Skip to content

Conversation

@devin-ai-integration
Copy link
Contributor

Summary

Updates the laravel-mongodb-passport package to support Laravel 8, Passport 10, and their updated dependencies. This is a breaking change that drops support for Laravel 6/7 and Passport 8/9.

Key changes:

  • PSR-7 implementation: Switched from laminas/diactoros to nyholm/psr7 (required by Passport 10)
  • JWT library: Updated from lcobucci/jwt v3.3.3 to v4.0+ with new API (claims()->get() instead of getClaim())
  • ServerRequest fix: nyholm/psr7's ServerRequest requires constructor arguments, fixed with new ServerRequest('POST', '')
  • Hashed secrets support: Added support for Passport::$hashesClientSecrets feature

Review & Testing Checklist for Human

  • Verify nyholm/psr7 ServerRequest usage: The constructor now passes 'POST', '' as required args - confirm this works correctly with the OAuth2 authorization server
  • Test personal access token creation: This is the primary functionality affected - test PersonalAccessTokenFactory::make() in auth-api to ensure tokens are created and parsed correctly
  • Verify JWT v4 claim parsing: The claims()->get('jti') call in findAccessToken() is critical for token lookup - ensure this returns the correct token ID
  • Check constructor backward compatibility: The $jwt parameter is now optional/untyped - verify this doesn't break dependency injection in consuming applications

Recommended test plan:

  1. Run auth-api tests that use PersonalAccessTokenFactory (e.g., CustomOAuthEndpointsTest::testSingleCodeLogin* tests)
  2. Manually test creating a personal access token via the API
  3. Verify token introspection works with newly created tokens

Notes

This PR is part of the Laravel 8 upgrade for auth-api. The auth-api upgrade depends on these changes to fix 500 errors in tests that use PersonalAccessTokenFactory.

Link to Devin run: https://app.devin.ai/sessions/da4c6724a60445beb1dadd33270c5551
Requested by: james.osullivan@theaccessgroup.com

…nyholm/psr7

- Update composer.json to require Laravel 8, Passport 10, lcobucci/jwt ^4.0, nyholm/psr7 ^1.0
- Update PersonalAccessTokenFactory to use Nyholm\Psr7\ServerRequest with required constructor args
- Update JWT parsing to use lcobucci/jwt v4 API (claims()->get() instead of getClaim())
- Support Passport::hashesClientSecrets for client secret handling
- Update PHPUnit to ^9.0 for PHP 7.4+ compatibility

Co-Authored-By: james.osullivan@theaccessgroup.com <james.osullivan@theaccessgroup.com>
@devin-ai-integration
Copy link
Contributor Author

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

  • Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
  • Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

  • Disable automatic comment and CI monitoring

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants