# `Macaw.Auth.Ash.TokenResource`
[🔗](https://github.com/dcoai/macaw_auth_ash/blob/v0.3.2/lib/macaw/auth/ash/token_resource.ex#L1)

What `Macaw.Auth.Ash` adds to a host's AshAuthentication token resource:

    defmodule MyApp.Accounts.Token do
      use Ash.Resource,
        domain: MyApp.Accounts,
        data_layer: AshPostgres.DataLayer,
        extensions: [AshAuthentication.TokenResource, Macaw.Auth.Ash.TokenResource],
        notifiers: [Macaw.Auth.Ash.Notifier]
    end

AshAuthentication's token resource stores a JWT's `jti`, never the JWT,
with `purpose`, `subject`, `expires_at` and an `extra_data` map. A Macaw
session is one of those rows (purpose `"user"`), its metadata in
`extra_data["macaw_auth"]` (`Macaw.Auth.Ash.Sessions`). The resource's
own actions can store a token, and revoke one by token or jti, but not
update `extra_data` in place, read rows by subject, or revoke a stored
row by jti without making it unexpungeable (AshAuthentication's
`revoke_jti` sets a thousand-year expiry). So this extension adds, unless
the resource already defines them:

- `:macaw_auth_read`: a plain read, the primary one when the resource
  has none (log-out-everywhere's bulk update needs one);
- `:macaw_auth_update`: an update accepting `extra_data` (a session's
  use, its steps);
- `:macaw_auth_revoke`: an update setting `purpose` to `"revocation"`,
  keeping the row's own expiry, so the expunger still removes it.

and to AshAuthentication's `revoke_all_stored_for_subject` action the
`Macaw.Auth.Ash.AnnounceRevocation` change: that action is how
AshAuthentication's log-out-everywhere revokes, as a bulk update without
notifications, so a notifier alone would never hear of it.

A token resource without `Macaw.Auth.Ash.Notifier` is warned of at
compile time by a verifier (Spark reports its error as a compile
warning) and refused by `Macaw.Auth.Ash.Config` when it loads: without
the notifier, a revocation made through Ash directly would reach open
pages only at their next re-check.

# `read_action`

The read action this extension adds.

# `revoke_action`

The revoking update action this extension adds.

# `update_action`

The update action (`extra_data`) this extension adds.

---

*Consult [api-reference.md](api-reference.md) for complete listing*