AccessTokensController is for login/logout, but what about actual access token management?

[guoyunhe]

Current default AdonisJS project AccessTokensController has two methods, store for login, destroy for logout.

class AccessTokensController {
  async store({ request, serialize }: HttpContext) {
    const { email, password } = await request.validateUsing(loginValidator)

    const user = await User.verifyCredentials(email, password)
    const token = await User.accessTokens.create(user)

    return serialize({
      user: UserTransformer.transform(user),
      token: token.value!.release(),
    })
  }

  async destroy({ auth }: HttpContext) {
    const user = auth.getUserOrFail()
    if (user.currentAccessToken) {
      await User.accessTokens.delete(user, user.currentAccessToken.identifier)
    }

    return {
      message: 'Logged out successfully',
    }
  }
}

But in typical applications, you are actually able to manage your access tokens. You can create a token for third party clients (which doesn't necessary have a login form). You can also delete old access tokens (imagine your device was lost and you want to revert every access token on that device).

This means, we probably shouldn't confuse AuthController.login with AccessTokensController.store, or AuthController.logout with AccessTokensController.destroy.

And there is another NewAccountController. In many projects, Account is a different concept than User, which represent financial accounts. I doubt if this makes sense.