Allow users with is_request 1 to not log in - php

Question

I am currently working on a system where people can submit a registration request. The admin will need to accept the request in order for the user to be able to sign in. In my database, I have a field called is_request and with every registration this field is set by default to 1 (is set by default to 1 in the database) , meaning yes. When a user with this field set to 1, tries to log in, they will need to be notified that their account has not yet been activated. How can I accomplish this?
When the user tries to register the following happens:
protected function create(array $data)
{
$users = User::where('role_id', 1)->get();
$user = User::create([
'firstname' => $data['firstname'],
'lastname' => $data['lastname'],
'email' => $data['email'],
'role_id' => 3,
'activated' => 0,
'user_token' => Str::random(32),
'password' => Hash::make($data['password']),
]);
foreach($users as $admin) {
$admin->notify(new registerRequest($user));
}
Mail::to($user->email)->send(new RegisterRequestSend($user));
return $user;
}
And when the admin in the backend "accepts" the request the field is_request will be set to 0 and the user needs to be able to sign into the app.
The login controller looks like this
class LoginController extends Controller
{
/*
|--------------------------------------------------------------------------
| Login Controller
|--------------------------------------------------------------------------
|
| This controller handles authenticating users for the application and
| redirecting them to your home screen. The controller uses a trait
| to conveniently provide its functionality to your applications.
|
*/
use AuthenticatesUsers;
/**
* Where to redirect users after login.
*
* #var string
*/
protected $redirectTo = RouteServiceProvider::HOME;
/**
* Create a new controller instance.
*
* #return void
*/
public function __construct()
{
$this->middleware('guest')->except('logout');
}
}
Update:: DB Table

Answer 1

You could create an global middleware that checks if the user is accepted or not:
namespace App\Http\Middleware;
use Closure;
class CheckIfAccepted
{
/**
* Handle an incoming request.
*
* #param \Illuminate\Http\Request $request
* #param \Closure $next
* #return mixed
*/
public function handle($request, Closure $next)
{
if (auth()->check() && !auth()->user()->isAccepted) {
auth()->logout();
return redirect('not-accepted');
}
return $next($request);
}
}
This middleware will log out any authed user that aren't accepted and redirect them to a route of your choice.
Change auth()->user()->isAccepted to an attribute or method that contains information about the accepted-status.
If you want the middleware to run at every request, you can add it as a global middleware by adding it the the $middleware-array in app/Http/Kernel.php.
You can read more about middleware and how to create them in the docs:
https://laravel.com/docs/master/middleware

Answer 2

First you have to make the admin to update the attributes of the user when they are notified
User::where('id' , $user_id)->update(['is_request' => 0]);
then add this in your login controller
public function credentials(Request $request)
{
$credentials = $request->only($this->username(), 'password');
$credentials = array_add($credentials, 'is_request', 0);
return $credentials;
}