Sanctum tokens with abilities and rate limits

<?php

namespace App\Http\Controllers\Api;

use App\Http\Controllers\Controller;
use Illuminate\Http\JsonResponse;
use Illuminate\Http\Request;
use Illuminate\Validation\Rule;

class TokenController extends Controller
{
    /** Only these can ever be granted. */
    private const ABILITIES = ['orders:read', 'orders:write', 'products:read', 'products:write'];

    public function store(Request $request): JsonResponse
    {
        $data = $request->validate([
            'name' => ['required', 'string', 'max:60'],
            'abilities' => ['required', 'array', 'min:1'],
            'abilities.*' => ['string', Rule::in(self::ABILITIES)],
            'days' => ['nullable', 'integer', 'between:1,365'],
        ]);

        $token = $request->user()->createToken(
            $data['name'],
            $data['abilities'],
            now()->addDays($data['days'] ?? 90),
        );

        // The plain text value is shown once and cannot be recovered later.
        return response()->json(['token' => $token->plainTextToken, 'abilities' => $data['abilities']], 201);
    }

    public function destroy(Request $request, int $id): JsonResponse
    {
        $request->user()->tokens()->whereKey($id)->delete();

        return response()->json(status: 204);
    }
}

<?php

// Inside App\Providers\AppServiceProvider::boot()

use Illuminate\Cache\RateLimiting\Limit;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\RateLimiter;

RateLimiter::for('api-token', function (Request $request) {
    $token = $request->user()?->currentAccessToken();

    // Limit per token, so one client cannot starve others sharing an IP.
    return $token
        ? Limit::perMinute($token->can('orders:write') ? 240 : 60)->by('token:'.$token->id)
        : Limit::perMinute(20)->by($request->ip());
});

<?php

// routes/api.php (excerpt)

use App\Http\Controllers\Api\OrderController;
use App\Http\Controllers\Api\TokenController;
use Illuminate\Support\Facades\Route;

Route::middleware(['auth:sanctum', 'throttle:api-token'])->group(function () {
    Route::get('/orders', [OrderController::class, 'index'])->middleware('abilities:orders:read');
    Route::post('/orders', [OrderController::class, 'store'])->middleware('abilities:orders:write');

    // Any one of these abilities is enough.
    Route::get('/export', [OrderController::class, 'export'])->middleware('ability:orders:read,products:read');

    Route::delete('/tokens/{id}', [TokenController::class, 'destroy']);
});