Auth Redis Storage Bundle Laravel Package

Getting Started

This package is published as a Symfony bundle, not a Laravel package — the Flex recipe, services.yaml wiring, and the bundle's configuration tree are Symfony-only. As a Laravel developer you can still use it, but you'll consume the framework-agnostic parts directly: the domain contracts (TokenBlacklistInterface, ActiveTokenStorageInterface) and their Redis implementations (RedisTokenBlacklist, RedisActiveTokenStorage). Skip the bundle bootstrapping and wire it yourself.

Steps:

1. composer require keron-digital/auth-redis-storage-bundle (or the vendor/name shown in the README — confirm the exact package name, since the release notes only give the bundle name).
2. Read the Domain folder first for the two interfaces, then Infrastructure/Redis for the implementations. Check the constructor signatures: they take a Redis client plus the prefix/suffix configuration values.
3. Bind the interfaces in a TokenStorageServiceProvider:

   $this->app->bind(TokenBlacklistInterface::class, function ($app) {
       return new RedisTokenBlacklist(
           $app->make(\Redis::class),
           config('auth-tokens.blacklist_prefix'),
       );
   });
   

4. First use case: blacklist a JWT jti on logout with a TTL equal to the token's remaining lifetime.

Implementation Patterns

Blacklist on revocation. After validating a logout/revocation request, call $blacklist->add($jti, $remainingTtlSeconds). Because the implementation uses SETEX, Redis cleans the key up automatically when the token would have expired anyway — you only need to track the residual validity window, not forever.

Active-token tracking on issue. When minting a token, register the identifier with its full intended lifetime, optionally with the user ID. On each request, check the active store to confirm the token was actually issued and hasn't naturally expired; this doubles as an "issued from this system" check.

Combined middleware flow. In a Laravel middleware or TokenValidator service, run checks in order: (1) blacklist lookup — reject if present; (2) active-token lookup — reject if absent; (3) signature/claims verification. Doing the cheap Redis checks first avoids work on obviously-bad tokens.

Per-environment namespacing. Use the exposed general prefix plus the blacklist/active suffixes to segregate by app and environment in a shared Redis, e.g. myapp:production:bl: and myapp:production:act:. Keep these in config/auth-tokens.php and mirror them in the service provider bindings.

TTL propagation. Wherever you mint tokens, capture the token's expiry and pass the same TTL to both the blacklist (on revocation, recomputed as remaining time) and the active store (on issue) so the Redis lifespan tracks the token lifespan exactly.

Gotchas and Tips

• Symfony-only integration. The bundle extension, Flex recipe, and config tree will not be loaded by Laravel. You must instantiate the Redis implementations yourself; don't expect config/packages/*.yaml semantics to apply. The README's "specify the Redis client service" step maps to a container binding in Laravel.
• SETEX means "expires with the token". Both stores auto-clean on natural expiry. This is convenient but means a blacklist entry disappears the moment the token is dead anyway — never set a TTL longer than the token's remaining life, and never shorter, or you reopen a revocation window.
• Active tracking ≠ revocation. An absent active-token key means "never issued / already expired", not "revoked". Revocation is the blacklist's job. If you conflate them you'll either miss revocations or reject legitimately renewed tokens.
• Verify the Redis client type. Symfony bundles of this style commonly type-hint \Redis (phpredis). If you use Predis, you may need a thin adapter. Confirm from the constructor before wiring.
• Key collisions in shared Redis. Always set both the prefix and the per-store suffixes; the defaults may overlap with other apps.
• Clock skew. TTLs are passed as integers; if tokens seem to expire early or late, check the app/Redis clock delta and that you're passing seconds (not a DateTime that gets cast to 0).
• Debugging. If keys aren't appearing, redis-cli --scan --pattern '<prefix>*' and TTL <key> are your fastest checks — confirm the key was written and its TTL matches expectation.
• Extension points. The DDD split is the win here: implement TokenBlacklistInterface / ActiveTokenStorageInterface against MySQL or DynamoDB and swap the binding without touching callers. Keep your app code typed to the interfaces, never to the Redis concrete classes.