Manages authentication tokens in the MishkaCMS system.
This resource serves as the token store for AshAuthentication, handling the lifecycle of JWT tokens used throughout the authentication system. It stores tokens for various purposes including authentication, password reset, magic links, and session management. The resource tracks token metadata including JTI (JWT ID), subject (user identifier), expiration times, and any additional data associated with the token.
Tokens can be revoked individually or in bulk for a specific subject, enabling secure session management and the ability to log users out across all devices. The resource provides automatic expiration handling with the ability to purge expired tokens from the database. Token revocation is implemented through revocation tokens that mark specific JTIs as invalid.
Access to this resource is strictly controlled through policies that only allow AshAuthentication to interact with tokens directly, preventing unauthorized token manipulation. The resource supports various token operations including storage, retrieval, revocation, and validation checks, forming the backbone of the system's token-based authentication infrastructure.
Revoking
revoke/1, revoke_unissued/1 and revoke_minted/1 are the ways this application revokes a
token. Each answers :ok or {:error, error} and never raises, so a caller that says "logged
out" knows whether the token still works. revoked/1 asks whether one already was. failure/1
names a failed revocation for a log line without the token in it.
Summary
Functions
What failed, for a log line: the modules of the errors and nothing of their values, which can hold the token.
Validates that the keys in the provided input are valid for at least one action on the resource.
Same as input/1, except restricts the keys to values accepted by the action provided.
Revokes token, a token this application signed and handed out. :ok when it no longer works,
{:error, error} when it may still.
revoke_unissued/1 for the token AshAuthentication put on user's metadata as it signed them
in; :ok for a user that carries none.
Revokes token, one that was signed and never handed to anybody — a sign-in turned away after
AshAuthentication had already minted its token — so no unused one is left valid.
Whether token has been revoked: {:ok, true | false}, or {:error, error} when the revocation
list could not be read. AshAuthentication's own token_revoked?/3 answers true for a list it
could not read, which would let a caller report a token as ended that may still work.
Types
@type t() :: %MishkaCmsCore.Accounts.Token{ __lateral_join_source__: term(), __meta__: term(), __metadata__: term(), __order__: term(), aggregates: term(), calculations: term(), created_at: term(), expires_at: term(), extra_data: term(), jti: term(), purpose: term(), subject: term(), updated_at: term() }
Functions
What failed, for a log line: the modules of the errors and nothing of their values, which can hold the token.
Validates that the keys in the provided input are valid for at least one action on the resource.
Raises a KeyError error at compile time if not. This exists because generally a struct should only ever
be created by Ash as a result of a successful action. You should not be creating records manually in code,
e.g %MyResource{value: 1, value: 2}. Generally that is fine, but often with embedded resources it is nice
to be able to validate the keys that are being provided, e.g
Resource
|> Ash.Changeset.for_create(:create, %{embedded: EmbeddedResource.input(foo: 1, bar: 2)})
|> Ash.create()Same as input/1, except restricts the keys to values accepted by the action provided.
Revokes token, a token this application signed and handed out. :ok when it no longer works,
{:error, error} when it may still.
revoke_unissued/1 for the token AshAuthentication put on user's metadata as it signed them
in; :ok for a user that carries none.
Revokes token, one that was signed and never handed to anybody — a sign-in turned away after
AshAuthentication had already minted its token — so no unused one is left valid.
:ok, or {:error, error} once the failure is logged.
Whether token has been revoked: {:ok, true | false}, or {:error, error} when the revocation
list could not be read. AshAuthentication's own token_revoked?/3 answers true for a list it
could not read, which would let a caller report a token as ended that may still work.