Allow distinguishing invalid/non-existing password reset tokens from expired ones

[jnoordsij]

The current TokenRepositoryInterface interface (see https://github.com/laravel/framework/blob/master/src/Illuminate/Auth/Passwords/TokenRepositoryInterface.php) does not allow distinguishing invalid/non-existing password reset tokens from expired ones. Consequently, in the implementation of validateReset in PasswordBroker (see

framework/src/Illuminate/Auth/Passwords/PasswordBroker.php

Lines 119 to 136 in 0454123

	/**
	* Validate a password reset for the given credentials.
	*
	* @param array $credentials
	* @return \Illuminate\Contracts\Auth\CanResetPassword|string
	*/
	protected function validateReset(#[\SensitiveParameter] array $credentials)
	{
	if (is_null($user = $this->getUser($credentials))) {
	return static::INVALID_USER;
	}
	if (! $this->tokens->exists($user, $credentials['token'])) {
	return static::INVALID_TOKEN;
	}
	return $user;
	}

), one can only distinguish valid from non-valid tokens.

I think it could be beneficial to distinguish existing but expired tokens from non-existing ones, to provide better feedback to users trying to reset their password. Currently for me to do so, this would require extensive framework overrides (extended TokenRepositoryInterface + implementation, overridden PasswordBroker and consequently PasswordBrokerManager). Therefore, I would prefer to see if it is possible to alter the framework implementation to do this or more easily allow for this.

However, given this will likely be a backward incompatible change with some room for choice, I would first like to see if there is support for this idea, and if there's any preference on the suggested implementation. Some rough ideas to implement this I have are:

• Adding some method to the TokenRepositoryInterface to check for expired-but-valid tokens; e.g. exposing the tokenExpired function of the DatabaseTokenRepository (

  framework/src/Illuminate/Auth/Passwords/DatabaseTokenRepository.php

  Line 98 in 0454123

  protected function tokenExpired($createdAt)

  ) or a similar function.
• Update the exists method on the TokenRepositoryInterface to have a broader return type (enum or string), to distinguish token states.
• Adding a new getTokenState method on the TokenRepositoryInterface doing the above, with the exists then calling this in the framework implementation.