Laravel 带有文件上传的 vapor“此操作未经授权”

Question

I have set up Laravel Vapor with my RESTFull app using Sanctum and now I'm trying to simply upload a file. I'm making a request POST /vapor/signed-storage-url and I'm getting:

{
    "message": "This action is unauthorized.",
    ...
}

I have created the UserPolicy as described in the docs :

class UserPolicy 
{
    /**
     * Determine whether the user can upload files.
     *
     * @param User $user
     * @return bool
     */
    public function uploadFiles(User $user): bool
    {
        return true;
    }
}

But I keep getting This action is unauthorized .

Answer 1

The key piece of information here is that I'm using Sanctum to authenticate my users in my app. Laravel's Vapor uses by default the web middleware

From the docs I wasn't able to find a way to publish Vapor's configuration.

If we look at the routes configuration we will have:

    /**
     * Ensure that Vapor's internal routes are defined.
     *
     * @return void
     */
    public function ensureRoutesAreDefined()
    {
        if ($this->app->routesAreCached()) {
            return;
        }

        if (config('vapor.signed_storage.enabled', true)) {
            Route::post(
                config('vapor.signed_storage.url', '/vapor/signed-storage-url'),
                Contracts\SignedStorageUrlController::class.'@store'
            )->middleware(config('vapor.middleware', 'web'));
        }
    }

Vapor is getting the vapor.middleware environment to tell which middleware will be applied to /vapor/signed-storage-url route. Since I'm using Sanctum I just had to manually publish Vapor's configuration by creating a vapor.php in my config folder:

- config
-- app.php
-- filesystem.php
-- vapor.php 👈

Now in this file you can define your middleware to be set to auth:sanctum :

<?php

return [
    // Most of these variables are not necessary as the default from Vapor's 
    // core library is okay for most cases but I will leave here you need to use any of them
    'redirect_to_root' => true,

    'redirect_robots_txt' => true,

    'serve_assets' => [],

    'middleware' => 'auth:sanctum' 👈
];

Now Vapor will start to use the auth:sanctum middleware to authenticate the request to POST /vapor/signed-storage-url