将 lcobucci/jwt 从 3.x 升级到 4.x：使用 $currentTime 迁移 ValidationData

Question

I'm migrating lcobucci/jwt code written by another developer, and I can see several validation calls, which look like this:

    $validationData = new ValidationData($this->getNowTime() + self::TTL_TIME_LIMIT);
    if (!$token->validate($validationData)) {
        // ...
    }

    $validationData = new ValidationData($this->getNowTime());
    if (!$token->validate($validationData)) {
        // ...
    }

From the upgrading steps I can see that validation is now done like this:

!$this->configuration->validator()->validate($token, ...$this->configuration->validationConstraints())

But I can not see how can I pass the $currentTime argument with new API. And as you can see, in the old code it's not always an actual current time as in the first call (as I understand it's done to see if token will be expired during the next hour).

Any solution for smooth migration in this case?

Answer 1

After some research I was able to upgrade it to the new API:

$validAtConstraint = new LooseValidAt(
    new FrozenClock($this->getNowTime()->modify(\sprintf('+%s seconds', self::TTL_TIME_LIMIT)))
);

if ($this->configuration->validator()->validate(
        $token,
        $validAtConstraint,
        ...$this->configuration->validationConstraints()
    )
) {
    // ...
}

Also, check out more detailed answer on the library github's discussion: https://github.com/lcobucci/jwt/discussions/813