lcharette/laravel-auth-api

Basic auth API routes for Single Page Application.

0.0.1 2021-04-04 01:52 UTC

Requires

• php: ^7.3|^8.0
• laravel/framework: ^8.12
• tymon/jwt-auth: ^1.0.0

Requires (Dev)

• friendsofphp/php-cs-fixer: ^2.17
• orchestra/testbench: ^6.15
• phpunit/phpunit: ^9.3.3

MIT

• Louis Charette

README

Branch	Build	Coverage	Style
main

Basic reusable auth API routes for Laravel based SPA application. No UI is provided with this package, except the one require for email validation and password recovery. This is meant to be the starting point for your Vue (or similar) based frontend.

This is still a work in progress and might not be used for production yet

Usage

Setup

composer require lcharette/laravel-auth-api

Next, you'll need to update your User model so it implemen Tymon\JWTAuth\Contracts\JWTSubject. The Lcharette\AuthApi\Auth\isJWTSubject trait can be used to add the required methods. For example :

class User extends Authenticatable implements JWTSubject
{
    use Notifiable, SoftDeletes, HasFactory, isJWTSubject;
   
    ...
}

Available Routes

Once installed, this packages adds the following routes to you Laravel app :

Method	Route	Description	Required Data
POST	/api/register	Post to this route to register a new user.	username, email, password, password_confirm
POST	/api/login	Perform login and return auth token.	email, password
POST	/api/logout	Perform logout action and invalidade current token.
POST	/api/refresh	Refresh current token and returns new one.
GET	/api/user	Return the current user information inside data key.

All routes will return a 200 status with json string if successfull. Any error will returns as a 400 error code with the error detail inside the json response. A 403 (forbidden) status code will be returned if the route is accessed without a valid token (except for login and register routes).

Limiting Other Routes

If you want to limit routes from your app to only "logged in" user, that is users that provides a valid token, you can add the Lcharette\AuthApi\Http\Middleware\RequireAuth middleware to any route or group of route. For example, this will make /list returns a 403 error if a valid token is not passed with the request :

Route::middleware([RequireAuth::class, 'api'])->group(function () {
    Route::get('/lists', [ListController::class, 'index']);
});

Alternatively, the Lcharette\AuthApi\Http\Middleware\RequireGuest middleware can be used if the route required the user not to be logged in.

Posting Token from Axios (Vue.js)

Token can be retreived from the login response and set as default header for future axios request. Just be sure to removed the token on logout or 401 error.

axios.post("/api/login", { email, password })
    .then(resp => {
        axios.defaults.headers.common['Authorization'] = 'Bearer ' + resp.data.access_token
    })
    .catch(err => {
        localStorage.removeItem("access_token");
    });

TODO

• Revoke token
• Update profile
• Update password
• Two Factor
• Password reset
• Email confirmation
• Custom user Trait / Interface
• Add more customisabilisation

License

This package is open-sourced under the MIT license.