try make route public when it has auth middleware - php

Question

hello i got issue with access to few routes when they under restricted from middlewere
my route look like this
Route::group([
'middleware' => ['api','auth:sanctum'],
], function ($router) {
Route::prefix('users')->group(function ($usersRoute) {
Route::post('login', 'Api\Users\UserController#login');
Route::post('logout', 'Api\Users\UserController#logout');
Route::post('refresh', 'Api\Users\UserController#refresh');
Route::post('profile', 'Api\Users\UserController#profile');
});
Route::prefix('leads')->group(function ($leadRoute) {
// Route::get('look' , 'Api\Leads\LeadController#index');
// Route::get('look/{id}' , 'Api\Leads\LeadController#find');
// Route::post('look' , 'Api\Leads\LeadController#create');
// Route::put('look/{id}' , 'Api\Leads\LeadController#update');
// Route::delete('look/{id}' , 'Api\Leads\LeadController#archived');
// Route::put('look/{id}/view' , 'Api\Leads\LeadController#toggleView');
Route::prefix('assets')->group(function ($leadRoute) {
Route::get('/' , 'Api\Leads\AssetController#index');
Route::post('/' , 'Api\Leads\AssetController#create');
Route::get('/show/random' , 'Api\Leads\AssetController#showRandomAsset');
Route::delete('/{id}' , 'Api\Leads\AssetController#archived');
Route::delete('/autoclear' , 'Api\Leads\AssetController#autoClear');
Route::put('/{id}/show' , 'Api\Leads\AssetController#toggleShow');
});
});
});
now i have two controllers that the contractor look like this
class UserController extends BaseAPIController
{
/**
* Create a new AuthController instance.
*
* #return void
*/
public function __construct()
{
$this->middleware('auth:sanctum', ['except' => ['login']]);
}
when i check the route list
api,auth:sanctum |
| | POST | api/users/login | | App\Http\Controllers\Api\Users\UserController#login | api,auth:sanctum |
| | POST | api/users/logout | | App\Http\Controllers\Api\Users\UserController#logout | api,auth:sanctum |
| | POST | api/users/profile | | App\Http\Controllers\Api\Users\UserController#profile | api,auth:sanctum |
| | POST | api/users/refresh | | App\Http\Controllers\Api\Users\UserController#refresh | api,auth:sanctum
what i try is free login route free for all but i get
{
"message": "Unauthenticated."
}
i kinda lost please help

Answer 1

when I check the doc of laravel, I found that:
$this->middleware('subscribed')->except('store');
the second param for function middleware is using for options, so how about try:
$this->middleware('auth:sanctum')->except('login');

Answer 2

From your code, you're including the middleware twice and that's not right.
You should remove the group middleware in the routes file since you're already injecting the auth middleware in the constructor method.
Remove
Route::group([
'middleware' => ['api','auth:sanctum'],
], function ($router) {
After this your code should work as intended because auth:sanctum middleware would be called only once in your controller every time it is instantiated and will exclude the login route.