90ddbb3572
Add optional expiration to personal API tokens. Users pick a duration (1/7/30/60/90 days or Never) at creation time. Expired tokens are rejected by Sanctum, pruned hourly by sanctum:prune-expired, and a team notification fires ~24h before expiry so owners can rotate before API calls start failing. - ApiTokens Livewire component stores expires_at from expiresInDays - Rework issued-tokens UI from card grid to table (matches other views) - New ApiTokenExpirationWarningJob scheduled hourly (idempotent via RateLimiter) - New ApiTokenExpiringNotification (email/discord/telegram/slack/pushover) - api_token_expiring added to alwaysSendEvents so users cannot silence expiry warnings from the per-event notification toggle UI - sanctum:prune-expired cadence moved from daily to hourly Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
49 lines
1.6 KiB
PHP
49 lines
1.6 KiB
PHP
<?php
|
|
|
|
namespace App\Jobs;
|
|
|
|
use App\Models\PersonalAccessToken;
|
|
use App\Models\Team;
|
|
use App\Models\User;
|
|
use App\Notifications\ApiTokenExpiringNotification;
|
|
use Illuminate\Bus\Queueable;
|
|
use Illuminate\Contracts\Queue\ShouldBeEncrypted;
|
|
use Illuminate\Contracts\Queue\ShouldQueue;
|
|
use Illuminate\Foundation\Bus\Dispatchable;
|
|
use Illuminate\Queue\InteractsWithQueue;
|
|
use Illuminate\Queue\SerializesModels;
|
|
use Illuminate\Support\Facades\RateLimiter;
|
|
use Laravel\Horizon\Contracts\Silenced;
|
|
|
|
class ApiTokenExpirationWarningJob implements ShouldBeEncrypted, ShouldQueue, Silenced
|
|
{
|
|
use Dispatchable, InteractsWithQueue, Queueable, SerializesModels;
|
|
|
|
public $tries = 1;
|
|
|
|
public $timeout = 120;
|
|
|
|
public function handle(): void
|
|
{
|
|
PersonalAccessToken::query()
|
|
->whereNotNull('expires_at')
|
|
->where('expires_at', '>', now())
|
|
->where('expires_at', '<=', now()->addDay())
|
|
->where('tokenable_type', User::class)
|
|
->chunkById(100, function ($tokens) {
|
|
foreach ($tokens as $token) {
|
|
if (! $token->team_id) {
|
|
continue;
|
|
}
|
|
RateLimiter::attempt(
|
|
'api-token-expiring:'.$token->id,
|
|
$maxAttempts = 0,
|
|
function () use ($token) {
|
|
Team::find($token->team_id)?->notify(new ApiTokenExpiringNotification($token));
|
|
},
|
|
$decaySeconds = 7 * 24 * 3600,
|
|
);
|
|
}
|
|
});
|
|
}
|
|
}
|