feat: expiration by seconds

config/sanctum.php

@@ -44,6 +44,8 @@
     | considered expired. This will override any values set in the token's
     | "expires_at" attribute, but first-party sessions are not affected.
     |
+    | To set the number of seconds, use decimal.
+    |
     */
 
     'expiration' => null,

src/Guard.php

@@ -19,7 +19,7 @@ class Guard
     /**
      * The number of minutes tokens should be allowed to remain valid.
      *
-     * @var int
+     * @var int|float
      */
     protected $expiration;
 
@@ -156,7 +156,7 @@ protected function isValidAccessToken($accessToken): bool
         }
 
         $isValid =
-            (! $this->expiration || $accessToken->created_at->gt(now()->subMinutes($this->expiration)))
+            (! $this->expiration || $accessToken->created_at->gt(now()->subSeconds($this->expiration * 60)))
             && (! $accessToken->expires_at || ! $accessToken->expires_at->isPast())
             && $this->hasValidProvider($accessToken->tokenable);
 

tests/Feature/GuardTest.php

@@ -164,6 +164,39 @@ public function test_authentication_with_token_succeeds_if_expires_at_not_passed
         $this->assertInstanceOf(DateTimeInterface::class, $returnedUser->currentAccessToken()->last_used_at);
     }
 
+    public function test_authentication_with_token_succeeds_if_expires_at_not_passed_by_seconds()
+    {
+        $factory = Mockery::mock(AuthFactory::class);
+
+        $expiration = 1 / 60 * 10;
+        $guard = new Guard($factory, $expiration, 'users');
+
+        $webGuard = Mockery::mock(stdClass::class);
+
+        $factory->shouldReceive('guard')
+            ->with('web')
+            ->andReturn($webGuard);
+
+        $webGuard->shouldReceive('user')->once()->andReturn(null);
+
+        $request = Request::create('/', 'GET');
+        $request->headers->set('Authorization', 'Bearer test');
+
+        $token = PersonalAccessTokenFactory::new()->for(
+            $user = UserFactory::new()->create(),
+            'tokenable'
+        )->create([
+            'name' => 'Test',
+            'expires_at' => now()->addSeconds(3),
+        ]);
+
+        $returnedUser = $guard->__invoke($request);
+
+        $this->assertEquals($user->id, $returnedUser->id);
+        $this->assertEquals($token->id, $returnedUser->currentAccessToken()->id);
+        $this->assertInstanceOf(DateTimeInterface::class, $returnedUser->currentAccessToken()->last_used_at);
+    }
+
     public function test_authentication_is_successful_with_token_if_no_session_present()
     {
         $factory = Mockery::mock(AuthFactory::class);