Laravel Passport 13.x

[hafezdivandari]

It's about time we released Laravel Passport 13.x, but we are being held back due to unmerged PRs in this repo after 5 months!

There are 4 bugs, that I've previously sent PRs to address them:

• Fix scope on device code grant #1412
• Fix including interval in response of device authorization request #1410
• Fix issue and persist a new refresh token when revoking refresh token is disabled #1449
• Fix "state" parameter of error responses #1298

And also 4 more PRs which would be really appreciated if we can merge before major Passport release:

• Validate confidential clients and determine if the client handles the grant type #1420
• Fix key files permission on Windows #1447
• Allow configuring the JWT builder when generating a token #1328 (TBD later)
• Add PHP 8.4 support #1454

Originally posted by @hafezdivandari in laravel/passport#1748 (comment)

[Sephster]

Thanks for your patience and work on this @hafezdivandari - as noted, I had an emergency at work which I'm sure you will appreciate, takes precedence over work I do in my free time. I'm available to start looking at this now though and had planned on doing so this evening. Thanks

[hafezdivandari]

@Sephster Are you available to review the remaining PRs? PR #1420 is particularly important, and the device authorization grant is currently unusable due to its bugs.

[Sephster]

Just a quick update. I haven't forgotten about this @hafezdivandari and have started reviewing 1412. I'll aim to have another two PRs reviewed this week. Cheers!

[hafezdivandari]

Thank you @Sephster, as I said the #1420 is the most important one for us. All PRs all small and I'm sure won't get more than 1 hour of your time in total, I'm available for any question you may have to make them easier for review.

[Sephster]

As with anything, it is just double checking the specs that is the slow part really. I put in well over a year to the device code grant. It went through numerous iterations and a release candidate with everything fully tested and still compliance issues slipped through :) Thank you for all your help with this though and I will be sure to shout should I need anything!

[hafezdivandari]

Totally understandable, I tried to mention the related spec section on each PR (I'll recheck them all again), and added tests wherever required.

[hafezdivandari]

Hi @Sephster would you please consider reviewing #1420? It is an important one for us, we can finalize Passport release after this one, thanks.

[Sephster]

Next on the list. I did take a look tonight but quite a few moving parts to it. Will get to it asap

[Sephster]

@hafezdivandari I will pick up #1420 tonight to try get it progressed but I think there is already no blockers here for Passport being upgraded if you wanted to progress this with Laravel? Anyways, I will pick it up tonight. I think that the JWT builder ticket should be handled separately to draw a close to this and get the package upgraded. Thanks for your patience

[hafezdivandari]

@Sephster The #1420 is important as we have added grant_types to client on Passport 13.x and it won't work as expected without merging that PR. Also #1410 is merged but not release yet, the changelog is wrong currently I've fixed the changelog on #1467. We can postpone #1328 for later.

[mhdcodes]

Hello everyone, I just wanted to weigh in on this issue. We're using Passport in production and have been affected by this laravel/passport#1790 I believe it impacts many users more precisely people using short lived access tokens. We're eagerly awaiting the Passport 13 release to resolve this for us.

thank you @hafezdivandari @Sephster for the great work you put into this.