AccessTokenValidator
in package
Single place that decides whether an access token is still usable: signature and expiration ({@see JwtManager}) plus the `jti` deny-list ({@see JtiDenyList}).
IMPORTANT: admin and front checkAuthentication() must go through this service. Asking
only JwtManager::isExpired() leaves a revoked but unexpired token logged in.
IMPORTANT: a token without jti is treated as not revoked (as in the API guard and
LoginUser). Tokens issued before jti was introduced live until they expire;
rejecting them would log out every live session.
IMPORTANT: the deny-list is fail-open. When the backend (Redis/DB) does not answer,
isRevoked() returns false and the token is validated by signature and expiration only
(see JtiDenyList).
Table of Contents
Properties
Methods
- __construct() : mixed
- extractJti() : string
- Returns the `jti` claim of the token, or an empty string when it cannot be decoded or has no claim.
- isRevoked() : bool
- Returns whether the token is revoked although it has not expired yet.
- isUsable() : bool
- Returns whether the token is still usable: valid signature, not expired, not revoked.
- revokeUserTokens() : void
- Invalidates all access tokens issued so far to the user.
Properties
$jtiDenyList read-only
private
JtiDenyList
$jtiDenyList
$jwtManager read-only
private
JwtManager
$jwtManager
Methods
__construct()
public
__construct(JwtManager $jwtManager, JtiDenyList $jtiDenyList) : mixed
Parameters
- $jwtManager : JwtManager
- $jtiDenyList : JtiDenyList
extractJti()
Returns the `jti` claim of the token, or an empty string when it cannot be decoded or has no claim.
public
extractJti(string $token) : string
Parameters
- $token : string
Return values
stringisRevoked()
Returns whether the token is revoked although it has not expired yet.
public
isRevoked(string $token) : bool
A token is revoked when its jti is on the deny-list (logout) or when it was issued
before the revocation stamp of its user (ban, password change or reset; see
self::revokeUserTokens()). The check costs one extra Redis GET per request
(DB fallback: one primary-key SELECT); the stamp lives only jwt.ttl seconds.
Parameters
- $token : string
Return values
boolisUsable()
Returns whether the token is still usable: valid signature, not expired, not revoked.
public
isUsable(string $token) : bool
isExpired() is true also for a malformed or foreign-signed token (decode failure),
so tampering is covered too.
Parameters
- $token : string
Return values
boolrevokeUserTokens()
Invalidates all access tokens issued so far to the user.
public
revokeUserTokens(int $userId) : void
Called from UserRefreshTokenManager::revokeAllForUser(), so it applies wherever refresh tokens are revoked (ban, deactivation, password change or reset). Fail-open like the whole deny-list.
Parameters
- $userId : int