Activities Feed Client - Should support invoke/invalidate user token

[tronghm88]

Hi there. I'm facing a problem, that is I want to invoke an user token to make it to be disable to call Stream API from clients. I search your documents and see Chat Client has invokeUserToken function but Activities Feed Client doesn't. My context is:

First, i generate an user token on server-side and make it can READ 2 feed groups: GROUP_1 and GROUP_2. Then send the token to client to let client connect Stream API directly. Then I generate new token and make it can feed only a group, group 1. So I need to generate new token, then it to client one more time. About old token, I want to force it to expire or block it by any way to let user can not user old token to access group 2. Please tell me how I can implement this logic?

Thanks for super great thing.

gz#13574

[shodgetts]

Agent comment from Zachery Converse in Zendesk ticket #13574:

Hello,

Thanks for reaching out to Stream! I'll look into this and get back to you.

Feel free to let us know if you have any additional information or questions.

Cheers, -Zachery Getstream.io

°°°

[shodgetts]

Agent comment from Zachery Converse in Zendesk ticket #13574:

Hi,

Tokens are unique to each user and not used to control permissions. Permissions are defined at a Feed Group level. invokeUserToken does not exist for the feeds product.

These docs are quite good at explaining these premises.

It is possible to add expiration logic to a token: Token Expiration/Refreshing - Feeds

This article is also quite useful: I'm receiving HTTP 403 Errors in my Feeds App

Feel free to let me know if you have any questions.

Cheers, -Zachery Getstream.io

°°°

[tronghm88]

Thanks so much for your answer. But I'm still confuse.

1. About this not used to control permissions. Permissions are defined at a Feed Group level. I read this document https://getstream.io/activity-feeds/docs/javascript/auth_and_permissions/?language=javascript and the Authentication section of the REST document https://getstream.io/docs_rest/

I understand that if we add Permission scopes to JWT tokens payload, we can control user permission if client use the tokens to call Stream API directly. Pardon me, but I haven't find a document about "Permissions are defined at a Feed Group level." Can you share me a link?

2. Next, for example, at the first time my Backend generate an user token with the below permission scope { "resource": "*", "action": "read", "feed_id": "user1, user2" } at this moment, client all read feed of both user 1 and user 2, right? Because of our business, a day my Backend must deny above user that he can't read feed of user 2 anymore. So we must re-generate new token with below scope: { "resource": "*", "action": "read", "feed_id": "user1" } and send to client But somehow, we want the old token must be invalidated/revoked immediately, because it may take a day util the old token is expired.

Looking forward you reply. Thank you so so much.

[tronghm88]

One more problem, if I use permission scope as above. Client can not use tokens with permission scope to get reaction of activities even if those activities are theirs.