Laravel Auth中间件

Question

I have a controller and in my controller I have an index function that returns data back to the user.

The user can filter the query that they want the index function to return.

I noticed that only routes with the auth:api middleware would return a user object when I tried calling Auth::user() .

Now my function returns all events in my database. A user can filter the results like this ?filter=my to return a list of events they created. The issue here is the user has to be logged in before they can see events they created.

My problem is if I wrap this route with auth:api then guest users will not be able to use it. However if I don't then that particular filter that requires a user to be logged in will always return empty.

This is my controller:

public function index(Request $request)
    {
        $categoryId = $request->get("category_id");
        $userId = Auth::check() ? Auth::user()->id : 0;
        $filter = $request->get("filter");
        $keyword = $request->get("keyword");

        $events = Event::with(["category", "organisers", "banners", "schedules.ticketTypes", "schedules.venue", "schedules.programme"])
            ->when(!empty($categoryId), function ($query) use ($categoryId) {
                return $query->where("category_id", $categoryId);
            })
            ->whereNull("suspended_at")
            ->when($filter == "popular", function ($query) use ($categoryId) {
                return $query->orderBy("views", "DESC")
                    ->limit(15);
            })
            ->when($filter == "upcoming", function ($query) {
                return $query->whereHas("schedules", function ($query) {
                    $query->where("date", ">=", Carbon::now())
                        ->where("date", "<", Carbon::now()->addDays(14))
                        ->limit(15);
                });
            })
            /* This part requires the auth:api middleware since I will be querying based on the user's id which I will get from the auth token passed in thee header.*/
            ->when($filter == "my", function ($query) use ($userId) {
                return $query->whereHas("organisers", function ($query) use ($userId) {
                    $query->where("id", $userId)
                        ->limit(15);
                });
            })
            ->when($filter == "search" && !empty($keyword), function ($query) use ($keyword) {
                return $query->where("slug", "LIKE", "%" . $keyword . "%");
            })
            ->get();

        return EventResource::collection($events);
    }

This is my Kernel.php:

<?php

namespace App\Http;

use Illuminate\Foundation\Http\Kernel as HttpKernel;

class Kernel extends HttpKernel
{
    /**
     * The application's global HTTP middleware stack.
     *
     * These middleware are run during every request to your application.
     *
     * @var array
     */
    protected $middleware = [
        \Illuminate\Foundation\Http\Middleware\CheckForMaintenanceMode::class,
        \Illuminate\Foundation\Http\Middleware\ValidatePostSize::class,
        \App\Http\Middleware\TrimStrings::class,
        \Illuminate\Foundation\Http\Middleware\ConvertEmptyStringsToNull::class,
        \App\Http\Middleware\TrustProxies::class,
        \Barryvdh\Cors\HandleCors::class,
    ];

    /**
     * The application's route middleware groups.
     *
     * @var array
     */
    protected $middlewareGroups = [
        'web' => [
            \App\Http\Middleware\EncryptCookies::class,
            \Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse::class,
            \Illuminate\Session\Middleware\StartSession::class,
            // \Illuminate\Session\Middleware\AuthenticateSession::class,
            \Illuminate\View\Middleware\ShareErrorsFromSession::class,
            \App\Http\Middleware\VerifyCsrfToken::class,
            \Illuminate\Routing\Middleware\SubstituteBindings::class,
        ],

        'api' => [
            'throttle:60,1',
            'bindings',
        ],
    ];

    /**
     * The application's route middleware.
     *
     * These middleware may be assigned to groups or used individually.
     *
     * @var array
     */
    protected $routeMiddleware = [
        'auth' => \Illuminate\Auth\Middleware\Authenticate::class,
        'auth.basic' => \Illuminate\Auth\Middleware\AuthenticateWithBasicAuth::class,
        'bindings' => \Illuminate\Routing\Middleware\SubstituteBindings::class,
        'cache.headers' => \Illuminate\Http\Middleware\SetCacheHeaders::class,
        'can' => \Illuminate\Auth\Middleware\Authorize::class,
        'guest' => \App\Http\Middleware\RedirectIfAuthenticated::class,
        'signed' => \Illuminate\Routing\Middleware\ValidateSignature::class,
        'throttle' => \Illuminate\Routing\Middleware\ThrottleRequests::class,
        'acl' => \Kodeine\Acl\Middleware\HasPermission::class
    ];
}

In summary my index function does not require user to be logged in to access it. However when you pass the filter ?filter=my to the url then user is required to be logged in for data to be returned since the function will return results based on the user's id.

Edit: previously in situations like this I would use jwt.check middleware when I was using tymon/jwt-auth package. However there doesn't seem to be a passport equivalent of that.

Answer 1

Update the filter my as follows:

->when($filter == "my" && $userId != 0, function ($query) use ($userId) {
    ...
})

Then it will be ignored when $userId is 0.

Answer 2

I am not sure that i understand it correctly but if I did what about:

$userId = Auth::guard('api')->check() ? Auth::guard('api')->user()->id : null; 


->when($filter == "my" && $userId, function ($query) use ($userId) {
      return $query->whereHas("organisers", function ($query) use ($userId) {
            $query->where("id", $userId)->limit(15);
      });
 })