DbJtiDenyList
in package
implements
JtiDenyList
DB-backed deny-list, a fallback for hosting without Redis.
The self::TABLE table holds a row (jti, expires_at). Expired rows are deleted
periodically by the Cron:System:JwtDenyListCleanup cron through self::purgeExpired().
IMPORTANT: fail-open. Any DBAL error is logged and the method behaves as if the deny-list did not exist, so a revoked token passes whenever the database fails.
Table of Contents
Interfaces
- JtiDenyList
- Deny-list for the JWT `jti` claim.
Constants
- TABLE : mixed = 'cms_system_jwt_denylist'
Properties
- $connection : Connection
Methods
- __construct() : mixed
- isRevoked() : bool
- isUserRevoked() : bool
- Returns whether the user's token (claims `iat` and `exp`) is revoked by the stamp of {@see self::revokeUser()}.
- purgeExpired() : int
- Deletes expired rows; called by the `Cron:System:JwtDenyListCleanup` cron.
- revoke() : void
- revokeUser() : void
- Stores a `user:<id>` row in the same table.
- userKey() : string
Constants
TABLE
private
mixed
TABLE
= 'cms_system_jwt_denylist'
Properties
$connection read-only
private
Connection
$connection
Methods
__construct()
public
__construct(Connection $connection) : mixed
Parameters
- $connection : Connection
isRevoked()
public
isRevoked(string $jti) : bool
Parameters
- $jti : string
Return values
boolisUserRevoked()
Returns whether the user's token (claims `iat` and `exp`) is revoked by the stamp of {@see self::revokeUser()}.
public
isUserRevoked(int $userId, int $issuedAt, int $expiresAt) : bool
A token issued in the same second as the stamp stays valid, because after a password change the presenter issues a new pair in the same request.
Parameters
- $userId : int
- $issuedAt : int
- $expiresAt : int
Return values
boolpurgeExpired()
Deletes expired rows; called by the `Cron:System:JwtDenyListCleanup` cron.
public
purgeExpired() : int
Return values
int —number of deleted rows
revoke()
public
revoke(string $jti, int $ttlSeconds) : void
Parameters
- $jti : string
- $ttlSeconds : int
revokeUser()
Stores a `user:<id>` row in the same table.
public
revokeUser(int $userId, int $ttlSeconds) : void
expires_at is the revocation time plus $ttlSeconds (jwt.ttl). A token is revoked
when it expires before the stamp (exp < expires_at), i.e. it was issued before the
revocation, so no extra column is needed. Repeated revocation moves the stamp. The same
cron cleans these rows as the jti ones.
Parameters
- $userId : int
- $ttlSeconds : int
userKey()
private
static userKey(int $userId) : string
Parameters
- $userId : int