Commit 357f498

@@ -21,6 +21,7 @@ class OauthsController < ApplicationController
   def token
     response.headers['Cache-Control'] = 'no-store'
     response.headers['Pragma'] = 'no-cache'
+    Authorization.find_by!(code: params[:code]).revoke!
     render json: {
       access_token: SecureRandom.hex(20),
       token_type: 'access',

@@ -8,4 +8,12 @@ class Authorization < ApplicationRecord
   after_initialize do
     self.expired_at = 10.minutes.from_now unless expired_at.present?
   end
+
+  def revoke!
+    update!(revoked_at: Time.now)
+  end
+
+  def revoked?
+    revoked_at.present?
+  end
 end

@@ -7,6 +7,7 @@ class CreateAuthorizations < ActiveRecord::Migration[5.2]
       t.references :client, foreign_key: true
       t.string :code, null: false, index: true
       t.datetime :expired_at, null: false
+      t.datetime :revoked_at
 
       t.timestamps
     end

@@ -17,6 +17,7 @@ ActiveRecord::Schema.define(version: 2018_09_05_020708) do
     t.integer "client_id"
     t.string "code", null: false
     t.datetime "expired_at", null: false
+    t.datetime "revoked_at"
     t.datetime "created_at", null: false
     t.datetime "updated_at", null: false
     t.index ["client_id"], name: "index_authorizations_on_client_id"

@@ -72,6 +72,7 @@ RSpec.describe '/oauth' do
         specify { expect(json[:token_type]).to be_present }
         specify { expect(json[:expires_in]).to be_present }
         specify { expect(json[:refresh_token]).to be_present }
+        specify { expect(authorization.reload).to be_revoked }
       end
     end
   end