adalal/solidtime
1
0
Fork 0
mirror of https://github.com/solidtime-io/solidtime.git synced 2026-10-08 05:43:18 +01:00
Code Issues Packages Projects Releases Wiki Activity

Added deletion of refresh tokens in DeletionService

Browse Source
This commit is contained in:
Constantin Graf
2026-09-24 13:14:54 +02:00
committed by Constantin Graf
parent 2ebbbceefb
commit a9d016d773
2 changed files with 50 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
app/Service/DeletionService.php
View File

@@ -11,6 +11,7 @@ use App\Models\Client;
use App\Models\Member;
use App\Models\Organization;
use App\Models\OrganizationInvitation;
use App\Models\Passport\RefreshToken;
use App\Models\Project;
use App\Models\ProjectMember;
use App\Models\Report;
@@ -169,6 +170,10 @@ class DeletionService
}
}
// Refresh tokens are not linked to the user directly, so they need to be deleted via their access tokens.
// Otherwise a still-valid refresh token could be used to issue a new access token for a deleted user,
// which fails with a foreign key violation on oauth_access_tokens.user_id.
RefreshToken::query()->whereIn('access_token_id', $user->accessTokens()->pluck('id'))->delete();
$user->accessTokens()->delete();
$user->authCodes()->delete();