Login, Logout & Token Refresh

final class LoginUser
{
    public function execute(LoginUserData $data): array
    {
        if (! Auth::attempt(
            ['email' => $data->email, 'password' => $data->password],
            $data->remember
        )) {
            throw ValidationException::withMessages([
                'email' => [__('auth.failed')],
            ]);
        }

        $user = User::where('email', $data->email)->firstOrFail();

        return ['user' => $user->load('tenants')];
    }
}

final class AuthenticateViaOAuth
{
    public function execute(OAuthUserData $data): array
    {
        return DB::transaction(function () use ($data): array {
            // 1. Try to find existing user by OAuth provider + ID
            $user = User::where('oauth_provider', $data->provider)
                ->where('oauth_provider_id', $data->oauthId)
                ->first();

            $isNewUser = false;

            if (! $user) {
                // 2. Check if user exists with same email — link OAuth to existing account
                $user = User::where('email', $data->email)->first();

                if ($user) {
                    $user->update([
                        'oauth_provider' => $data->provider,
                        'oauth_provider_id' => $data->oauthId,
                        'avatar' => $data->avatar,
                    ]);
                } else {
                    // 3. Create new user + tenant
                    $isNewUser = true;
                    $user = User::create([
                        'name' => $data->name,
                        'email' => $data->email,
                        'oauth_provider' => $data->provider,
                        'oauth_provider_id' => $data->oauthId,
                        'avatar' => $data->avatar,
                        'email_verified_at' => now(), // OAuth emails are pre-verified
                    ]);

                    // Create first tenant
                    $tenant = $this->createTenant->execute(
                        new CreateTenantData(name: $user->name."'s Organization"),
                        $user,
                    );
                }
            }

            return ['user' => $user->load('tenants'), 'isNewUser' => $isNewUser];
        });
    }
}

public function exchange(
    ExchangeOAuthCodeRequest $request,
    RefreshAccessToken $refreshAction,
): JsonResponse {
    $dto = $request->toDto();

    $cached = Cache::pull("oauth_exchange:{$dto->code}");

    if ($cached === null) {
        return response()->json([
            'message' => __('auth.oauth_code_expired'),
            'code' => 'OAUTH_CODE_EXPIRED',
        ], 400);
    }

    $user = User::findOrFail($cached['user_id']);

    $isStateful = EnsureFrontendRequestsAreStateful::fromFrontend($request);

    if ($isStateful) {
        Auth::guard('web')->login($user);
        $request->session()->regenerate();
    } else {
        $tokens = $refreshAction->createTokenPair($user);
        $response['accessToken'] = $tokens['accessToken'];
        $response['refreshToken'] = $tokens['refreshToken'];
    }

    return response()->json($response);
}

public function execute(string $refreshTokenString): array
{
    $hashedToken = hash('sha256', $refreshTokenString);
    $refreshToken = RefreshToken::where('token', $hashedToken)->first();

    if (! $refreshToken) {
        throw ValidationException::withMessages([
            'refresh_token' => [__('auth.invalid_refresh_token')],
        ]);
    }

    // Token reuse detection — potential theft
    if ($refreshToken->isRevoked()) {
        $refreshToken->revokeFamily();  // Revoke ALL tokens in this family
        throw ValidationException::withMessages([
            'refresh_token' => [__('auth.refresh_token_reused')],
        ]);
    }

    if ($refreshToken->isExpired()) {
        throw ValidationException::withMessages([
            'refresh_token' => [__('auth.refresh_token_expired')],
        ]);
    }

    return DB::transaction(function () use ($refreshToken): array {
        $user = $refreshToken->user;

        // Revoke current token (rotation)
        $refreshToken->revoke();

        // Create new token in the same family
        $newRefreshTokenString = Str::random(64);
        RefreshToken::create([
            'user_id' => $user->id,
            'token' => hash('sha256', $newRefreshTokenString),
            'family' => $refreshToken->family,
            'expires_at' => now()->addDays(self::REFRESH_TOKEN_EXPIRATION_DAYS),
        ]);

        $accessToken = $user->createToken('auth-token')->plainTextToken;

        return [
            'user' => $user->load('tenants'),
            'accessToken' => $accessToken,
            'refreshToken' => $newRefreshTokenString,
        ];
    });
}

public function logout(Request $request, LogoutUser $action): JsonResponse
{
    $user = $request->user();

    if ($user) {
        $action->execute($user); // Deletes access token + revokes refresh tokens
    }

    // Clear the guard's cached user BEFORE invalidating the session.
    // Without this, AuthenticateSession middleware stores the current
    // user's password hash in the new session, causing a 401 on the
    // next login by a different user.
    Auth::guard('web')->logout();

    if ($request->hasSession()) {
        $request->session()->invalidate();
        $request->session()->regenerateToken();
    }

    return response()->json(['message' => __('auth.logout_success')]);
}

const { checkAuth, requireAuth, requireGuest, startPeriodicRefresh, stopPeriodicRefresh } = useSession()

// In a page or middleware
await checkAuth()         // Initialize auth if not done yet
await requireAuth()       // Redirect to /login if not authenticated
await requireGuest()      // Redirect to /dashboard if already authenticated

// Optional: refresh user profile periodically
startPeriodicRefresh(300_000) // Every 5 minutes