TokenIssuance
class TokenIssuance implements NonCopyableContext, Transient
Constants
| protected CONTEXT_KEY |
|
| protected REVOCATION_BATCH_SIZE |
|
Properties
| AuthCode|DeviceCode|RefreshToken|null | $grant | ||
| ClientEntityInterface|null | $client | ||
| Token|null | $accessToken | ||
| string|null | $refreshTokenFamilyId | ||
| string|null | $tokenName | ||
| string|null | $dpopJkt | ||
| null|list<string> | $approvedScopes | ||
| null|list<string> | $refreshTokenScopes | ||
| null|list<string> | $requestedResources | ||
| null|array<string, list<string>> | $resources | ||
| list<string> | $audience | ||
| protected Connection|null | $connection | ||
| protected int | $transactionLevel | ||
| protected bool | $claimed | ||
| protected array<string, mixed> | $authorizationAttributes |
Methods
Pin one issuance to its settings and active signing key.
Get the current issuance, if one is running.
Run a fresh issuance and restore any enclosing operation afterwards.
Determine whether this operation exchanges credentials for tokens.
Record the grant already read during validation.
Record the client selected for this operation.
Record the attributes captured when the user authorized the request.
Get the attributes carried from authorization or the redeemed grant.
Reject redemption whose durable security writes could be rolled back by its caller.
Begin the credential transaction at the first validated write.
Claim a validated single-use grant before creating its successor tokens.
Commit the issuance before returning its completed response.
Undo the issuance without disturbing an enclosing caller's transaction.
Retain the signing key until this token's complete lifetime has passed.
Revoke a refresh grant and every access token still linked to it.
Revoke selected access tokens within the caller's credential transaction.
Details
at line 80
__construct(ServerEntry $entry, SigningCryptKey $signingKey, CarbonImmutable $startedAt, bool $tokenRequest = false)
Pin one issuance to its settings and active signing key.
at line 91
static TokenIssuance|null
current()
Get the current issuance, if one is running.
at line 104
static mixed
run(ServerFactory $servers, Closure $callback, array $attributes = [], bool $tokenRequest = false)
Run a fresh issuance and restore any enclosing operation afterwards.
at line 142
bool
isTokenRequest()
Determine whether this operation exchanges credentials for tokens.
at line 150
void
setGrant(AuthCode|DeviceCode|RefreshToken|null $grant)
Record the grant already read during validation.
at line 162
void
setClient(ClientEntityInterface $client)
Record the client selected for this operation.
at line 170
void
setAccessToken(Token $token)
Keep the saved access token available to response extensions.
at line 180
void
setAuthorizationAttributes(array $attributes)
Record the attributes captured when the user authorized the request.
at line 190
array
attributes()
Get the attributes carried from authorization or the redeemed grant.
at line 207
static void
ensureRedemptionAllowed(Connection $connection)
Reject redemption whose durable security writes could be rolled back by its caller.
Device polling timestamps and credential replay revocations must survive OAuth error responses.
at line 217
void
begin()
Begin the credential transaction at the first validated write.
at line 242
void
claimGrant(string|null $accessTokenId = null)
Claim a validated single-use grant before creating its successor tokens.
at line 277
bool
hasClaimed(Model $grant, string $id)
Determine whether this operation already consumed a grant.
at line 286
protected void
commit()
Commit the issuance before returning its completed response.
at line 309
protected void
rollBack()
Undo the issuance without disturbing an enclosing caller's transaction.
at line 322
void
retainSigningKey(DateTimeInterface $expiresAt, DateInterval|null $lifetime = null)
Retain the signing key until this token's complete lifetime has passed.
at line 363
static void
revokeAuthCodeTokens(AuthCode $code)
Revoke the credentials issued by a reused authorization code.
at line 382
static void
revokeRefreshTokenFamily(string $familyId)
Revoke a refresh grant and every access token still linked to it.
at line 411
static void
revokeAccessTokens(Builder $query)
Revoke selected access tokens within the caller's credential transaction.