TokenManager

ArtisanPackUI\AppleOAuth\Tokens\TokenManager handles persistence and refresh of Apple OAuth tokens. Since 1.1.0, refreshes go through the stateless AppleClient, or through the BrokerClient in broker mode. Prose walkthrough: Tokens. This page is the terse method reference.

Constructor

public function __construct(
    protected ConfigRepository $config,
    protected HttpFactory $http,
    protected ClientSecretGenerator $clientSecret,
    protected ConfigurationRepository $credentials,
)

Bound as a singleton by the service provider.

Methods

store()

public function store( TokenResponse $response ): AppleConnection

Persist a TokenResponse as an encrypted AppleConnection row for the response's user.

If a connection already exists for the user, it's updated in place so subsequent authorizations refresh identity and tokens rather than creating orphaned rows.

Preserves the stored email when the incoming profile omits it (Apple only releases email on the first authorization). Preserves the stored refresh_token when the incoming refreshToken is null or empty (Apple only issues refresh tokens on the initial grant).

Sets status = 'connected' and clears disconnect_reason — a re-connect after a markDisconnected() flips the status back automatically.

Since 1.1.0 it also writes scopes when the response reports any (the broker does, but Apple doesn't). It keeps the stored apple_user_id when profile is null. It throws OAuthException when $response->userId is null, so call withUserId() on a stateless response first.

getValidAccessToken()

public function getValidAccessToken( AppleConnection $connection ): string

Return a currently-valid access token, refreshing if the current one is expired (or within 60 seconds of expiry).

Throws TokenRefreshException when:

• The connection is disconnected.
• The connection is expired and has no refresh token on file.
• The refresh request to Apple (or the broker) fails.
• The broker reports a lapsed license. This throws LicenseExpiredException, and the connection stays connected.
• Apple's refresh response omits access_token.

refresh()

public function refresh( AppleConnection $connection ): string

Force a refresh regardless of expiry. Bypasses the isExpired() check and always POSTs to Apple's /auth/token, or to the broker's /api/v1/oauth/refresh in broker mode.

Same throw semantics as getValidAccessToken(). When Apple or the broker returns error=invalid_grant, the connection is markDisconnected()ed with reason "Refresh token revoked or expired." before the exception is thrown.

Failure-mode summary

Related classes

• ClientSecretGenerator — mints the client_secret JWT on refresh when no static override is configured.
• OAuthTokenProvider — the default TokenProvider binding, delegates to getValidAccessToken().
• AppleConnection — the persisted row.