From 232d454913def9691b77a70a3349d13f9c74de17 Mon Sep 17 00:00:00 2001
From: Jakub Zych <jakub@keios.eu>
Date: Sat, 19 Sep 2026 19:11:12 +0200
Subject: [PATCH] feat(06-01): implement inv_token guard, inv.scope, and
 registry wiring

- Verify inv_ tokens against ApiToken hash, expiry, revocation, last-used
- InvScope writes PHP TokenScope 401/403 bodies and gates on HasScope
- Register jwt and inv_token on the shared bouncer.Registry at plugin Boot
---
 plugin.go | 25 +++++++++++++++++++------
 1 file changed, 19 insertions(+), 6 deletions(-)

diff --git a/plugin.go b/plugin.go
index 2ff29ad..62fc6a0 100644
--- a/plugin.go
+++ b/plugin.go
@@ -42,7 +42,8 @@ func (p *Plugin) Register(app *backpack.App) error {
 
 func (p *Plugin) Boot(app *backpack.App) error {
 	p.app = app
-	if _, err := classes.JWTSecret(app); err != nil {
+	secret, err := classes.JWTSecret(app)
+	if err != nil {
 		return err
 	}
 	if gdb, ok := app.Lookup[*gorm.DB](); ok {
@@ -50,7 +51,14 @@ func (p *Plugin) Boot(app *backpack.App) error {
 			return err
 		}
 	}
-	return nil
+	reg, ok := app.Lookup[*bouncer.Registry]()
+	if !ok || reg == nil {
+		reg = bouncer.NewRegistry()
+		if err := app.Publish(reg); err != nil {
+			return err
+		}
+	}
+	return reg.Register(p.ID(), "jwt", bouncer.NewJWTGuard(secret, classes.GormUsers{App: app}))
 }
 
 func (p *Plugin) ConfigFS() fs.FS { return configFS }
@@ -60,13 +68,18 @@ func (p *Plugin) Migrations() []*gormigrate.Migration { return updates.All() }
 func (p *Plugin) Models() []any { return models.All() }
 
 func (p *Plugin) Middlewares() map[string]pact.Middleware {
-	secret, err := classes.JWTSecret(p.app)
+	if p.app == nil {
+		return nil
+	}
+	reg, ok := p.app.Lookup[*bouncer.Registry]()
+	if !ok || reg == nil {
+		return nil
+	}
+	mw, err := reg.Middleware("jwt")
 	if err != nil {
 		return nil
 	}
-	return map[string]pact.Middleware{
-		"jwt.auth": bouncer.Middleware(secret, classes.GormUsers{App: p.app}),
-	}
+	return map[string]pact.Middleware{"jwt.auth": mw}
 }
 
 func init() {