JWT Lifecycle

JWT yang diterbitkan dazoapp adalah kontrak lintas-service. Frontend memakainya untuk mengakses backend Go dan seluruh microservice lain. Ini bukan auth internal.

Ringkasan alur

ISSUE:
  Login (password / Google SSO / QuickLogin admin)
    → auth('api')->attempt() / login() / JWTAuth::fromUser()
    → Tymon generate JWT dengan claim standar (sub, iat, exp, nbf, iss, jti, prv)
    → claim custom = KOSONG (tidak ada store_id/role di token)
    → response: { access_token, expires_in: 3600, user }

REFRESH:
  POST /api/refresh (Authorization: Bearer <old token>)
    → auth('api')->refresh(true, true)
    → old token di-blacklist (tidak bisa dipakai lagi)
    → new token di-issue (TTL sama: 60 menit)
    → response: { access_token, expires_in }

CROSS-SERVICE:
  Frontend → backend Go (url_api) pakai axios polos
    → Authorization: Bearer <token>  (TAPI axios polos tidak auto-attach)
    → backend Go verifikasi pakai secret bersama JWT_SECRET

1. Token issuance

Titik penerbitan

Claim/payload

Claim standar (config/jwt.php:149-156):

• sub — user ID (MongoDB UUID string) dari User::getJWTIdentifier() (User.php:60-63)
• iat, exp, nbf, iss, jti — standar Tymon
• prv — otomatis aktif (config/jwt.php:193 lock_subject = true) untuk mencegah cross-model impersonation

TTL

expires_in di response = auth('api')->factory()->getTTL() * 60 (detik) — AuthService.php:160.

Secret

config/jwt.php:28 — 'secret' => env('JWT_SECRET'). Algoritma HS256 (config/jwt.php:136).

2. Refresh flow

Endpoint

POST /api/refresh (routes/api.php:85) → AuthController@refresh (AuthController.php:35-38) → AuthService::refresh() (AuthService.php:178-196).

Verifikasi & rotation

• Tymon verifikasi signature + exp dari token lama
• Token lama harus masih dalam window refresh_ttl (10.000 menit) sejak iat asli
• auth('api')->refresh(true, true) (AuthService.php:181):
  • Argumen 1 forceBlacklist=true — token lama di-blacklist, tidak bisa dipakai lagi
  • Argumen 2 blacklistEmulate=true — emulate blacklist behavior
• Blacklist aktif (config/jwt.php:222 JWT_BLACKLIST_ENABLED=true), storage default cache Illuminate (config/jwt.php:299)

Token expired saat request

Tymon lempar TokenExpiredException. Di AuthService.php:191-195 catch jadi AuthenticationException (401). Frontend axiosInstance.js:46:

1. POST /api/refresh pakai access token lama di header Authorization
2. Simpan access token baru ke localStorage
3. Replay request
4. Kalau refresh gagal, localStorage.clear() + router.post('/logout') (axiosInstance.js:74-76)

3. Cross-service usage

Service yang memakai JWT dazoapp

Cara frontend kirim token

Authorization: Bearer {token} header. resources/js/services/axiosInstance.js:12-22 — interceptor request ambil localStorage.getItem('access_token'), set header Authorization.

Token exchange vs langsung

Frontend memanggil backend Go (url_api) langsung pakai JWT dazoapp lewat axios. Tidak ada token exchange.

URL service di frontend

4. Guard & middleware

Guard

Guard api dengan driver jwt — config/auth.php:43-46. Provider users = Eloquent App\Models\User (config/auth.php:67-70).

User model implement Tymon\JWTAuth\Contracts\JWTSubject (User.php:11,15).

Middleware

• auth:api HANYA dipakai di 1 route group: routes/api.php:86-89 (/testjwt, /logout)
• Mayoritas route API pakai auth:sanctum (sanctum stateful via session cookie, bukan JWT)
• Tidak ada middleware alias jwt.auth / jwt.verify terdaftar di app/Http/Kernel.php:59-75. Tymon default dimasukkan via auth:api guard driver

Scope/role check

user_store pivot di-load saat auth

Eager loading: Auth::user()->loadMissing(['store', 'user_store.store']) — pola dominan (HandleInertiaRequests.php:52, BroadcastchatController.php:517, dst). Relasi User->user_store() = belongsTo(UserStore, 'id', 'user_id') (User.php:45-48). Bukan dari JWT, tapi query DB setelah auth resolve.

Inkonsistensi host engine WA

Jangan pilih sendiri — butuh konfirmasi user. Lihat External Services.

Yang tidak boleh diubah sendiri

Referensi file