Tokeny a relácie

use RoundlyConsulting\Auth\Facades\Authentication;

$guard   = Authentication::guard('users');
$context = $guard->contextFrom($request);
$current = $guard->tokenFrom($request);                    // jti, sid, auth_time, amr

$pair = $guard->refresh($refreshToken, $context);          // rotates within the same session; the previous access token stops working

$guard->sessions($user, $current->sessionId);              // Collection<SessionData>, current flagged
$guard->logout($user, $current);                           // this device
$guard->logoutSession($user, $sessionId);                  // one device
$revoked = $guard->logoutOthers($user, $current);          // every other device
$revoked = $guard->logoutEverywhere($user);                // tv++ and every session

'tokens' => [
    'access_ttl' => null,                // seconds; null → jwt.ttl
    'refresh_ttl' => 2_592_000,          // sliding, 30 days
    'refresh_absolute_ttl' => 7_776_000, // 90 days; 0 = no cap
    'claims_resolver' => DefaultClaimsResolver::class,
    'include_email' => true,
],

'sessions' => [
    'max_active' => null,                // int|null — oldest sessions revoked above the cap
],

'invalidation' => [                      // none|others|all  (account_disabled is always all)
    'password_changed' => 'others',
    'password_reset' => 'all',
    'email_changed' => 'others',
    'two_factor_changed' => 'others',
    'passkey_changed' => 'none',
],

use RoundlyConsulting\Auth\Contracts\Account;
use RoundlyConsulting\Auth\Contracts\ResolvesAccessTokenClaims;
use RoundlyConsulting\Auth\DataTransferObjects\AccessTokenClaims;
use RoundlyConsulting\Auth\Guards\GuardConfig;

// config: 'guards' => ['users' => ['tokens' => ['claims_resolver' => PermissionsClaims::class]]]

final class PermissionsClaims implements ResolvesAccessTokenClaims
{
    public function resolve(Account $account, GuardConfig $guard): AccessTokenClaims
    {
        return new AccessTokenClaims(
            email: $account->accountEmail(),
            emailVerified: $account->hasVerifiedEmail(),
            permissions: $account->permissions()->pluck('name')->all(),
            extra: ['tenant' => $account->tenant_id],
        );
    }
}