# `MishkaCmsCore.Accounts.Token`
[🔗](https://github.com/mishka-group/mishka_cms_core/blob/v0.0.1/lib/mishka_cms_core/accounts/token.ex#L5)

Manages authentication tokens in the MishkaCMS system.

This resource serves as the token store for AshAuthentication, handling the lifecycle
of JWT tokens used throughout the authentication system. It stores tokens for various
purposes including authentication, password reset, magic links, and session management.
The resource tracks token metadata including JTI (JWT ID), subject (user identifier),
expiration times, and any additional data associated with the token.

Tokens can be revoked individually or in bulk for a specific subject, enabling secure
session management and the ability to log users out across all devices. The resource
provides automatic expiration handling with the ability to purge expired tokens from
the database. Token revocation is implemented through revocation tokens that mark
specific JTIs as invalid.

Access to this resource is strictly controlled through policies that only allow
AshAuthentication to interact with tokens directly, preventing unauthorized token
manipulation. The resource supports various token operations including storage,
retrieval, revocation, and validation checks, forming the backbone of the system's
token-based authentication infrastructure.

## Revoking

`revoke/1`, `revoke_unissued/1` and `revoke_minted/1` are the ways this application revokes a
token. Each answers `:ok` or `{:error, error}` and never raises, so a caller that says "logged
out" knows whether the token still works. `revoked/1` asks whether one already was. `failure/1`
names a failed revocation for a log line without the token in it.

# `t`

```elixir
@type t() :: %MishkaCmsCore.Accounts.Token{
  __lateral_join_source__: term(),
  __meta__: term(),
  __metadata__: term(),
  __order__: term(),
  aggregates: term(),
  calculations: term(),
  created_at: term(),
  expires_at: term(),
  extra_data: term(),
  jti: term(),
  purpose: term(),
  subject: term(),
  updated_at: term()
}
```

# `default_short_name`

# `failure`

```elixir
@spec failure(term()) :: String.t()
```

What failed, for a log line: the modules of the errors and nothing of their values, which can hold
the token.

# `input`

```elixir
@spec input(values :: map() | Keyword.t()) :: map() | no_return()
```

Validates that the keys in the provided input are valid for at least one action on the resource.

Raises a KeyError error at compile time if not. This exists because generally a struct should only ever
be created by Ash as a result of a successful action. You should not be creating records manually in code,
e.g `%MyResource{value: 1, value: 2}`. Generally that is fine, but often with embedded resources it is nice
to be able to validate the keys that are being provided, e.g

```elixir
Resource
|> Ash.Changeset.for_create(:create, %{embedded: EmbeddedResource.input(foo: 1, bar: 2)})
|> Ash.create()
```

# `input`

```elixir
@spec input(values :: map() | Keyword.t(), action :: atom()) :: map() | no_return()
```

Same as `input/1`, except restricts the keys to values accepted by the action provided.

# `primary_key_matches?`

# `revoke`

```elixir
@spec revoke(String.t()) :: :ok | {:error, term()}
```

Revokes `token`, a token this application signed and handed out. `:ok` when it no longer works,
`{:error, error}` when it may still.

# `revoke_minted`

```elixir
@spec revoke_minted(struct()) :: :ok | {:error, term()}
```

`revoke_unissued/1` for the token AshAuthentication put on `user`'s metadata as it signed them
in; `:ok` for a user that carries none.

# `revoke_unissued`

```elixir
@spec revoke_unissued(String.t()) :: :ok | {:error, term()}
```

Revokes `token`, one that was signed and never handed to anybody — a sign-in turned away after
AshAuthentication had already minted its token — so no unused one is left valid.

`:ok`, or `{:error, error}` once the failure is logged.

# `revoked`

```elixir
@spec revoked(String.t()) :: {:ok, boolean()} | {:error, term()}
```

Whether `token` has been revoked: `{:ok, true | false}`, or `{:error, error}` when the revocation
list could not be read. AshAuthentication's own `token_revoked?/3` answers `true` for a list it
could not read, which would let a caller report a token as ended that may still work.

---

*Consult [api-reference.md](api-reference.md) for complete listing*