Hassan Ajek
5 years ago
17 changed files with 861 additions and 55 deletions
@ -0,0 +1,19 @@ |
|||||
|
<?php |
||||
|
|
||||
|
namespace App\Http\Controllers; |
||||
|
|
||||
|
use App\Http\Forms\SchoolForms\RegisterSchoolForm; |
||||
|
use App\Http\Forms\SchoolForms\RenewTokenForm; |
||||
|
|
||||
|
class SchoolUserController extends Controller |
||||
|
{ |
||||
|
public function renewToken(RenewTokenForm $form) |
||||
|
{ |
||||
|
return $form->run(); |
||||
|
} |
||||
|
|
||||
|
public function register(RegisterSchoolForm $form) |
||||
|
{ |
||||
|
return $form->run(); |
||||
|
} |
||||
|
} |
||||
@ -0,0 +1,37 @@ |
|||||
|
<?php |
||||
|
namespace App\Http\Forms\SchoolForms; |
||||
|
|
||||
|
use App\SchoolUser; |
||||
|
use Illuminate\Foundation\Http\FormRequest; |
||||
|
use Illuminate\Support\Facades\Hash; |
||||
|
use Tymon\JWTAuth\Facades\JWTAuth; |
||||
|
|
||||
|
class RegisterSchoolForm extends FormRequest |
||||
|
{ |
||||
|
public function rules() |
||||
|
{ |
||||
|
return [ |
||||
|
'name' => 'required|string|max:255', |
||||
|
'email' => 'required|string|email|max:255|unique:school_users', |
||||
|
'url' => 'required|string|regex:/^https?:\/\/.*teacharabia\.com\/api$/i|unique:school_users', |
||||
|
'password' => 'required|string|min:6|confirmed', |
||||
|
'super_password' => 'required|string' |
||||
|
]; |
||||
|
} |
||||
|
|
||||
|
public function run() |
||||
|
{ |
||||
|
if (env('APP_SUPER_PASSWORD') != $this->super_password) { |
||||
|
$this->failedAuthorization(); |
||||
|
} |
||||
|
else{ |
||||
|
$hashPassword['password'] = Hash::make($this->password); |
||||
|
$this->merge($hashPassword); |
||||
|
$user = new SchoolUser(); |
||||
|
$user->fill($this->only($user->getFillable())); |
||||
|
$user->save(); |
||||
|
$token = JWTAuth::fromUser($user); |
||||
|
return ['token' => $token]; |
||||
|
} |
||||
|
} |
||||
|
} |
||||
@ -0,0 +1,35 @@ |
|||||
|
<?php |
||||
|
|
||||
|
namespace App\Http\Forms\SchoolForms; |
||||
|
|
||||
|
use Illuminate\Foundation\Http\FormRequest; |
||||
|
use Tymon\JWTAuth\Facades\JWTAuth; |
||||
|
use Tymon\JWTAuth\Exceptions\TokenInvalidException; |
||||
|
|
||||
|
class RenewTokenForm extends FormRequest |
||||
|
{ |
||||
|
public function rules() |
||||
|
{ |
||||
|
return [ |
||||
|
'email' => 'required|string|email|max:255|exists:school_users', |
||||
|
'password' => 'required|string|min:6', |
||||
|
'super_password' => 'required|string', |
||||
|
]; |
||||
|
} |
||||
|
|
||||
|
public function run() |
||||
|
{ |
||||
|
if (env('APP_SUPER_PASSWORD') != $this->super_password) { |
||||
|
$this->failedAuthorization(); |
||||
|
} |
||||
|
else{ |
||||
|
$newToken = JWTAuth::attempt(['email' => $this->email, 'password' => $this->password]); |
||||
|
if($newToken){ |
||||
|
JWTAuth::invalidate(true); |
||||
|
return ['token' => $newToken]; |
||||
|
}else{ |
||||
|
throw new TokenInvalidException('Wrong credentials.'); |
||||
|
} |
||||
|
} |
||||
|
} |
||||
|
} |
||||
@ -0,0 +1,21 @@ |
|||||
|
<?php |
||||
|
|
||||
|
namespace App\Http\Middleware; |
||||
|
|
||||
|
use Closure; |
||||
|
|
||||
|
class JsonMiddleware |
||||
|
{ |
||||
|
/** |
||||
|
* Handle an incoming request. |
||||
|
* |
||||
|
* @param \Illuminate\Http\Request $request |
||||
|
* @param \Closure $next |
||||
|
* @return mixed |
||||
|
*/ |
||||
|
public function handle($request, Closure $next) |
||||
|
{ |
||||
|
$request->headers->set('Accept', 'application/json'); |
||||
|
return $next($request); |
||||
|
} |
||||
|
} |
||||
@ -0,0 +1,22 @@ |
|||||
|
<?php |
||||
|
|
||||
|
namespace App\Http\Middleware; |
||||
|
|
||||
|
use Closure; |
||||
|
use Tymon\JWTAuth\Facades\JWTAuth; |
||||
|
|
||||
|
class JwtMiddleware |
||||
|
{ |
||||
|
/** |
||||
|
* Handle an incoming request. |
||||
|
* |
||||
|
* @param \Illuminate\Http\Request $request |
||||
|
* @param \Closure $next |
||||
|
* @return mixed |
||||
|
*/ |
||||
|
public function handle($request, Closure $next) |
||||
|
{ |
||||
|
JWTAuth::parseToken()->authenticate(); |
||||
|
return $next($request); |
||||
|
} |
||||
|
} |
||||
@ -0,0 +1,37 @@ |
|||||
|
<?php |
||||
|
|
||||
|
namespace App; |
||||
|
|
||||
|
use Illuminate\Foundation\Auth\User as Authenticatable; |
||||
|
use Tymon\JWTAuth\Contracts\JWTSubject; |
||||
|
|
||||
|
class SchoolUser extends Authenticatable implements JWTSubject |
||||
|
{ |
||||
|
/** |
||||
|
* The attributes that are mass assignable. |
||||
|
* |
||||
|
* @var array |
||||
|
*/ |
||||
|
protected $fillable = [ |
||||
|
'name', 'email', 'password', 'url', |
||||
|
]; |
||||
|
|
||||
|
/** |
||||
|
* The attributes that should be hidden for arrays. |
||||
|
* |
||||
|
* @var array |
||||
|
*/ |
||||
|
protected $hidden = [ |
||||
|
'password' |
||||
|
]; |
||||
|
|
||||
|
public function getJWTIdentifier() |
||||
|
{ |
||||
|
return $this->getKey(); |
||||
|
} |
||||
|
|
||||
|
public function getJWTCustomClaims() |
||||
|
{ |
||||
|
return []; |
||||
|
} |
||||
|
} |
||||
@ -1,39 +0,0 @@ |
|||||
<?php |
|
||||
|
|
||||
namespace App; |
|
||||
|
|
||||
use Illuminate\Contracts\Auth\MustVerifyEmail; |
|
||||
use Illuminate\Foundation\Auth\User as Authenticatable; |
|
||||
use Illuminate\Notifications\Notifiable; |
|
||||
|
|
||||
class User extends Authenticatable |
|
||||
{ |
|
||||
use Notifiable; |
|
||||
|
|
||||
/** |
|
||||
* The attributes that are mass assignable. |
|
||||
* |
|
||||
* @var array |
|
||||
*/ |
|
||||
protected $fillable = [ |
|
||||
'name', 'email', 'password', |
|
||||
]; |
|
||||
|
|
||||
/** |
|
||||
* The attributes that should be hidden for arrays. |
|
||||
* |
|
||||
* @var array |
|
||||
*/ |
|
||||
protected $hidden = [ |
|
||||
'password', 'remember_token', |
|
||||
]; |
|
||||
|
|
||||
/** |
|
||||
* The attributes that should be cast to native types. |
|
||||
* |
|
||||
* @var array |
|
||||
*/ |
|
||||
protected $casts = [ |
|
||||
'email_verified_at' => 'datetime', |
|
||||
]; |
|
||||
} |
|
||||
@ -0,0 +1,303 @@ |
|||||
|
<?php |
||||
|
|
||||
|
/* |
||||
|
* This file is part of jwt-auth. |
||||
|
* |
||||
|
* (c) Sean Tymon <tymon148@gmail.com> |
||||
|
* |
||||
|
* For the full copyright and license information, please view the LICENSE |
||||
|
* file that was distributed with this source code. |
||||
|
*/ |
||||
|
|
||||
|
return [ |
||||
|
|
||||
|
/* |
||||
|
|-------------------------------------------------------------------------- |
||||
|
| JWT Authentication Secret |
||||
|
|-------------------------------------------------------------------------- |
||||
|
| |
||||
|
| Don't forget to set this in your .env file, as it will be used to sign |
||||
|
| your tokens. A helper command is provided for this: |
||||
|
| `php artisan jwt:secret` |
||||
|
| |
||||
|
| Note: This will be used for Symmetric algorithms only (HMAC), |
||||
|
| since RSA and ECDSA use a private/public key combo (See below). |
||||
|
| |
||||
|
*/ |
||||
|
|
||||
|
'secret' => env('JWT_SECRET'), |
||||
|
|
||||
|
/* |
||||
|
|-------------------------------------------------------------------------- |
||||
|
| JWT Authentication Keys |
||||
|
|-------------------------------------------------------------------------- |
||||
|
| |
||||
|
| The algorithm you are using, will determine whether your tokens are |
||||
|
| signed with a random string (defined in `JWT_SECRET`) or using the |
||||
|
| following public & private keys. |
||||
|
| |
||||
|
| Symmetric Algorithms: |
||||
|
| HS256, HS384 & HS512 will use `JWT_SECRET`. |
||||
|
| |
||||
|
| Asymmetric Algorithms: |
||||
|
| RS256, RS384 & RS512 / ES256, ES384 & ES512 will use the keys below. |
||||
|
| |
||||
|
*/ |
||||
|
|
||||
|
'keys' => [ |
||||
|
|
||||
|
/* |
||||
|
|-------------------------------------------------------------------------- |
||||
|
| Public Key |
||||
|
|-------------------------------------------------------------------------- |
||||
|
| |
||||
|
| A path or resource to your public key. |
||||
|
| |
||||
|
| E.g. 'file://path/to/public/key' |
||||
|
| |
||||
|
*/ |
||||
|
|
||||
|
'public' => env('JWT_PUBLIC_KEY'), |
||||
|
|
||||
|
/* |
||||
|
|-------------------------------------------------------------------------- |
||||
|
| Private Key |
||||
|
|-------------------------------------------------------------------------- |
||||
|
| |
||||
|
| A path or resource to your private key. |
||||
|
| |
||||
|
| E.g. 'file://path/to/private/key' |
||||
|
| |
||||
|
*/ |
||||
|
|
||||
|
'private' => env('JWT_PRIVATE_KEY'), |
||||
|
|
||||
|
/* |
||||
|
|-------------------------------------------------------------------------- |
||||
|
| Passphrase |
||||
|
|-------------------------------------------------------------------------- |
||||
|
| |
||||
|
| The passphrase for your private key. Can be null if none set. |
||||
|
| |
||||
|
*/ |
||||
|
|
||||
|
'passphrase' => env('JWT_PASSPHRASE'), |
||||
|
|
||||
|
], |
||||
|
|
||||
|
/* |
||||
|
|-------------------------------------------------------------------------- |
||||
|
| JWT time to live |
||||
|
|-------------------------------------------------------------------------- |
||||
|
| |
||||
|
| Specify the length of time (in minutes) that the token will be valid for. |
||||
|
| Defaults to 1 hour. |
||||
|
| |
||||
|
| You can also set this to null, to yield a never expiring token. |
||||
|
| Some people may want this behaviour for e.g. a mobile app. |
||||
|
| This is not particularly recommended, so make sure you have appropriate |
||||
|
| systems in place to revoke the token if necessary. |
||||
|
| Notice: If you set this to null you should remove 'exp' element from 'required_claims' list. |
||||
|
| |
||||
|
*/ |
||||
|
|
||||
|
'ttl' => env('JWT_TTL', 60), |
||||
|
|
||||
|
/* |
||||
|
|-------------------------------------------------------------------------- |
||||
|
| Refresh time to live |
||||
|
|-------------------------------------------------------------------------- |
||||
|
| |
||||
|
| Specify the length of time (in minutes) that the token can be refreshed |
||||
|
| within. I.E. The user can refresh their token within a 2 week window of |
||||
|
| the original token being created until they must re-authenticate. |
||||
|
| Defaults to 2 weeks. |
||||
|
| |
||||
|
| You can also set this to null, to yield an infinite refresh time. |
||||
|
| Some may want this instead of never expiring tokens for e.g. a mobile app. |
||||
|
| This is not particularly recommended, so make sure you have appropriate |
||||
|
| systems in place to revoke the token if necessary. |
||||
|
| |
||||
|
*/ |
||||
|
|
||||
|
'refresh_ttl' => env('JWT_REFRESH_TTL', 20160), |
||||
|
|
||||
|
/* |
||||
|
|-------------------------------------------------------------------------- |
||||
|
| JWT hashing algorithm |
||||
|
|-------------------------------------------------------------------------- |
||||
|
| |
||||
|
| Specify the hashing algorithm that will be used to sign the token. |
||||
|
| |
||||
|
| See here: https://github.com/namshi/jose/tree/master/src/Namshi/JOSE/Signer/OpenSSL |
||||
|
| for possible values. |
||||
|
| |
||||
|
*/ |
||||
|
|
||||
|
'algo' => env('JWT_ALGO', 'HS256'), |
||||
|
|
||||
|
/* |
||||
|
|-------------------------------------------------------------------------- |
||||
|
| Required Claims |
||||
|
|-------------------------------------------------------------------------- |
||||
|
| |
||||
|
| Specify the required claims that must exist in any token. |
||||
|
| A TokenInvalidException will be thrown if any of these claims are not |
||||
|
| present in the payload. |
||||
|
| |
||||
|
*/ |
||||
|
|
||||
|
'required_claims' => [ |
||||
|
'iss', |
||||
|
'iat', |
||||
|
'nbf', |
||||
|
'sub', |
||||
|
'jti', |
||||
|
], |
||||
|
|
||||
|
/* |
||||
|
|-------------------------------------------------------------------------- |
||||
|
| Persistent Claims |
||||
|
|-------------------------------------------------------------------------- |
||||
|
| |
||||
|
| Specify the claim keys to be persisted when refreshing a token. |
||||
|
| `sub` and `iat` will automatically be persisted, in |
||||
|
| addition to the these claims. |
||||
|
| |
||||
|
| Note: If a claim does not exist then it will be ignored. |
||||
|
| |
||||
|
*/ |
||||
|
|
||||
|
'persistent_claims' => [ |
||||
|
// 'foo', |
||||
|
// 'bar', |
||||
|
], |
||||
|
|
||||
|
/* |
||||
|
|-------------------------------------------------------------------------- |
||||
|
| Lock Subject |
||||
|
|-------------------------------------------------------------------------- |
||||
|
| |
||||
|
| This will determine whether a `prv` claim is automatically added to |
||||
|
| the token. The purpose of this is to ensure that if you have multiple |
||||
|
| authentication models e.g. `App\User` & `App\OtherPerson`, then we |
||||
|
| should prevent one authentication request from impersonating another, |
||||
|
| if 2 tokens happen to have the same id across the 2 different models. |
||||
|
| |
||||
|
| Under specific circumstances, you may want to disable this behaviour |
||||
|
| e.g. if you only have one authentication model, then you would save |
||||
|
| a little on token size. |
||||
|
| |
||||
|
*/ |
||||
|
|
||||
|
'lock_subject' => true, |
||||
|
|
||||
|
/* |
||||
|
|-------------------------------------------------------------------------- |
||||
|
| Leeway |
||||
|
|-------------------------------------------------------------------------- |
||||
|
| |
||||
|
| This property gives the jwt timestamp claims some "leeway". |
||||
|
| Meaning that if you have any unavoidable slight clock skew on |
||||
|
| any of your servers then this will afford you some level of cushioning. |
||||
|
| |
||||
|
| This applies to the claims `iat`, `nbf` and `exp`. |
||||
|
| |
||||
|
| Specify in seconds - only if you know you need it. |
||||
|
| |
||||
|
*/ |
||||
|
|
||||
|
'leeway' => env('JWT_LEEWAY', 0), |
||||
|
|
||||
|
/* |
||||
|
|-------------------------------------------------------------------------- |
||||
|
| Blacklist Enabled |
||||
|
|-------------------------------------------------------------------------- |
||||
|
| |
||||
|
| In order to invalidate tokens, you must have the blacklist enabled. |
||||
|
| If you do not want or need this functionality, then set this to false. |
||||
|
| |
||||
|
*/ |
||||
|
|
||||
|
'blacklist_enabled' => env('JWT_BLACKLIST_ENABLED', true), |
||||
|
|
||||
|
/* |
||||
|
| ------------------------------------------------------------------------- |
||||
|
| Blacklist Grace Period |
||||
|
| ------------------------------------------------------------------------- |
||||
|
| |
||||
|
| When multiple concurrent requests are made with the same JWT, |
||||
|
| it is possible that some of them fail, due to token regeneration |
||||
|
| on every request. |
||||
|
| |
||||
|
| Set grace period in seconds to prevent parallel request failure. |
||||
|
| |
||||
|
*/ |
||||
|
|
||||
|
'blacklist_grace_period' => env('JWT_BLACKLIST_GRACE_PERIOD', 0), |
||||
|
|
||||
|
/* |
||||
|
|-------------------------------------------------------------------------- |
||||
|
| Cookies encryption |
||||
|
|-------------------------------------------------------------------------- |
||||
|
| |
||||
|
| By default Laravel encrypt cookies for security reason. |
||||
|
| If you decide to not decrypt cookies, you will have to configure Laravel |
||||
|
| to not encrypt your cookie token by adding its name into the $except |
||||
|
| array available in the middleware "EncryptCookies" provided by Laravel. |
||||
|
| see https://laravel.com/docs/master/responses#cookies-and-encryption |
||||
|
| for details. |
||||
|
| |
||||
|
| Set it to true if you want to decrypt cookies. |
||||
|
| |
||||
|
*/ |
||||
|
|
||||
|
'decrypt_cookies' => false, |
||||
|
|
||||
|
/* |
||||
|
|-------------------------------------------------------------------------- |
||||
|
| Providers |
||||
|
|-------------------------------------------------------------------------- |
||||
|
| |
||||
|
| Specify the various providers used throughout the package. |
||||
|
| |
||||
|
*/ |
||||
|
|
||||
|
'providers' => [ |
||||
|
|
||||
|
/* |
||||
|
|-------------------------------------------------------------------------- |
||||
|
| JWT Provider |
||||
|
|-------------------------------------------------------------------------- |
||||
|
| |
||||
|
| Specify the provider that is used to create and decode the tokens. |
||||
|
| |
||||
|
*/ |
||||
|
|
||||
|
'jwt' => Tymon\JWTAuth\Providers\JWT\Lcobucci::class, |
||||
|
|
||||
|
/* |
||||
|
|-------------------------------------------------------------------------- |
||||
|
| Authentication Provider |
||||
|
|-------------------------------------------------------------------------- |
||||
|
| |
||||
|
| Specify the provider that is used to authenticate users. |
||||
|
| |
||||
|
*/ |
||||
|
|
||||
|
'auth' => Tymon\JWTAuth\Providers\Auth\Illuminate::class, |
||||
|
|
||||
|
/* |
||||
|
|-------------------------------------------------------------------------- |
||||
|
| Storage Provider |
||||
|
|-------------------------------------------------------------------------- |
||||
|
| |
||||
|
| Specify the provider that is used to store tokens in the blacklist. |
||||
|
| |
||||
|
*/ |
||||
|
|
||||
|
'storage' => Tymon\JWTAuth\Providers\Storage\Illuminate::class, |
||||
|
|
||||
|
], |
||||
|
|
||||
|
]; |
||||
Loading…
Reference in new issue