oauth2.php library

Path in the Gestor bibliotecas/oauth2.php

Issues and validates the tokens external systems use to call the Gestor API (_api/…). It is not the social login (oauth.php).

Tokens

oauth2_gerar_token_client_credentials(['id_usuarios' => …, 'grant_type' => 'client_credentials', 'scope' => …]) takes an already authenticated user and returns:

{ "access_token": "…", "token_type": "Bearer", "expires_in": 3600, "refresh_token": "…", "scope": "read" }

• Both tokens use the Gestor JWT format, signed with the site's private RSA key (chaves/gestor/privada.key, via autenticacao_gerar_jwt_chave_privada()).

• Each one has a random pubID, stored in oauth2_tokens with the USUARIO_HASH_PASSWORD HMAC, IP, User-Agent and expiration. Revoking a token means deleting the row.

• Lifetime: oauth2.token-expiration (3600 s) and oauth2.refresh-token-expiration (30 days), from $_CONFIG.

• A user has at most oauth2.maximo-tokens-usuario (5) active access tokens: the oldest is revoked (oauth2_fifo_ids_para_revogar()).

• Every issuance first deletes the expired tokens of all users (oauth2_limpar_tokens_expirados()).

Validating and renewing

• oauth2_autorizar_requisicao() reads Authorization: Bearer <token> and calls oauth2_validar_token(), which checks the signature with the public key, the pubID and HMAC in the database, the access type, the expiration and whether the user is active. It returns id_usuarios, nome, email, usuario, id_usuarios_perfis and scope, or false.

• oauth2_renovar_token(['refresh_token' => …]) validates the refresh token, deletes it (single use) and issues a new pair. The previous access token stays valid until it expires.

Functions

oauth2_fifo_ids_para_revogar($tokens, $maximo)

oauth2_gerar_token_client_credentials(array $params = false): array|false

oauth2_validar_token(array $params = false): array|false

oauth2_autorizar_requisicao(array $params = false): array|false

oauth2_limpar_tokens_expirados(): bool

oauth2_renovar_token(array $params = false): array|false