Magento 2: How can I Revoke an Authorization Token

Question

Per the Magento 2 developer documentation

When you make web API calls, you supply this token in the Authorization request header with the Bearer HTTP authorization scheme to prove your identity. The token never expires but it can be revoked.

As a system owner -- how do I revoke an authorization token? Is it as simple as setting the revoked column in the oauth_token to 1? Or do I need to do more.

Irrespective of that, is there a GUI for doing this anywhere? Or do I need to manually edit the database myself?

Answer 1

It is actually just the Force Sign-In on the User Info section of the users page.

Answer 2

I reckon the controller action class related to what you're looking for is Magento\User\Controller\Adminhtml\User\InvalidateToken.php:

public function execute()
{
    if ($userId = $this->getRequest()->getParam('user_id')) {
        try {
            $this->tokenService->revokeAdminAccessToken($userId);
            $this->messageManager->addSuccess(__('You have revoked the user\'s tokens.'));
            $this->_redirect('adminhtml/*/edit', ['user_id' => $userId]);
            return;
        } catch (\Exception $e) {
            $this->messageManager->addError($e->getMessage());
            $this->_redirect('adminhtml/*/edit', ['user_id' => $userId]);
            return;
        }
    }
    $this->messageManager->addError(__('We can\'t find a user to revoke.'));
    $this->_redirect('adminhtml/*');
}

It is trigerred by clicking the Force Sign-in button on the user edit page Magento\User\Block\User\Edit.php:

if (!empty($objId)) {
        $deleteConfirmMsg = __("Are you sure you want to revoke the user\'s tokens?");
        $this->addButton(
            'invalidate',
            [
                'label' => __('Force Sign-In'),
                'class' => 'invalidate-token',
                'onclick' => 'deleteConfirm(\'' . $deleteConfirmMsg . '\', \'' . $this->getInvalidateUrl() . '\')',
            ]
        );
    }

The function that actually sets the revoked column to 1 can be found under /Magento/Integration/Model/AdminTokenService.php :

public function revokeAdminAccessToken($adminId)
{
    $tokenCollection = $this->tokenModelCollectionFactory->create()->addFilterByAdminId($adminId);
    if ($tokenCollection->getSize() == 0) {
        throw new LocalizedException(__('This user has no tokens.'));
    }
    try {
        foreach ($tokenCollection as $token) {
            $token->setRevoked(1)->save();
        }
    } catch (\Exception $e) {
        throw new LocalizedException(__('The tokens could not be revoked.'));
    }
    return true;
}

Answer 3

protected $_customerTokenServiceFactory;

public function __construct(\Magento\Integration\Model\CustomerTokenService $customerTokenServiceFactory)
{
   $this->_customerTokenServiceFactory = $customerTokenServiceFactory;
}


public function revokeCustomerAccess($customerId)
{
   $this->_customerTokenServiceFactory->revokeCustomerAccessToken($customerId); 
}