blob: e6213a891f07f727283c555b842fb6bc0ad28fe5 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
|
<?php
namespace App\Http\Middleware;
use App\Models\User;
use Closure;
use Illuminate\Http\Request;
use Symfony\Component\HttpFoundation\Response;
class TokenAuth
{
public function handle(Request $request, Closure $next): Response
{
$token = null;
// Check for Bearer token in Authorization header (API)
if ($request->hasHeader('Authorization')) {
$auth = $request->header('Authorization');
if (str_starts_with($auth, 'Bearer ')) {
$token = substr($auth, 7);
}
}
// Check session for web requests
if (!$token && session()->has('api_token')) {
$token = session('api_token');
}
// Check "Remember me" cookie
if (!$token && $request->cookie('remember_token')) {
$token = $request->cookie('remember_token');
// Restore session from remember token
session(['api_token' => $token]);
}
if (!$token) {
if ($request->expectsJson()) {
return response()->json(['message' => 'Unauthorized'], 401);
}
return redirect()->route('login');
}
$user = User::where('api_token', hash('sha256', $token))->first();
if (!$user) {
if ($request->expectsJson()) {
return response()->json(['message' => 'Invalid token'], 401);
}
session()->forget(['api_token', 'user_id']);
return redirect()->route('login');
}
// Store user in request for later use
$request->attributes->set('user', $user);
return $next($request);
}
}
|
