1. Guards
1.1. authentication will go through Guards
1.2. including: . drivers: define how it persist (session vs token) . provider: allow getting a user by certain criteria (get User from MongoDB instead of MySQL
1.3. Changing default Guard
1.3.1. defined in : app/auth.php
1.3.2. default: guards for web using sessions/users
1.3.3. $apiUser = auth()->guard('api')->user() we can use another guard for this call
1.4. Adding a new guard
1.4.1. define in auth.guards. we already defined . auth.guards.web . auth.guards.api
1.4.2. We can define new User Provider
1.4.3. auth route middleware can take additional parameters for guard name Route::group(['middleware' => 'auth:trainees'], function(){ //trainee routes goes here });
1.4.4. We must create a new class implements Illuminate\Contracts\Auth\UserProvider interface for NoSQL DB
2. Access Control List (ACL)
2.1. Definition: can, cannot, allows, denies is the verbs to check whether user has enough right to perform specify actions
2.2. Perform via GATE
2.3. Defining Authorization Rules
2.3.1. AuthServiceProvider::boot
2.3.2. Illuminate\Contracts\Auth\Access\Gate is injected automatically
2.3.3. sample: $gate::define('update-contact', function($user, $contact){ return $user->id === $contact->id });
2.3.4. can define by class@method instead of closure
2.4. Gate facade
2.4.1. we can pass new parameters (exclude $user) by Gate::allows('update-contact', [$contact]){ })
2.4.2. passing multiple params by passing arrays
2.4.3. Authorize entire routes by Route::get('people/create', function(){ })->middleware('can:create-person)
3. Auth Middleware
3.1. define in App\Http\Kernel
3.2. authentication related middleware are . auth: restrict route access to authenticated users. . auth.basic: HTTP basic authentication to authenticated users . guest: restrict access to unauthenticated users (for example we don't want logged in user to access login page again)
4. Controller Authorization
4.1. import AuthorizeRequestTraits
4.2. 3 methods for authorization . authorize() . authorizeForUser() . authorizeResource()
4.2.1. authorize({ability-name}, {array-of-parameters') : validate if logged-in user has the right to edit this resources
4.2.2. authorizeForUser({user}, {ability-name}, {array-of-parameter')
4.2.3. authorizeResource: call in controller constructor to maps a predefined set of authorization rules
4.3. We can checking on User instance $user->can('create-contact')
5. Testing
5.1. Using $this->be($user) for testing
6. User Model and Migration
6.1. Laravel shipped with default Authentication Model : App/User
6.2. run `php artisan make:auth` to create authentication class
6.3. Using auth() Global helper and the Auth Facade
6.3.1. auth()->guest(): check if user is guest
6.3.2. auth()->check(): return true if user is loggedin
6.3.3. auth()->user(), or auth()->id() : to get the user instance or id of currently logged in user
7. The Auth Controllers
7.1. Auth-namespaced controllers:
7.1.1. RegisterController
7.1.2. LoginController
7.1.3. ResetPasswordController
7.1.4. ForgotPasswordController
7.2. RegisterController
7.2.1. `$redirectTo` defines where user will be redirected after register
7.2.2. method `validator()` defines how to validate registrations
7.2.3. RegisterUsers trait
7.2.3.1. showRegistrationForm: display a view for user to input information
7.2.3.2. `register`: register user to database
7.2.3.3. `auth`: to use the guard
7.3. LoginController
7.3.1. AuthenticatesUsers trait
7.3.1.1. responsible for: . show users the login forms . validating the login . throttling failed logins . handling logout . redirecting users after successful logins
7.3.2. ThrottleLogins trait
7.3.2.1. interface of Illuminate\Cache\RateLimiter
7.3.2.2. ThrottleLogins limit any given combination of User name and IP address to 5 attempts per secs
7.4. ResetPasswordController
7.4.1. showResetForm: show the `auth.passwords.reset` view
7.4.2. resetPassword: actually reset the password
7.5. ForgotPasswordController
7.5.1. SendsPasswordResetEmails trait
7.5.2. can customize the broker methods
7.6. Auth::routes()
7.6.1. Auth::routes add these routes for authentication, registration, and password resets
7.7. Auth Scaffold
7.7.1. adding migrations for user
7.7.2. adding `Auth::routes()` to routes file
7.7.3. adding a view for each route from `Auth::routes()`
7.7.4. creates a HomeController to serve as landing page for logged in user
7.8. RememberMe
7.8.1. laravel shipped the remember_me to remember user via cookie
7.8.2. when a user accessed, it will check whether the `remember_me` token exists then will automatically log this user in
7.8.3. cookie expired is about 5 years (forever cookie)
8. Auth Events
8.1. events are broadcast to system
8.2. Illuminate\Auth\Events\Attempting
8.3. Illuminate\Auth\Events\Login
8.4. Illuminate\Auth\Events\Logout
8.5. Illuminate\Auth\Events\Lockout
9. Other Checks
9.1. Blade Check
9.1.1. blade have directives to check authorization
9.1.2. @can, @cannot, @endcan can do these authorization check
9.2. Intercepting Check
9.2.1. using before to override the authorization
9.2.2. $gate->before(function($user, $ability){ if ($user->isAdmin()){ return true } );
9.3. Policies
9.3.1. organizing structures to help grouping authorization logic based on resource you're controlling
9.3.2. make it easy to manage defining authorization rules for behavior toward a particular Eloquent model
9.3.3. defined in: $policies parameter in AuthService Provider
9.3.4. protected $policies = [ Contact::class => ContactPolicy::class ];
9.3.5. Gate will determine the first parameter to figure out which methods to check on the policy
9.4. Overriding Policies
9.4.1. before: just like normal ability definitions, define before methods allow us to override any call before it's even processed
9.4.2. public function before($user, $ability){ if $user->isAdmin() { return true; } };