fix(security): stop storing OAuth access/refresh tokens on users

app/Models/User.php

@@ -3,13 +3,11 @@
 namespace App\Models;
 
 use App\Enums\AirportView;
-use App\Services\OAuth\VatsimProvider;
 use Illuminate\Database\Eloquent\Casts\Attribute;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Database\Eloquent\Relations\HasMany;
 use Illuminate\Foundation\Auth\User as Authenticatable;
 use Illuminate\Notifications\Notifiable;
-use League\OAuth2\Client\Token\AccessToken;
 use Spatie\Activitylog\LogOptions;
 use Spatie\Activitylog\Traits\LogsActivity;
 
@@ -22,9 +20,6 @@
  * @property AirportView $airport_view
  * @property bool $use_monospace_font
  * @property string|null $remember_token
- * @property string|null $access_token
- * @property string|null $refresh_token
- * @property int|null $token_expires
  * @property \Illuminate\Support\Carbon|null $created_at
  * @property \Illuminate\Support\Carbon|null $updated_at
  * @property-read \Illuminate\Database\Eloquent\Collection<int, \Spatie\Activitylog\Models\Activity> $activities
@@ -39,17 +34,14 @@
  * @method static \Illuminate\Database\Eloquent\Builder<static>|User newModelQuery()
  * @method static \Illuminate\Database\Eloquent\Builder<static>|User newQuery()
  * @method static \Illuminate\Database\Eloquent\Builder<static>|User query()
- * @method static \Illuminate\Database\Eloquent\Builder<static>|User whereAccessToken($value)
  * @method static \Illuminate\Database\Eloquent\Builder<static>|User whereAirportView($value)
  * @method static \Illuminate\Database\Eloquent\Builder<static>|User whereCreatedAt($value)
  * @method static \Illuminate\Database\Eloquent\Builder<static>|User whereEmail($value)
  * @method static \Illuminate\Database\Eloquent\Builder<static>|User whereId($value)
  * @method static \Illuminate\Database\Eloquent\Builder<static>|User whereIsAdmin($value)
  * @method static \Illuminate\Database\Eloquent\Builder<static>|User whereNameFirst($value)
  * @method static \Illuminate\Database\Eloquent\Builder<static>|User whereNameLast($value)
- * @method static \Illuminate\Database\Eloquent\Builder<static>|User whereRefreshToken($value)
  * @method static \Illuminate\Database\Eloquent\Builder<static>|User whereRememberToken($value)
- * @method static \Illuminate\Database\Eloquent\Builder<static>|User whereTokenExpires($value)
  * @method static \Illuminate\Database\Eloquent\Builder<static>|User whereUpdatedAt($value)
  * @method static \Illuminate\Database\Eloquent\Builder<static>|User whereUseMonospaceFont($value)
  * @mixin \Eloquent
@@ -73,9 +65,6 @@ class User extends Authenticatable
      */
     protected $hidden = [
         'remember_token',
-        'access_token',
-        'refresh_token',
-        'token_expires',
     ];
 
     public function getActivitylogOptions(): LogOptions
@@ -109,36 +98,6 @@ protected function pic(): Attribute
         );
     }
 
-    /**
-     * Returns a valid access token, refreshing it via the OAuth provider if it has expired.
-     * Persists updated token fields to the database when a refresh occurs.
-     */
-    public function refreshTokenIfExpired(): ?AccessToken
-    {
-        if ($this->access_token === null) {
-            return null;
-        }
-
-        $token = new AccessToken([
-            'access_token' => $this->access_token,
-            'refresh_token' => $this->refresh_token,
-            'expires' => $this->token_expires,
-        ]);
-
-        if ($token->hasExpired()) {
-            $refreshedToken = resolve(VatsimProvider::class)->updateToken($token);
-            $token = $refreshedToken instanceof AccessToken ? $refreshedToken : null;
-
-            $this->update([
-                'access_token' => $token?->getToken(),
-                'refresh_token' => $token?->getRefreshToken(),
-                'token_expires' => $token?->getExpires(),
-            ]);
-        }
-
-        return $token;
-    }
-
     /**
      * The attributes that should be cast to native types.
      *

app/Services/Auth/AuthenticationService.php

@@ -42,15 +42,15 @@ public function authenticateFromOAuth(Request $request): ?array
             return null;
         }
 
-        $user = $this->upsertUser($data, $accessToken);
+        $user = $this->upsertUser($data);
 
         return ['user' => $user, 'data' => $data];
     }
 
     /**
      * Create or update the user record and log them in.
      */
-    protected function upsertUser(array $data, $token): User
+    protected function upsertUser(array $data): User
     {
         $account = User::updateOrCreate(
             ['id' => $data['cid']],
@@ -61,19 +61,6 @@ protected function upsertUser(array $data, $token): User
             ]
         );
 
-        if ($token->getToken() !== null) {
-            $account->access_token = $token->getToken();
-        }
-
-        if ($token->getRefreshToken() !== null) {
-            $account->refresh_token = $token->getRefreshToken();
-        }
-
-        if ($token->getExpires() !== null) {
-            $account->token_expires = $token->getExpires();
-        }
-
-        $account->save();
         auth()->loginUsingId($data['cid'], true);
         activity()->log('Login');
 

app/Services/OAuth/VatsimProvider.php

@@ -1,10 +1,10 @@
 <?php
 
+declare(strict_types=1);
+
 namespace App\Services\OAuth;
 
 use League\OAuth2\Client\Provider\GenericProvider;
-use League\OAuth2\Client\Provider\Exception\IdentityProviderException;
-use League\OAuth2\Client\Token\AccessTokenInterface;
 
 class VatsimProvider extends GenericProvider
 {
@@ -25,17 +25,6 @@ public function __construct()
         ]);
     }
 
-    public function updateToken(AccessTokenInterface $token): ?AccessTokenInterface
-    {
-        try {
-            return $this->getAccessToken('refresh_token', [
-                'refresh_token' => $token->getRefreshToken(),
-            ]);
-        } catch (IdentityProviderException) {
-            return null;
-        }
-    }
-
     public function getOAuthProperty(string $property, mixed $data): mixed
     {
         return data_get($data, str_replace('-', '.', $property)) ?: false;

database/migrations/2026_10_07_190017_drop_oauth_token_columns_from_users_table.php

@@ -0,0 +1,29 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class () extends Migration {
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::table('users', function (Blueprint $table): void {
+            $table->dropColumn(['access_token', 'refresh_token', 'token_expires']);
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::table('users', function (Blueprint $table): void {
+            $table->text('access_token')->after('remember_token')->nullable();
+            $table->text('refresh_token')->after('access_token')->nullable();
+            $table->unsignedBigInteger('token_expires')->after('refresh_token')->nullable();
+        });
+    }
+};