Laravel 8 tymon/jwt-auth invalidate token to another user - jwt

Question

I have a Laravel 8 API project using the tymon/jwt-auth package, and I'm trying to do the following.
As a user 'admin', I can delete others user's clients.
In the database, the entities are never deleted completely; I use a status attribute 'active'|'deleted' to soft-delete the entity.
After deleting a user, I need to invalidate the token if the user has one.
The problem comes with the last point, I can get the deleted user token, but I couldn't find how to invalidate that specific token in the JWT docs. I couldn't find a question like this either.
public function delete($id)
{
$parameters = ['id' => $id, 'status' => 'deleted'];
$user = request()->user();
$data = User::where('id', '<>', $user->id)->where('status', 'active')
->where('id', $parameters['id'])->first();
if (!isset($data)) {
return response()->json(['error' => 'User does not exist'], 400);
}
$data->fill($parameters)->save();
$token = auth()->tokenById($data->id);
if ($token) {
// TODO invalidate deleted user token
// The next line invalidates the current auth token, not the target
// user token auth()->invalidate($token);
}
return response()->json(['message' => 'Success'], 200);
}
If I properly delete the user from DB, the next requests using his token are now invalid because the user doesn't exist anymore. So there is a way to tell tymon/jwt-auth or the auth guard they need to check if the user has status = 'deleted'?

Answer 1

You can invalidate token from middleware.
if ($user->blocked) {
$token = $request->bearerToken();
\Illuminate\Support\Facades\Auth::setToken($token)->invalidate();
throw new UnauthorizedException();
}