added support for legacy tickets, fixed switching of modes and also style updates

2026-10-14 16:37:23 +01:00
parent e241c08ef6
commit 7073a81b99
6 changed files with 279 additions and 12 deletions
@@ -0,0 +1,103 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Modules\Helpdesk\Http\Controllers;
+
+use App\Models\User;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+use Illuminate\Routing\Controller;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Validation\ValidationException;
+
+final class NativeTokenController extends Controller
+{
+    public function exchange(Request $request): JsonResponse
+    {
+        $data = $request->validate([
+            'grant_type' => ['required', 'in:authorization_code'],
+            'client_id' => ['required', 'string'],
+            'code' => ['required', 'string'],
+            'redirect_uri' => ['required', 'string'],
+            'code_verifier' => [
+                'required',
+                'string',
+                'regex:/^[A-Za-z0-9._~-]{43,128}$/',
+            ],
+        ]);
+
+        $challenge = rtrim(
+            strtr(
+                base64_encode(hash('sha256', $data['code_verifier'], true)),
+                '+/',
+                '-_'
+            ),
+            '='
+        );
+
+        $result = DB::transaction(function () use ($data, $challenge): ?array {
+            $authorization = DB::table('helpdesk_native_authorization_codes')
+                ->where('code_hash', hash('sha256', $data['code']))
+                ->lockForUpdate()
+                ->first();
+
+            if (! $authorization) {
+                return null;
+            }
+
+            if (
+                $authorization->consumed_at !== null
+                || now()->greaterThanOrEqualTo($authorization->expires_at)
+                || ! hash_equals($authorization->client_id, $data['client_id'])
+                || ! hash_equals($authorization->redirect_uri, $data['redirect_uri'])
+                || $authorization->code_challenge_method !== 'S256'
+                || ! hash_equals($authorization->code_challenge, $challenge)
+            ) {
+                return null;
+            }
+
+            $user = User::query()->find($authorization->user_id);
+
+            if (! $user) {
+                return null;
+            }
+
+            DB::table('helpdesk_native_authorization_codes')
+                ->where('id', $authorization->id)
+                ->update([
+                    'consumed_at' => now(),
+                    'updated_at' => now(),
+                ]);
+
+            $token = $user->createToken(
+                'HelpdeskMac',
+                ['helpdesk:native'],
+                now()->addDays(
+                    (int) config('helpdesk-native.access_token_lifetime_days', 30)
+                )
+            );
+
+            return [
+                'access_token' => $token->plainTextToken,
+                'token_type' => 'Bearer',
+                'expires_at' => $token->accessToken->expires_at?->toIso8601String(),
+                'user' => [
+                    'id' => $user->getKey(),
+                    'name' => $user->name,
+                    'email' => $user->email,
+                ],
+            ];
+        });
+
+        if ($result === null) {
+            throw ValidationException::withMessages([
+                'code' => ['Invalid or expired authorization code.'],
+            ]);
+        }
+
+        return response()->json($result)
+            ->header('Cache-Control', 'no-store')
+            ->header('Pragma', 'no-cache');
+    }
+}