125 lines
3.9 KiB
PHP
125 lines
3.9 KiB
PHP
<?php
|
|
|
|
namespace Leantime\Domain\Auth\Services;
|
|
|
|
use Illuminate\Contracts\Auth\Authenticatable;
|
|
use Illuminate\Contracts\Auth\UserProvider;
|
|
use Laravel\Sanctum\HasApiTokens;
|
|
use Leantime\Domain\Auth\Models\AuthenticatableUser;
|
|
use Leantime\Domain\Auth\Services\Auth as AuthService;
|
|
|
|
class AuthUser implements UserProvider
|
|
{
|
|
use HasApiTokens;
|
|
|
|
protected $authRepo;
|
|
|
|
protected $userRepo;
|
|
|
|
protected $userdata;
|
|
|
|
public function __construct(
|
|
protected AuthService $authService)
|
|
{
|
|
$this->authRepo = $this->authService->authRepo;
|
|
$this->userRepo = $this->authService->userRepo;
|
|
}
|
|
|
|
public function retrieveById($identifier)
|
|
{
|
|
$userData = $this->userRepo->getUser($identifier);
|
|
|
|
// Not found → null, per the UserProvider contract. Returning a (non-null) empty user
|
|
// object would let the guard treat the request as authenticated.
|
|
if (empty($userData)) {
|
|
return null;
|
|
}
|
|
|
|
return new AuthenticatableUser((array) $userData);
|
|
}
|
|
|
|
public function retrieveByToken($identifier, $token)
|
|
{
|
|
$userData = $this->authService->getUserByToken($token);
|
|
|
|
if (empty($userData)) {
|
|
return null;
|
|
}
|
|
|
|
return new AuthenticatableUser((array) $userData);
|
|
}
|
|
|
|
public function updateRememberToken(Authenticatable $user, $token)
|
|
{
|
|
// Not implemented for now
|
|
}
|
|
|
|
public function retrieveByCredentials(array $credentials)
|
|
{
|
|
if (! isset($credentials['username'])) {
|
|
return null;
|
|
}
|
|
|
|
return $this->authRepo->getUserByLogin(
|
|
$credentials['username'],
|
|
$credentials['password'] ?? null
|
|
);
|
|
}
|
|
|
|
public function validateCredentials(Authenticatable $user, array $credentials)
|
|
{
|
|
return $this->authService->login(
|
|
$credentials['username'],
|
|
$credentials['password']
|
|
);
|
|
}
|
|
|
|
public function rehashPasswordIfRequired(Authenticatable $user, array $credentials, bool $force = false) {}
|
|
|
|
public function getOrCreateUser($user, $source)
|
|
{
|
|
// Look up the existing account in a separate variable — the $user param holds the
|
|
// external/OAuth profile data we need to create the account from, so it must not be
|
|
// overwritten by the lookup result (doing so previously built new users with empty fields).
|
|
$existingUser = $this->authRepo->getUserByEmail($user['email']);
|
|
|
|
if (empty($existingUser) && config()->get('auth.create_user')) {
|
|
|
|
$userArray = [
|
|
'firstname' => $user['firstname'],
|
|
'lastname' => $user['lastname'],
|
|
'phone' => $user['phone'] ?? '',
|
|
'user' => $user['email'] ?? '',
|
|
'role' => $user['role'] ?? '30',
|
|
'department' => $user['department'] ?? '',
|
|
'jobTitle' => $user['jobTitle'] ?? '',
|
|
'jobLevel' => $user['jobLevel'] ?? '',
|
|
'password' => '',
|
|
'clientId' => '',
|
|
'source' => $source,
|
|
'status' => 'a',
|
|
];
|
|
|
|
$this->userRepo->addUser($userArray);
|
|
$existingUser = $this->authRepo->getUserByEmail($user['email']);
|
|
}
|
|
|
|
return $existingUser;
|
|
}
|
|
|
|
public function setUser($userId)
|
|
{
|
|
$this->userdata = $this->userRepo->getUser($userId);
|
|
|
|
$this->setUserSession($this->userdata);
|
|
}
|
|
|
|
protected function setUserSession($user)
|
|
{
|
|
// Sanctum/Bearer-token session. twoFAVerified: true — the token is the strong credential
|
|
// and no interactive 2FA is possible. Built via the shared factory so role (NAME string,
|
|
// not raw int) and every other field stay identical to the web + x-api-key paths.
|
|
session(['userdata' => UserSessionBuilder::build($user, isExternalAuth: false, twoFAVerified: true)]);
|
|
}
|
|
}
|