From 83bcd0944bc19b7e4039c737be1c8de43c706f6f Mon Sep 17 00:00:00 2001
From: addshore <git@addshore.com>
Date: Tue, 29 Sep 2026 00:49:27 +0100
Subject: [PATCH] Revoke the auth token on logout

Bug: T298754
---
 app/Http/Controllers/Auth/LoginController.php |  5 +++++
 tests/Routes/Auth/LoginTest.php               | 16 +++++++++++++++-
 2 files changed, 20 insertions(+), 1 deletion(-)

diff --git a/app/Http/Controllers/Auth/LoginController.php b/app/Http/Controllers/Auth/LoginController.php
index 025aa53f7..5adb4c929 100644
--- a/app/Http/Controllers/Auth/LoginController.php
+++ b/app/Http/Controllers/Auth/LoginController.php
@@ -47,6 +47,11 @@ public function getLogin(Request $request) {
     }
 
     public function deleteLogin(Request $request) {
+        $token = $request->user()->token();
+        if ($token) {
+            $token->revoke();
+        }
+
         return response()
             ->json()
             ->setStatusCode(204)
diff --git a/tests/Routes/Auth/LoginTest.php b/tests/Routes/Auth/LoginTest.php
index 106a51a98..24146fe1a 100644
--- a/tests/Routes/Auth/LoginTest.php
+++ b/tests/Routes/Auth/LoginTest.php
@@ -5,6 +5,7 @@
 use App\User;
 use Illuminate\Foundation\Testing\DatabaseTransactions;
 use Illuminate\Support\Facades\Artisan;
+use Illuminate\Support\Facades\Config;
 use Tests\Routes\Traits\OptionsRequestAllowed;
 use Tests\TestCase;
 
@@ -52,8 +53,21 @@ public function testGet() {
 
     public function testDelete() {
         $user = User::factory()->create();
-        $this->actingAs($user, 'api')
+        $token = $user->createToken('logout-test');
+        $otherToken = $user->createToken('other-session');
+
+        $this->withCredentials()
+            ->withUnencryptedCookie(Config::get('auth.cookies.key'), $token->accessToken)
             ->delete($this->route)
             ->assertStatus(204);
+
+        $this->assertDatabaseHas('oauth_access_tokens', [
+            'id' => $token->token->id,
+            'revoked' => true,
+        ]);
+        $this->assertDatabaseHas('oauth_access_tokens', [
+            'id' => $otherToken->token->id,
+            'revoked' => false,
+        ]);
     }
 }