Merge pull request #7 from BulkGate/security-token

Security token

Author: lukaspijak

src/Settings/Settings.php

@@ -117,6 +117,8 @@ public function install(bool $update = false): void
 
 	public function uninstall(): void
 	{
+		$this->delete('static:application_token');
+
 		if ($this->load('main:delete_db') ?? false)
 		{
 			$this->repository->dropTable();

src/User/Sign.php

@@ -8,7 +8,7 @@
  */
 
 use BulkGate\{Plugin\AuthenticateException, Plugin\Debug\Logger, Plugin\Eshop\Configuration, Plugin\InvalidResponseException, Plugin\IO\Connection, Plugin\IO\Request, Plugin\IO\Url, Plugin\Localization\Language, Plugin\Settings\Settings, Plugin\Strict, Plugin\Utils\Jwt};
-use function array_merge;
+use function array_merge, time;
 
 class Sign
 {
@@ -83,7 +83,7 @@ public function in(string $email, string $password, ?string $success_redirect =
 			$this->settings->set('static:application_token', $response->data['data']['application_token'], ['type' => 'string']);
 			$this->settings->set('static:synchronize', 0, ['type' => 'int']);
 
-			return ['token' => $this->authenticate(true), 'data' => ['redirect' => $success_redirect]];
+			return ['token' => $this->authenticate(true, ['expire' => time() + 300]), 'data' => ['redirect' => $success_redirect]];
 		}
 		catch (InvalidResponseException|AuthenticateException $e)
 		{
@@ -101,6 +101,6 @@ public function out(string $success_redirect): array
 	{
 		$this->settings->delete('static:application_token');
 
-		return ['token' => $this->authenticate(true), 'data' => ['redirect' => $success_redirect]];
+		return ['token' => $this->authenticate(true, ['expire' => time() + 300]), 'data' => ['redirect' => $success_redirect]];
 	}
 }

tests/Settings/SettingsTest.phpt

@@ -102,6 +102,7 @@ class SettingsTest extends TestCase
 			'delete_db' => new Setting(['scope' => 'main', 'key' => 'delete_db', 'type' => 'bool', 'value' => '1']),
 		]));
 		$repository->shouldReceive('dropTable')->withNoArgs()->once();
+		$repository->shouldReceive('remove')->with('static', 'application_token')->once();
 
 		Assert::noError(fn () => $settings->uninstall());
 	}