Possible solution:

• Create / extend own RequestGuard
• Handle case where token is present but can't be authenticated

In the docs/protecting_routes.md section the last_used_at timestamp is still mentioned, even though it has been removed.

This has to be updated and the other files should also be checked for similar occurrences.

Reported in: m-thalmann/Cookbook#6 by @neeooh

When running the migrations with MySQL the following exception is thrown:

SQLSTATE[42000]: Syntax error or access violation: 1101 BLOB, TEXT, GEOMETRY or JSON column 'abilities' can't have a default value (Connection: mysql, SQL: create table `auth_tokens` (`id` bigint unsigned not null auto_increment primary key, `type` varchar(255) not null, `authenticatable_type` varchar(255) not null, `authenticatable_id` bigint unsigned not null, `group_id` int null, `name` varchar(255) null, `token` varchar(64) not null, `abilities` text not null default '[]', `revoked_at` timestamp null, `expires_at` timestamp null, `created_at` timestamp null, `updated_at` timestamp null) default character set utf8mb4 collate 'utf8mb4_unicode_ci')

This is because the text column does not allow defining default values (this is allowed in SQLite).

Add where-clause to filter also for type and pass the type to the function

Currently this package allows to generate Refresh Tokens and Access Tokens, both of which are stored to the database. Since (most of the time) they are generated in pairs and one can't exist without the other, it would be better to just store the Refresh Tokens, whereas the Access Tokens have encoded the group-id and a signature for it (somewhat like JWT). There should also be possibilities to create "standalone" Access Tokens with special permissions and a more easy way to create new tokens / pairs.

ToDo

• Distinguish between Token-Pair-Access-Tokens and "standalone" Access Tokens
• Better / easier way to create new Tokens (-Pairs)
• (Don't use static Methods, use a Facade instead)
• More customization options for:
  • Retrieving of token from request
  • Setting/Retrieving user
  • Authenticating a request (even when no token is present)
  • ...
    ...