function __construct() {
$this->middleware('auth');
$this->middleware(function ($request, $next) {
$this->user = \Auth::user();
});
echo $this->user;
exit;
}
the problem is that when I echo the user inside the middleware function where I get the user his data is printed ok, that means he is loggeed in, but if I echo the same variable outside the function it is null, but the examples shows that it must be filled with data, what I'am doing wrong?
It seems issue of scope of the variable.
As you are defining and assigning value of varialbe inside function, you can not access it from outside.
Instead, if you do like this, it should work:
function __construct() {
public $user = ''; // Declared it here,
$this->middleware('auth');
$this->middleware(function ($request, $next) {
$this->user = \Auth::user()->role; // assigned a value here,
});
echo $this->user; // It will print here.
exit;
}
The variable $this->user will be an object so I believe echo will not work. If you want to check its value then use print_r($this->user); instead and if you want to access it in some other function then return $this->user it.
If you need the user inside middleware to set it in the controller. It is way better to do it simpler, same could be done in the middleware.
public function __construct(Request $request)
{
$this->user = $request->user();
dd($this->user);
}
This solution requires that the user has been loaded by Auth. This can be null at some point and for the route list generation in Laravel this will be called with a null user. If this still does not work, I do not believe your user is set or the Auth middleware has been initialized.
Related
After 5.3 update of laravel devs can't access session variable in constructors. Question is - how to setup CartController with properties which are based on session cart Id?
Just for example:
class CartController extends Controller
{
public $cartId;
public $cartProducts;
public function __construct()
{
$this->cartId= $this->getCartId();
$this->cartProducts = $this->getCartProducts();
}
public function getCartProducts()
{
return CartProduct::with('product')->where('id_cart', $this->getCartId())->get();
}
public function getCartId()
{
$sessionCartId = Session::get('cartId');
$cookieCartId = Cookie::get('cartId');
if ($cookieCartId) {
$cartId = $cookieCartId;
Session::put('cartId', $cartId);
} elseif ($sessionCartId) {
$cartId = $sessionCartId;
Cookie::queue('cartId', $cartId, 10080);
} else {
$cartId = $this->setNewCart();
}
return $cartId;
}
In this example when I call via ajax getCartProducts() to get list of products I need to call method getCartId() instead property $this->cartId. It is not bad but when I call more complex actions like deleting and refreshing tables method getCartId will be called multiple times causing multiple queries. Now if I could access property I could get cartId in one query.
So question is - how to solve this problem?
You can access the session data inside __construct using a middleware closure:
public function __construct()
{
$this->middleware(function ($request, $next) {
$this->cartId = $this->getCartId();
$this->cartProducts = $this->getCartProducts();
return $next($request);
});
}
I have tried different methods discussed in here but not successful to my problem.
Assumptions:
Failure to group routes under the same middleware group.
Get all the sessions required from web middleware and replace them into
global middleware
But I don't know how? help, please.
Controller
class StarterController extends Controller
{
public function index()
{
$id = Auth::check();
dd($id);
}
}
Route
Route::get('/auth.register', 'AuthController#getRegister')->name('auth')->middleware('guest');
Route::get('/auth.login', 'AuthController#getLogin')->name('auth')->middleware('guest');
You have to call user helper function first :
Auth::user()->id;
I’m new to slim and trying to figure out the best way to create a global user variable. My first thought is to add it to the Container, but I can’t figure out how to inject $app into a route mapped to a class method. I saw somewhere that I can add Container $container to the constructor and the DI should do it automatically? Doesn’t seem to be working.
__construct(Container $container)
Plus, I need to access the variable in a middleware class I wrote to parse my Bearer header, and I can’t find any details on how to do that. I know I can pass $app into each ->add, but that’s a lot of repeated code, and I’m hoping I can avoid that. I'm already injecting an extra variable to parse for roles:
->add(new \App\Middleware\AuthMiddleware('admin'));
public function __construct($role = null)
I can always create a PHP global, but I'd like to figure out what the right Slim way of doing this is.
You can do this with a CurrentUser-class which stores the roles:
class CurrentUser {
private $roles;
function getRoles() {return $this->roles; }
function setRoles($newRoles) {$this->roles = $newRoles; }
}
Which then you can add to the container:
$container[CurrentUser::class] = function($c) {
$user = new CurrentUser();
$user->setRoles(['myrole']);
return $user;
};
And use the CurrentUser-object in a helper method which dynamically creates us the wanted middleware. This method could also be on the CurrentUser-class
function hasPermission($role) {
return function($req, $resp, $next) use ($role) {
if(in_array($role, $this[CurrentUser::class]->getRoles())) {
return $next($res, $resp); // proceed to route
} else {
// handle unauthorized
return $resp->withStatus(401)->write('unauthorized');
}
};
}
Now use the helper method to create the middleware which authorize the user.
$app->get('/books', function ($request, $response, $args) {
return $response->write('Some books yay');
})->add(hasPermission('myrole'));
I'm doing an existence check within a middleware, by checking a route-parameter.
If the check succeeds, I'm attaching it's model to the request to make it available throughout the rest of the request-cycle, application.
// App\Http\Middleware\CheckForExistence.php:
...
public function handle($request, Closure $next)
{
// some checks...
// success
$request->attributes->add([
'company' => $someModel
]);
}
I now have a controller which 'needs' this information in a couple of methods. So my thought was to add it to the construct of the controller and add it as a protected var in the whole controller:
// App\Http\Controllers\MyController.php
<?php
use Illuminate\Http\Request;
class MyController extends Controller
{
protected $company;
public function __construct(Request $request)
{
$this->company = $request->attributes->get('company');
}
public function index()
{
dd($this->company); // returns null
}
}
This controllers index() returns null instead of the give model.
If I change the index() method to:
public function index(Request $request)
{
return $request->attributes->get('company');
}
This returns the model; as expected.
Why is this happening? It looks like the middleware is not run when the controller is constructed.... Is there a way to circumvent it?
Or am I missing the obvious here.....
I could off course repeat myself in each method; but that is not very DRY ;)
You can't access the session or authenticated user in your controller's constructor because the middleware has not run yet, So you can do it like this :
public function __construct()
{
$this->middleware(function ($request, $next) {
$this->company = $request->attributes->get('company');
return $next($request);
});
}
For reasons currently unclear to me, the controller object is constructed before the request changes are reflected in the request object. In short the request is not considered properly constructed when a controller is constructed. This post seems to imply that.
There's two ways to work around this (if for a second we ignore what you're trying to do).
Use request dependency injection
public function index(Request $request)
{
$compary = $request->attributes->get('company');
}
This is not really WET because you're just swapping $this->company with $request->attributes->get('company') it's just a refactor. You should be injecting the request in the controller action anyway and if you don't want to do that you can use the request() helper.
Use a callback middleware in the constructor (Maraboc's answer explains how)
Now if you want a more case specific solution though you can use case specific dependency injection:
If you need to bind a model to a specific route parameter you can use route model binding and add the following in your RouteServiceProvider (or any provider).
Route::bind("companyAsARouteVarName", function () {
// this is why more details in the question are invaluable. I don't know if this is the right way for you.
//checks
// success
return $someModel;
});
Then you will register your route as:
Route::get("/something/{companyAsARouteVarName}", "SomeController#index");
and your controller will be:
public function index(Company $companyAsARouteVarName) {
//Magic
}
Controller constructor will be initialized before middleware execution.
You can get data from Injected $request object in controller functions.
I'm trying to allow user to view their own profile in Laravel 5.4.
UserPolicy.php
public function view(User $authUser, $user)
{
return true;
}
registered policy in AuthServiceProvider.php
protected $policies = [
App\Task::class => App\Policies\TaskPolicy::class,
App\User::class => App\Policies\UserPolicy::class
];
Routes
Route::group(['middleware' => 'auth'], function() {
Route::resource('user', 'UserController');
} );
Blade template
#can ( 'view', $user )
// yes
#else
// no
#endcan
UserController.php
public function profile()
{
return $this->show(Auth::user()->id);
}
public function show($id)
{
$user = User::find($id);
return view('user.show', array( 'user'=>$user,'data'=>$this->data ) );
}
The return is always 'false'. Same for calling policy form the controller. Where do I go wrong?
Answering my own question feels weird, but I hate it when I come across questions without followups.
So after double checking It turned out that if I remove authorizeResource from the constructor:
public function __construct()
{
$this->authorizeResource(User::class);
}
and check for authorization in the controller function:
$this->authorize('view',$user);
everything works.
I must've missed this part when I added $user as a parameter in the policy function. So the user to be viewed is never passed in the authorizeResource method.
Thanks everyone for taking your time to help me.
When you add
public function __construct()
{
$this->authorizeResource(User::class);
}
to your Controller, you have to edit all your function signatures to match it to the class e.g. your show signature has to change from public function show($id)
to public function show(User $user)
After that it should work
Just a different approach here to users viewing their own profile.
First, I will create a route for that
Route::group(['middleware' => 'auth'], function() {
Route::get('profile', 'UserController#profile');
});
Then in the profile function I do
public function profile()
{
$user = Auth::user();
return view('profile', compact('user'));
}
This way, user automatically only views their own profile.
Now, if you want to allow some users to view others' profiles, then you can use Policy. Why? Because I think user should ALWAYS be able to view their own profile. But not all users should view other users profiles.
Solution:
Change the second parameter from #can( 'view', $user ) to #can( 'view', $subject ) and it will work find.
Why:
Because you're doing it the wrong way.
public function view(User $user, $subject){
return true;
}
Just look carefully the policy view method, first parameter is authenticated user or current user and second parameter is $subject, Since policies organize authorization logic around models.
Policies are classes that organize authorization logic around a
particular model or resource. For example, if your application is a
blog, you may have a Post model and a corresponding PostPolicy to
authorize user actions such as creating or updating posts.
if you want to go further deep inside it.
https://github.com/laravel/framework/blob/5.3/src/Illuminate/Auth/Access/Gate.php#L353
/**
* Resolve the callback for a policy check.
*
* #param \Illuminate\Contracts\Auth\Authenticatable $user
* #param string $ability
* #param array $arguments
* #return callable
*/
protected function resolvePolicyCallback($user, $ability, array $arguments)
{
return function () use ($user, $ability, $arguments) {
$instance = $this->getPolicyFor($arguments[0]);
// If we receive a non-null result from the before method, we will return it
// as the final result. This will allow developers to override the checks
// in the policy to return a result for all rules defined in the class.
if (method_exists($instance, 'before')) {
if (! is_null($result = $instance->before($user, $ability, ...$arguments))) {
return $result;
}
}
if (strpos($ability, '-') !== false) {
$ability = Str::camel($ability);
}
// If the first argument is a string, that means they are passing a class name
// to the policy. We will remove the first argument from this argument list
// because the policy already knows what type of models it can authorize.
if (isset($arguments[0]) && is_string($arguments[0])) {
array_shift($arguments);
}
if (! is_callable([$instance, $ability])) {
return false;
}
return $instance->{$ability}($user, ...$arguments);
};
}
See the last line where it is calling the method with $user and $argument( in our case Model ) is passed.
Laravel Docs for Authorization/Policies
It's possible to escape one or more policies methods using options parameter at authorizeResource with except:
public function __construct()
{
$this->authorizeResource(User::class, 'user', ['except' => ['view']]);
}
This should be on Laravel's documentation, but it isn't. I discovered this just guessing. I think this way it is a better approach thus, by removing authorizeResource method in the construct, it would be necessary to implement the authorization method for each resource action in order to protect the controller.