From 0fe7d5a05415ef18b979b356dc69e17bf3f4a48d Mon Sep 17 00:00:00 2001 From: Frank Karlitschek Date: Tue, 20 Oct 2026 19:06:52 -0400 Subject: [PATCH] feat(auth): allow apps to invalidate a single token Add invalidateTokenById() to the public token provider so apps can end one session or revoke one app password without touching the user's other devices. The core token manager already implements it. Assisted-by: ClaudeCode:claude-opus-5-5 Co-Authored-By: Claude Opus 5.5 Signed-off-by: Frank Karlitschek --- lib/public/Authentication/Token/IProvider.php | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/lib/public/Authentication/Token/IProvider.php b/lib/public/Authentication/Token/IProvider.php index 3eeb8da73ee75..452123d43b2e8 100644 --- a/lib/public/Authentication/Token/IProvider.php +++ b/lib/public/Authentication/Token/IProvider.php @@ -28,6 +28,16 @@ interface IProvider { */ public function invalidateTokensOfUser(string $uid, ?string $clientName); + /** + * invalidates (deletes) a single token of a user, e.g. one session or app password + * + * @param string $uid + * @param int $id the token's database id, see IToken::getId() + * @since 36.0.0 + * @return void + */ + public function invalidateTokenById(string $uid, int $id); + /** * Get a token by token string id *