markitosgv / JWTRefreshTokenBundle / 30879373193

100%

push

github

feat: limit how many refresh tokens a user may hold

Each login stores a token, deliberately, so that a user's devices are separate
sessions. Nothing bounded how many of them accumulated: an application wanting a
device limit had to write it, and there was no way to revoke a user's oldest
sessions without revoking all of them.

max_tokens_per_user revokes past the newest N once a login has been stored, so
it is the login that just succeeded that is kept. Newest is by expiry, which
with ttl_update on is least recently used, and expired tokens sort last so a
live session is never given up while a dead one is kept.

revokeAllButNewestForUser() and deleteAllButNewestForUser() go on the interfaces
added this cycle, so nothing released has to change. The DBAL manager now
implements RevokeRefreshTokenManagerInterface as well, which it did not, so the
limit is not silently unenforced there. A manager that cannot revoke is told so
rather than left appearing to apply a limit it is not applying.

A shared contract suite holds all three backends to the same behaviour.

79 of 80 new or added lines in 7 files covered. (98.75%)

1188 of 1219 relevant lines covered (97.46%)

16.33 hits per line