diff --git a/CHANGELOG.md b/CHANGELOG.md index 0dc47702..8276a763 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,12 +7,27 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 You can find and compare releases at the GitHub release page. ## [Unreleased] -- SetSecret regenerates config with new secret in the Lcobucci provider + +### Added +- Fixes #259 - Can't logout with an expired token + +### Removed + +## [2.6.0] 2024-07-11 + +### Added +- New `getUserId` method + +## [2.5.0] 2024-07-03 + +### Added - Refresh iat claim when refreshing a token +## [2.4.0] 2024-05-27 + ### Added - Support for lcobucci/jwt^5.0 (and dropped support for ^4.0) -- New `getUserId` method +- SetSecret regenerates config with new secret in the Lcobucci provider ## [2.3.0] 2024-05-09 diff --git a/src/JWTGuard.php b/src/JWTGuard.php index 534bcb7e..21f5531a 100644 --- a/src/JWTGuard.php +++ b/src/JWTGuard.php @@ -200,7 +200,11 @@ public function login(JWTSubject $user) */ public function logout($forceForever = false) { - $this->requireToken()->invalidate($forceForever); + try { + $this->requireToken()->invalidate($forceForever); + } catch (JWTException $e) { + // Proceed with the logout as normal if we can't invalidate the token + } $this->fireLogoutEvent($this->user); diff --git a/tests/JWTGuardTest.php b/tests/JWTGuardTest.php index cd7c99ec..825f71bb 100644 --- a/tests/JWTGuardTest.php +++ b/tests/JWTGuardTest.php @@ -22,6 +22,7 @@ use Illuminate\Http\Request; use Mockery\LegacyMockInterface; use PHPOpenSourceSaver\JWTAuth\Exceptions\JWTException; +use PHPOpenSourceSaver\JWTAuth\Exceptions\TokenExpiredException; use PHPOpenSourceSaver\JWTAuth\Exceptions\UserNotDefinedException; use PHPOpenSourceSaver\JWTAuth\Factory; use PHPOpenSourceSaver\JWTAuth\JWT; @@ -353,6 +354,25 @@ public function testItShouldLogoutTheUserByInvalidatingTheToken() $this->assertNull($this->guard->getUser()); } + public function testItShouldLogoutTheUserEvenWithExpiredToken() + { + $this->jwt->shouldReceive('setRequest')->andReturn($this->jwt); + $this->jwt->shouldReceive('getToken')->once()->andReturn(true); + $this->jwt->shouldReceive('invalidate')->andThrow(TokenExpiredException::class); + $this->jwt->shouldReceive('unsetToken')->once(); + + $this->eventDispatcher->shouldReceive('dispatch') + ->never() + ->with(\Mockery::type(Authenticated::class)); + + $this->eventDispatcher->shouldReceive('dispatch') + ->once() + ->with(\Mockery::type(Logout::class)); + + $this->guard->logout(); + $this->assertNull($this->guard->getUser()); + } + public function testItShouldRefreshTheToken() { $this->jwt->shouldReceive('setRequest')->andReturn($this->jwt);