Laravel API 使用修改后的“MustVerifyApiEmail”和自定义“EnsureApiEmailIsVerified”中间件无法接收请求用户

Question

我使用 Laravel 6.x 作为带有外部（不同域）Vue 前端的后端，并且没有注册用户功能。 我注册用户的方式是使用 Maatwebsite/Laravel-Excel package 导入批量用户——效果很好。

因此，当创建每个用户时，通过向每个用户发送 email 验证链接来创建作业，当他们第一次登录时，他们需要更改密码，同时他们的 email 被标记为已验证 - 这也应该可以正常工作。

问题是，对于已经创建的用户工厂，他们的 email_verified_at 字段已填写 - 以及新导入的用户 - 我无法登录，因为自定义 EnsureEmailApiIsVerified 中间件无权访问 $request->user()。 我发现我可以指定 'api' 的身份验证保护，例如 $request->user('api') ，然后可以获取用户，但只有他们的 Bearer 令牌（使用 Laravel Passport）随请求一起发送.

这确实是有道理的，因为系统在没有诸如令牌之类的标识符的情况下如何知道请求用户是谁。 但是，用户 model 上的标准“实现 MustVerifyEmail”和 web 路由上的后续标准“EnsureEmailIsVerified”中间件如何获取 $request->user()？

有理由认为，（标准和我的自定义）中间件都应该可以访问 $request->user() 或者两者都不应该。

现在我不得不修改并将相当多的框架控制器带入我的 App\Http 目录，但我几乎逐字复制了它们，只是更改了一些东西以确保它适用于我的 API 路由 - 因为将默认保护设置为“api”而不是 config/auth.php 中的 'web' 并没有像我想象的那样在我的控制器中使用它作为默认值。

所以这是我遵循的步骤：

创建了一个自定义中间件并将其附加到 App\Http\Kernel.php 中的整个“api”中间件组

/**
     * The application's route middleware groups.
     *
     * @var array
     */
    protected $middlewareGroups = [
        'web' => [
            \App\Http\Middleware\EncryptCookies::class,
            \Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse::class,
            \Illuminate\Session\Middleware\StartSession::class,
            // \Illuminate\Session\Middleware\AuthenticateSession::class,
            \Illuminate\View\Middleware\ShareErrorsFromSession::class,
            \App\Http\Middleware\VerifyCsrfToken::class,
            \Illuminate\Routing\Middleware\SubstituteBindings::class
        ],

        'api' => [
            'throttle:60,1',
            'bindings',
            'verifiedapi',

        ],
    ];

    /**
     * The application's route middleware.
     *
     * These middleware may be assigned to groups or used individually.
     *
     * @var array
     */
    protected $routeMiddleware = [
        'auth' => \App\Http\Middleware\Authenticate::class,
        'auth.basic' => \Illuminate\Auth\Middleware\AuthenticateWithBasicAuth::class,
        'bindings' => \Illuminate\Routing\Middleware\SubstituteBindings::class,
        'cache.headers' => \Illuminate\Http\Middleware\SetCacheHeaders::class,
        'can' => \Illuminate\Auth\Middleware\Authorize::class,
        'guest' => \App\Http\Middleware\RedirectIfAuthenticated::class,
        'password.confirm' => \Illuminate\Auth\Middleware\RequirePassword::class,
        'role' => \App\Http\Middleware\HasRole::class,
        'signed' => \Illuminate\Routing\Middleware\ValidateSignature::class,
        'throttle' => \Illuminate\Routing\Middleware\ThrottleRequests::class,
        'verified' => \Illuminate\Auth\Middleware\EnsureEmailIsVerified::class,
        'verifiedapi' => \App\Http\Middleware\EnsureApiEmailIsVerified::class,
    ];

然后是自定义的“EnsureApiEmailIsVerified”中间件：

<?php

namespace App\Http\Middleware;

use Closure;
use App\Http\Controllers\API\Auth\MustVerifyApiEmail;

class EnsureApiEmailIsVerified
{
    /**
     * Handle an incoming request.
     *
     * @param  \Illuminate\Http\Request  $request
     * @param  \Closure  $next
     * @return mixed
     */
    public function handle($request, Closure $next)
    {
        if (! $request->user('api') ||
            ($request->user('api') instanceof MustVerifyApiEmail &&
            ! $request->user('api')->hasVerifiedEmail())) {
            return abort(403, 'Your email has not yet been verified.');
        }

        return $next($request);
    }
}

您将看到它引用了我的自定义“MustVerifyApiEmail”的一个实例，该实例是在用户 Model 上使用的特征，唯一偏离标准特征的是公共 function 'sendApiEmailVerificationNotification'，例如：

<?php

namespace App\Http\Controllers\API\Auth;

use App\Notifications\VerifyApiEmail;

trait MustVerifyApiEmail
{
    /**
     * Determine if the user has verified their email address.
     *
     * @return bool
     */
    public function hasVerifiedEmail()
    {
        return ! is_null($this->email_verified_at);
    }

    /**
     * Mark the given user's email as verified.
     *
     * @return bool
     */
    public function markEmailAsVerified()
    {
        return $this->forceFill([
            'email_verified_at' => $this->freshTimestamp(),
        ])->save();
    }

    /**
     * Send the email verification notification.
     *
     * @return void
     */
    public function sendApiEmailVerificationNotification()
    {
        $this->notify(new VerifyApiEmail);
    }

    /**
     * Get the email address that should be used for verification.
     *
     * @return string
     */
    public function getEmailForVerification()
    {
        return $this->email;
    }
}

这个新的 'sendApiEmailVerificationNotification()' 通过自定义的 VerifyApiEmail 通知通知 $request-user('api')，如下所示：

<?php

namespace App\Notifications;

use Illuminate\Bus\Queueable;
use Illuminate\Support\Carbon;
use Illuminate\Support\Facades\URL;
use Illuminate\Support\Facades\Lang;
use Illuminate\Support\Facades\Config;
use Illuminate\Notifications\Notification;
use Illuminate\Contracts\Queue\ShouldQueue;
use Illuminate\Notifications\Messages\MailMessage;

class VerifyApiEmail implements ShouldQueue
{
    use Queueable;

    /**
     * The callback that should be used to build the mail message.
     *
     * @var \Closure|null
     */
    public static $toMailCallback;

    /**
     * Create a new notification instance.
     *
     * @return void
     */
    public function __construct()
    {
        //
    }

    /**
     * Get the notification's delivery channels.
     *
     * @param  mixed  $notifiable
     * @return array
     */
    public function via($notifiable)
    {
        return ['mail'];
    }

    /**
     * Build the mail representation of the notification.
     *
     * @param  mixed  $notifiable
     * @return \Illuminate\Notifications\Messages\MailMessage
     */
    public function toMail($notifiable)
    {
        $verificationUrl = $this->verificationUrl($notifiable);

        if (static::$toMailCallback) {
            return call_user_func(static::$toMailCallback, $notifiable, $verificationUrl);
        }

        return (new MailMessage)
            ->subject(Lang::get('Verify Email Address'))
            ->line(Lang::get('Please click the button below to verify your email address.'))
            ->action(Lang::get('Verify Email Address'), $verificationUrl)
            ->line(Lang::get('If you did not create an account, no further action is required.'));
    }

    /**
     * Get the verification URL for the given notifiable.
     *
     * @param  mixed  $notifiable
     * @return string
     */
    protected function verificationUrl($notifiable)
    {
        return URL::temporarySignedRoute(
            'verification.api.verify',
            Carbon::now()->addMinutes(Config::get('auth.verification.expire', 60)),
            [
                'id' => $notifiable->getKey(),
                'hash' => sha1($notifiable->getEmailForVerification()),
            ]
        );
    }

    /**
     * Set a callback that should be used when building the notification mail message.
     *
     * @param  \Closure  $callback
     * @return void
     */
    public static function toMailUsing($callback)
    {
        static::$toMailCallback = $callback;
    }
}

新的api路线如下：

Route::namespace('API\Auth')->group(function () {
    Route::post('login', 'PassportController@login');
    Route::post('refresh', 'PassportController@refresh');
    Route::post('logout', 'PassportController@logout');
    Route::get('email/verify/{id}/{hash}', 'VerificationApiController@verify')->name('verification.api.verify');
    Route::get('email/resend', 'VerificationApiController@resend')->name('api.verification.resend');
});

而 VerificationApiController 如下：

<?php

namespace App\Http\Controllers\API\Auth;

use Illuminate\Http\Request;
use App\Http\Controllers\Controller;
use Illuminate\Auth\Events\Verified;
use Illuminate\Auth\Access\AuthorizationException;

class VerificationApiController extends Controller
{

    /**
     * Show the email verification notice.
     *
     * @param  \Illuminate\Http\Request  $request
     * @return \Illuminate\Http\Response
     */
    public function show(Request $request)
    {
        //
    }

    /**
     * Mark the authenticated user's email address as verified.
     *
     * @param  \Illuminate\Http\Request  $request
     * @return \Illuminate\Http\Response
     *
     * @throws \Illuminate\Auth\Access\AuthorizationException
     */
    public function verify(Request $request)
    {
        if (! hash_equals((string) $request->route('id'), (string) $request->user('api')->getKey())) {
            throw new AuthorizationException;
        }

        if (! hash_equals((string) $request->route('hash'), sha1($request->user('api')->getEmailForVerification()))) {
            throw new AuthorizationException;
        }

        if ($request->user('api')->hasVerifiedEmail()) {
            return response()->json(['error' => 'Email already verified'], 422);
        }

        if ($request->user('api')->markEmailAsVerified()) {
            event(new Verified($request->user('api')));
        }

        return response()->json(['success' => 'Email verified!']);
    }

    /**
     * Resend the email verification notification.
     *
     * @param  \Illuminate\Http\Request  $request
     * @return \Illuminate\Http\Response
     */
    public function resend(Request $request)
    {
        $request->user('api')->sendApiEmailVerificationNotification();

        return response()->json(['success' => 'Email verification has been resent!']);
    }
}

我还注意到，在 User Model 上，它将 User 扩展为 Authenticatable，然后使用标准 MustVerifyEmail' - 所以我也将其从框架中取出，并将用法更改为新的 MustVerifyApiEmail - 如下所示：

<?php

namespace App\Http\Controllers\API\Auth;

use Illuminate\Auth\Authenticatable;
use Illuminate\Database\Eloquent\Model;
use Illuminate\Auth\Passwords\CanResetPassword;
use Illuminate\Foundation\Auth\Access\Authorizable;
use App\Http\Controllers\API\Auth\MustVerifyApiEmail;
use Illuminate\Contracts\Auth\Authenticatable as AuthenticatableContract;
use Illuminate\Contracts\Auth\Access\Authorizable as AuthorizableContract;
use Illuminate\Contracts\Auth\CanResetPassword as CanResetPasswordContract;

class User extends Model implements
    AuthenticatableContract,
    AuthorizableContract,
    CanResetPasswordContract
{
    use Authenticatable, Authorizable, CanResetPassword, MustVerifyApiEmail;
}

我的用户 model 然后在顶部看起来像这样：

<?php

namespace App;

use Illuminate\Support\Str;
use Laravel\Passport\HasApiTokens;
use Illuminate\Notifications\Notifiable;
use App\Http\Controllers\API\Auth\User as Authenticatable;
use App\Http\Controllers\API\Auth\MustVerifyApiEmailInterface;

class User extends Authenticatable implements MustVerifyApiEmailInterface
{
    use HasApiTokens, Notifiable;
...

正如您所看到的，这是相当多的定制——但理论上它应该都可以工作，而且我没有得到任何可以使用的错误。 以下是我得到的错误：

当我使用 email 已验证或什至未验证的用户登录时，我收到用户的 email 尚未验证的错误 - 但只是因为它没有获取 $request->user('api')。 当我在返回请求转储 $request->user('api') 之前尝试在中间件本身中引发错误时，它给了我 null

所以我的问题是，使用 'verified' => \Illuminate\Auth\Middleware\EnsureEmailIsVerified::class 的标准中间件 - 这如何获取 $request->user()？

有什么我遗漏的东西还是我以错误的方式解决这个问题？ 似乎当用户登录时它没有登录然后运行中间件 - 所以没有 $request->user('api') - 也许是因为我使用的是 Passport，但我认为应该发生的情况是中间件需要在对用户进行身份验证后运行，然后才能访问 $request->user('api')

任何指导都将不胜感激！

api.php

Route::prefix('email')->middleware(['auth:api'])->group(function () {
  Route::get('resend', 'VerificationController@resend')->name('verification.resend');
  Route::get('verify/{id}/{hash}', 'VerificationController@verify')->name('verification.verify');
});