feat: upgrade saloon to v4

Author: ju5t

UPGRADE.md

@@ -0,0 +1,31 @@
+# Upgrade Guide
+
+## From v0.x to v1.0.0
+
+### Saloon v4
+
+This release upgrades from Saloon v3 to v4. Saloon v4 is primarily a security release that removes serialization support from `AccessTokenAuthenticator`.
+
+### MoneybirdAuth cast
+
+The `MoneybirdAuth` cast now stores tokens as JSON instead of PHP serialized data. Existing serialized data will continue to be read correctly, but new writes will always use JSON.
+
+To migrate existing data you have two options:
+
+#### Option 1: Let it migrate automatically
+
+The cast will read the old format and write the new format on the next save. No action required on your end. If you are using tokens that never expire, you may want to trigger a save manually to migrate the data.
+
+#### Option 2: Run a migration
+
+If you prefer to migrate all data at once, you can create a migration that reads and re-saves the affected models:
+
+```php
+use App\Models\YourModel;
+
+YourModel::query()->each(function ($model) {
+    $model->saveQuietly();
+});
+```
+
+This will read the old serialized format and re-save it as JSON.

composer.json

@@ -18,9 +18,9 @@
     "require": {
         "php": "^8.2",
         "illuminate/contracts": "^11.0||^12.0||^13.0",
-        "saloonphp/laravel-plugin": "^3.11",
+        "saloonphp/laravel-plugin": "^4.0",
         "saloonphp/rate-limit-plugin": "^2.0",
-        "saloonphp/saloon": "^3.0",
+        "saloonphp/saloon": "^4.0",
         "spatie/laravel-data": "^4.13",
         "spatie/laravel-package-tools": "^1.16"
     },

src/Casts/MoneybirdAuth.php

@@ -2,31 +2,48 @@
 
 namespace Sensson\Moneybird\Casts;
 
+use DateTimeImmutable;
 use Saloon\Http\Auth\AccessTokenAuthenticator;
 
 class MoneybirdAuth
 {
-    /**
-     * Cast the given value.
-     */
     public function get($model, string $key, $value, array $attributes): ?AccessTokenAuthenticator
     {
         if (is_null($value)) {
             return null;
         }
 
-        return unserialize($value, ['allowed_classes' => true]);
+        $data = json_decode($value, true);
+
+        if (json_last_error() !== JSON_ERROR_NONE) {
+            $legacy = unserialize($value, [
+                'allowed_classes' => [AccessTokenAuthenticator::class, DateTimeImmutable::class],
+            ]);
+
+            return new AccessTokenAuthenticator(
+                accessToken: $legacy->getAccessToken(),
+                refreshToken: $legacy->getRefreshToken(),
+                expiresAt: $legacy->getExpiresAt(),
+            );
+        }
+
+        return new AccessTokenAuthenticator(
+            accessToken: $data['access_token'],
+            refreshToken: $data['refresh_token'] ?? null,
+            expiresAt: isset($data['expires_at']) ? new DateTimeImmutable($data['expires_at']) : null,
+        );
     }
 
-    /**
-     * Prepare the given value for storage.
-     */
     public function set($model, string $key, $value, array $attributes): mixed
     {
         if (is_null($value)) {
             return null;
         }
 
-        return serialize($value);
+        return json_encode([
+            'access_token' => $value->getAccessToken(),
+            'refresh_token' => $value->getRefreshToken(),
+            'expires_at' => $value->getExpiresAt()?->format(DateTimeImmutable::ATOM),
+        ]);
     }
 }