daniel-de-wit / lighthouse-sanctum
Laravel Sanctum support for Laravel Lighthouse.
Installs: 17 965
Dependents: 0
Suggesters: 0
Security: 0
Stars: 36
Watchers: 3
Forks: 3
Open Issues: 3
Requires
- php: ^8.0.2
- laravel/framework: ^9.0
- laravel/sanctum: ^2.14
- nuwave/lighthouse: ^5.5
Requires (Dev)
- friendsofphp/php-cs-fixer: ^3.0
- mockery/mockery: ^1.5
- nunomaduro/larastan: ^1.0 || ^2.0
- orchestra/testbench: ^6.0 || ^7.0
- orchestra/testbench-core: ^6.26 || ^7.0
- phpoption/phpoption: ^1.8
- phpstan/phpstan-mockery: ^1.0
- phpstan/phpstan-phpunit: ^1.0
- phpunit/phpunit: ^9.5
- thecodingmachine/safe: ^2.0
- dev-master
- 2.1.1
- 2.1.0
- 2.0.0
- 1.4.0
- 1.3.0
- 1.2.0
- 1.1.1
- 1.1.0
- 1.0.2
- 1.0.1
- 1.0.0
- dev-add-integration-test-for-custom-user-identifier
- dev-fix-phpstan-issues
- dev-add-lighthouse-guard-configuration-to-readme
- dev-configurable-credential-keys
- dev-daniel-de-wit-patch-2-1
- dev-daniel-de-wit-patch-2
- dev-daniel-de-wit-patch-1
This package is auto-updated.
Last update: 2022-06-23 13:25:48 UTC
README
Add Laravel Sanctum support to Lighthouse
Requirements
Installation
1. Install using composer:
composer require daniel-de-wit/lighthouse-sanctum
2. Publish configuration and schema
php artisan vendor:publish --tag=lighthouse-sanctum
3. Import the published schema into your main GraphQL schema (./graphql/schema.graphql
)
type Query type Mutation #import sanctum.graphql
4. HasApiTokens
Apply the Laravel\Sanctum\HasApiTokens
trait to your Authenticatable model as described in the Laravel Sanctum documentation.
use Illuminate\Auth\Authenticatable; use Laravel\Sanctum\Contracts\HasApiTokens as HasApiTokensContract; use Laravel\Sanctum\HasApiTokens; class User extends Authenticatable implements HasApiTokensContract { use HasApiTokens; }
5. Configuration
This package relies on API Token Authentication, which uses stateless Bearer tokens to authenticate requests.
By default, Laravel Sanctum assumes that requests made from localhost should use the stateful Spa Authentication instead. To disable this behaviour, remove any lines in your sanctum configuration:
// File: ./config/sanctum.php /* |-------------------------------------------------------------------------- | Stateful Domains |-------------------------------------------------------------------------- | | Requests from the following domains / hosts will receive stateful API | authentication cookies. Typically, these should include your local | and production domains which access your API via a frontend SPA. | */ 'stateful' => [ // Remove entries here ],
Make sure the following middleware is enabled for Lighthouse:
// File: ./config/lighthouse.php 'middleware' => [ ... \Nuwave\Lighthouse\Support\Http\Middleware\AttemptAuthentication::class, ... ],
Configure Lighthouse to use the Sanctum guard:
// File: ./config/lighthouse.php /* |-------------------------------------------------------------------------- | Authentication Guard |-------------------------------------------------------------------------- | | The guard to use for authenticating GraphQL requests, if needed. | This setting is used whenever Lighthouse looks for an authenticated user, for example in directives | such as `@guard` and when applying the `AttemptAuthentication` middleware. | */ 'guard' => 'sanctum',
Usage
- Login
- Logout
- Register
- Email Verification
- Resend Email Verification Link
- Forgot Password
- Reset Password
- Update Password
Login
Authenticate the user to receive a Bearer token.
mutation { login(input: { email: "john.doe@gmail.com" password: "secret" }) { token } }
Apply the Authorization header on subsequent calls using the token
"Authorization": "Bearer 1|lJo1cMhrW9tIUuGwlV1EPjKnvfZKzvgpGgplbwX9"
(Using something other than email? See Custom Identification)
Logout
Revoke the current token.
mutation { logout { status message } }
Register
Successfully registering a user will immediately yield a bearer token (unless email verification is required).
mutation { register(input: { name: "John Doe" email: "john.doe@gmail.com" password: "secret" password_confirmation: "secret" }) { token status } }
☝️ Want to disable password confirmation? Update your schema
When registering a user in combination with the MustVerifyEmail
contract you can optionally define the url for email verification.
Both __ID__
and __HASH__
will be replaced with the proper values.
When use_signed_email_verification_url
is enabled in the configuration, the placeholders __EXPIRES__
and __SIGNATURE__
will be replaced.
mutation { register(input: { name: "John Doe" email: "john.doe@gmail.com" password: "secret" password_confirmation: "secret" verification_url: { url: "https://my-front-end.com/verify-email?id=__ID__&token=__HASH__" # Signed: url: "https://my-front-end.com/verify-email?id=__ID__&token=__HASH__&expires=__EXPIRES__&signature=__SIGNATURE__" } }) { token status } }
Email Verification
mutation { verifyEmail(input: { id: "1" hash: "af269947ed80d4a7bc3f78a6dfd05ec369373f9d" }) { name email } }
When use_signed_email_verification_url
is enabled in the configuration, the input requires two additional fields.
mutation { verifyEmail(input: { id: "1" hash: "af269947ed80d4a7bc3f78a6dfd05ec369373f9d" expires: 1619775828 signature: "e923636f1093c414aab39f846e9d7a372beefa7b628b28179197e539c56aa0f0" }) { name email } }
Resend Email Verification Link
mutation { resendEmailVerification(input: { email: "john.doe@gmail.com", verification_url: { url: "https://my-front-end.com/verify-email?id=__ID__&token=__HASH__" # Signed: url: "https://my-front-end.com/verify-email?id=__ID__&token=__HASH__&expires=__EXPIRES__&signature=__SIGNATURE__" } }) { status } }
Forgot Password
Sends a reset password notification.
Optionally use custom reset url using both __EMAIL__
and __TOKEN__
placeholders.
mutation { forgotPassword(input: { email: "john.doe@gmail.com" reset_password_url: { url: "https://my-front-end.com/reset-password?email=__EMAIL__&token=__TOKEN__" } }) { status message } }
Reset Password
Reset the user's password.
mutation { resetPassword(input: { email: "john.doe@gmail.com", token: "af269947ed80d4a7bc3f78a6dfd05ec369373f9d" password: "secret" password_confirmation: "secret" }) { status message } }
☝️ Want to disable password confirmation? Update your schema
Update Password
Updates the current user's password.
mutation { updatePassword(input: { current_password: "mypass", password: "secret", password_confirmation: "secret" }) { status } }
Custom Identification
You can customize which fields are used for authenticating users.
For example, using username
instead of the default email
.
/* |-------------------------------------------------------------------------- | Identification |-------------------------------------------------------------------------- | | Configure the credential fields by which the user will be identified. | Default: email */ 'user_identifier_field_name' => 'username',
Update the GraphQL schema accordingly
input LoginInput { username: String! @rules(apply: ["required"]) }
Testing
composer test
Coverage
composer coverage
Static Analysis
composer analyze
Contributing
Please see CONTRIBUTING for details.
Credits
License
The MIT License (MIT). Please see License File for more information.