->toJson())
53+
->middleware('auth:api');
54+
55+
$this->getJson('/foo', [
56+
'Authorization' => $oldToken['token_type'].' '.$oldToken['access_token'],
57+
])->assertUnauthorized();
58+
59+
$json = $this->getJson('/foo', [
60+
'Authorization' => $newToken['token_type'].' '.$newToken['access_token'],
61+
])->assertOk()->json();
62+
63+
$this->assertSame(['read', 'delete'], $json['oauth_scopes']);
64+
65+
$json = $this->post('/oauth/token', [
66+
'grant_type' => 'refresh_token',
67+
'client_id' => $client->getKey(),
68+
'client_secret' => $client->plainSecret,
69+
'refresh_token' => $oldToken['refresh_token'],
70+
])->assertStatus(400)->json();
71+
72+
$this->assertSame('invalid_grant', $json['error']);
73+
$this->assertSame('The refresh token is invalid.', $json['error_description']);
74+
$this->assertSame('Token has been revoked', $json['hint']);
75+
}
76+
77+
public function testRefreshingTokenWithoutRevoking()
78+
{
79+
Passport::$revokeRefreshTokenAfterUse = false;
80+
81+
$client = ClientFactory::new()->create();
82+
83+
$oldToken = $this->getNewAccessToken($client);
84+
85+
$newToken = $this->post('/oauth/token', [
86+
'grant_type' => 'refresh_token',
87+
'client_id' => $client->getKey(),
88+
'client_secret' => $client->plainSecret,
89+
'refresh_token' => $oldToken['refresh_token'],
90+
'scope' => 'read delete',
91+
])->assertOK()->json();
92+
93+
$this->assertArrayHasKey('access_token', $newToken);
94+
$this->assertArrayHasKey('refresh_token', $newToken);
95+
$this->assertSame(31536000, $newToken['expires_in']);
96+
$this->assertSame('Bearer', $newToken['token_type']);
97+
98+
Route::get('/foo', fn (Request $request) => $request->user()->token()->toJson())
99+
->middleware('auth:api');
100+
101+
$this->getJson('/foo', [
102+
'Authorization' => $oldToken['token_type'].' '.$oldToken['access_token'],
103+
])->assertUnauthorized();
104+
105+
$json = $this->getJson('/foo', [
106+
'Authorization' => $newToken['token_type'].' '.$newToken['access_token'],
107+
])->assertOk();
108+
109+
$this->assertSame(['read', 'delete'], $json['oauth_scopes']);
110+
111+
$json = $this->post('/oauth/token', [
112+
'grant_type' => 'refresh_token',
113+
'client_id' => $client->getKey(),
114+
'client_secret' => $client->plainSecret,
115+
'refresh_token' => $oldToken['refresh_token'],
116+
])->assertOk()->json();
117+
118+
$this->assertArrayHasKey('access_token', $json);
119+
$this->assertArrayHasKey('refresh_token', $json);
120+
$this->assertSame(31536000, $json['expires_in']);
121+
$this->assertSame('Bearer', $json['token_type']);
122+
}
123+
124+
public function testRefreshingTokenWithAdditionalScopes()
125+
{
126+
$client = ClientFactory::new()->create();
127+
128+
$oldToken = $this->getNewAccessToken($client);
129+
130+
$json = $this->post('/oauth/token', [
131+
'grant_type' => 'refresh_token',
132+
'client_id' => $client->getKey(),
133+
'client_secret' => $client->plainSecret,
134+
'refresh_token' => $oldToken['refresh_token'],
135+
'scope' => 'create update',
136+
])->assertStatus(400)->json();
137+
138+
$this->assertSame('invalid_scope', $json['error']);
139+
$this->assertSame('The requested scope is invalid, unknown, or malformed', $json['error_description']);
140+
$this->assertSame('Check the `update` scope', $json['hint']);
141+
}
142+
143+
private function getNewAccessToken(Client $client)
144+
{
145+
$this->actingAs(UserFactory::new()->create(), 'web');
146+
147+
$authToken = $this->get('/oauth/authorize?'.http_build_query([
148+
'client_id' => $client->getKey(),
149+
'redirect_uri' => $redirect = $client->redirect_uris[0],
150+
'response_type' => 'code',
151+
'scope' => 'create read delete',
152+
]))->assertOk()->json('authToken');
153+
154+
$redirectUrl = $this->post('/oauth/authorize', ['auth_token' => $authToken])->headers->get('Location');
155+
parse_str(parse_url($redirectUrl, PHP_URL_QUERY), $params);
156+
157+
return $this->post('/oauth/token', [
158+
'grant_type' => 'authorization_code',
159+
'client_id' => $client->getKey(),
160+
'client_secret' => $client->plainSecret,
161+
'redirect_uri' => $redirect,
162+
'code' => $params['code'],
163+
])->assertOK()->json();
164+
}
165+
}

0 commit comments

Comments
 (0)