feat(auth): implement token expiration for personal access tokens and update tests

.env.example

@@ -35,6 +35,8 @@ SESSION_ENCRYPT=false
 SESSION_PATH=/
 SESSION_DOMAIN=null
 
+SANCTUM_EXPIRATION=720
+
 BROADCAST_CONNECTION=log
 FILESYSTEM_DISK=local
 QUEUE_CONNECTION=database

app/Domains/Auth/Controllers/LoginController.php

@@ -26,7 +26,12 @@ class LoginController extends Controller
             ]);
         }
 
-        $token = $user->createToken('api-token')->plainTextToken;
+        $expirationMinutes = (int) config('sanctum.expiration');
+        $token = $user->createToken(
+            'api-token',
+            ['*'],
+            now()->addMinutes($expirationMinutes),
+        )->plainTextToken;
 
         return response()->json([
             'message' => 'Sesion iniciada correctamente.',

composer.json

@@ -10,7 +10,7 @@
         "laravel/framework": "^13.8",
         "laravel/sanctum": "^4.3",
         "laravel/tinker": "^3.0",
-        "league/flysystem-aws-s3-v3": "3.0"
+        "league/flysystem-aws-s3-v3":  "^3.0"
     },
     "require-dev": {
         "fakerphp/faker": "^1.23",

composer.lock

@@ -4,7 +4,7 @@
         "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
         "This file is @generated automatically"
     ],
-    "content-hash": "08dac456d84023cd816d5c96086a3b3c",
+    "content-hash": "15f02d79a83b338e4181fb79dcd0a600",
     "packages": [
         {
             "name": "aws/aws-crt-php",
@@ -1958,21 +1958,21 @@
         },
         {
             "name": "league/flysystem-aws-s3-v3",
-            "version": "3.0.0",
+            "version": "3.35.2",
             "source": {
                 "type": "git",
                 "url": "https://github.com/thephpleague/flysystem-aws-s3-v3.git",
-                "reference": "f8ba6a92a5c1fdcbdd89dede009a1e6e1b93ba8c"
+                "reference": "8475ef9adfc6498b85469e2abec6fe3118cd08c4"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/thephpleague/flysystem-aws-s3-v3/zipball/f8ba6a92a5c1fdcbdd89dede009a1e6e1b93ba8c",
-                "reference": "f8ba6a92a5c1fdcbdd89dede009a1e6e1b93ba8c",
+                "url": "https://api.github.com/repos/thephpleague/flysystem-aws-s3-v3/zipball/8475ef9adfc6498b85469e2abec6fe3118cd08c4",
+                "reference": "8475ef9adfc6498b85469e2abec6fe3118cd08c4",
                 "shasum": ""
             },
             "require": {
-                "aws/aws-sdk-php": "^3.132.4",
-                "league/flysystem": "^2.0.0 || ^3.0.0",
+                "aws/aws-sdk-php": "^3.371.5",
+                "league/flysystem": "^3.10.0",
                 "league/mime-type-detection": "^1.0.0",
                 "php": "^8.0.2"
             },
@@ -2007,10 +2007,9 @@
                 "storage"
             ],
             "support": {
-                "issues": "https://github.com/thephpleague/flysystem-aws-s3-v3/issues",
-                "source": "https://github.com/thephpleague/flysystem-aws-s3-v3/tree/3.0.0"
+                "source": "https://github.com/thephpleague/flysystem-aws-s3-v3/tree/3.35.2"
             },
-            "time": "2022-01-13T21:11:49+00:00"
+            "time": "2026-07-01T23:25:49+00:00"
         },
         {
             "name": "league/flysystem-local",

config/filesystems.php

@@ -54,6 +54,8 @@ return [
             'region' => env('AWS_DEFAULT_REGION'),
             'bucket' => env('AWS_BUCKET'),
             'url' => env('AWS_URL'),
+            'visibility' => 'private',
+            'retain_visibility' => false,
             'endpoint' => env('AWS_ENDPOINT'),
             'use_path_style_endpoint' => env('AWS_USE_PATH_STYLE_ENDPOINT', false),
             'http' => [

config/sanctum.php

@@ -50,7 +50,7 @@ return [
     |
     */
 
-    'expiration' => null,
+    'expiration' => (int) env('SANCTUM_EXPIRATION', 720),
 
     /*
     |--------------------------------------------------------------------------

tests/Feature/Auth/LoginControllerTest.php

@@ -34,6 +34,12 @@ class LoginControllerTest extends TestCase
 
         $this->assertIsString($response->json('token'));
         $this->assertNotEmpty($response->json('token'));
+        $accessToken = $user->tokens()->sole();
+        $this->assertTrue(
+            $accessToken->expires_at->equalTo(
+                $accessToken->created_at->copy()->addMinutes(config('sanctum.expiration'))
+            )
+        );
 
         $this->withHeader('Authorization', 'Bearer '.$response->json('token'))
             ->getJson('/api/me')
@@ -42,6 +48,21 @@ class LoginControllerTest extends TestCase
             ->assertJsonPath('email', 'grace@example.com');
     }
 
+    public function test_personal_access_tokens_expire_after_twelve_hours(): void
+    {
+        $this->travelTo(now()->startOfSecond());
+
+        $user = User::factory()->create();
+        $token = $user->createToken('api-token')->plainTextToken;
+
+        $this->travel(12)->hours();
+        $this->travel(1)->minutes();
+
+        $this->withHeader('Authorization', 'Bearer '.$token)
+            ->getJson('/api/me')
+            ->assertUnauthorized();
+    }
+
     public function test_it_rejects_access_to_the_current_user_endpoint_without_a_token(): void
     {
         $this->getJson('/api/me')->assertUnauthorized();