Laravel Passport 13.x

[hafezdivandari]

It's about time we released Laravel Passport 13.x, but we are being held back due to unmerged PRs in this repo after 8 months!

There are 4 bugs, that I've previously sent PRs to address them:

• Fix scope on device code grant #1412
• Fix including interval in response of device authorization request #1410
• Fix issue and persist a new refresh token when revoking refresh token is disabled #1449
• Fix "state" parameter of error responses #1298

And also 4 more PRs which would be really appreciated if we can merge before major Passport release:

• Validate confidential clients and determine if the client handles the grant type #1420
• Fix key files permission on Windows #1447
• Allow configuring the JWT builder when generating a token #1328 (TBD later)
• Add PHP 8.4 support #1454
• Fix Events and add TODOs for the next major release #1467

Originally posted by @hafezdivandari in laravel/passport#1748 (comment)

[Sephster]

Thanks for your patience and work on this @hafezdivandari - as noted, I had an emergency at work which I'm sure you will appreciate, takes precedence over work I do in my free time. I'm available to start looking at this now though and had planned on doing so this evening. Thanks

[hafezdivandari]

@Sephster Are you available to review the remaining PRs? PR #1420 is particularly important, and the device authorization grant is currently unusable due to its bugs.

[Sephster]

Just a quick update. I haven't forgotten about this @hafezdivandari and have started reviewing 1412. I'll aim to have another two PRs reviewed this week. Cheers!

[hafezdivandari]

Thank you @Sephster, as I said the #1420 is the most important one for us. All PRs all small and I'm sure won't get more than 1 hour of your time in total, I'm available for any question you may have to make them easier for review.

[Sephster]

As with anything, it is just double checking the specs that is the slow part really. I put in well over a year to the device code grant. It went through numerous iterations and a release candidate with everything fully tested and still compliance issues slipped through :) Thank you for all your help with this though and I will be sure to shout should I need anything!

[hafezdivandari]

Totally understandable, I tried to mention the related spec section on each PR (I'll recheck them all again), and added tests wherever required.

[hafezdivandari]

Hi @Sephster would you please consider reviewing #1420? It is an important one for us, we can finalize Passport release after this one, thanks.

[Sephster]

Next on the list. I did take a look tonight but quite a few moving parts to it. Will get to it asap

[Sephster]

@hafezdivandari I will pick up #1420 tonight to try get it progressed but I think there is already no blockers here for Passport being upgraded if you wanted to progress this with Laravel? Anyways, I will pick it up tonight. I think that the JWT builder ticket should be handled separately to draw a close to this and get the package upgraded. Thanks for your patience

[hafezdivandari]

@Sephster The #1420 is important as we have added grant_types to client on Passport 13.x and it won't work as expected without merging that PR. Also #1410 is merged but not release yet, the changelog is wrong currently I've fixed the changelog on #1467. We can postpone #1328 for later.

[mhdcodes]

Hello everyone, I just wanted to weigh in on this issue. We're using Passport in production and have been affected by this laravel/passport#1790 I believe it impacts many users more precisely people using short lived access tokens. We're eagerly awaiting the Passport 13 release to resolve this for us.

thank you @hafezdivandari @Sephster for the great work you put into this.

[hafezdivandari]

Hi @Sephster, any progress on this?

[hafezdivandari]

Hi @Sephster, it's been over two weeks since your last comment. Would it help to bring more people on board if you don’t have time to maintain this package?

#1410 is merged but not released.
#1467 fixes some bug and the changelog entry.
#1420 is pending review.

[Sephster]

I'll aim to look at this as soon as I can. I have started the review but it is complicated by the fact that the PR is addressing multiple issues at once which is making it slow going. I'm hopeful it won't be much longer.