Laravel passport ( can`t understand)

Question

I read a lot of articles and watched a lot of videos about Laravel passport but still can not understand some things.

I have an application which works with Laravel 5.5 + vueJs. All requests to the back-end are sent via axios. All my routes are located in api.php

Route::middleware('api')->group(function(){

    Route::get('/prepare/', 'CompgenApiController@prepareDefault');

    Route::post('/replace/', 'CompgenApiController@replaceImage');

    Route::get('/replaceall/', 'CompgenApiController@replaceAllImages');

    Route::get('/collage/', 'CompgenApiController@collage'); //@todo переделать на POST

    Route::get('/generate/', 'CompgenApiController@generate');

    Route::post('/upload/', 'CompgenApiController@userUpload');

    Route::post('/reupload/', 'CompgenApiController@moderationReupload');

});

Also I have a VK bot that sends requests to the same routes. At the moment I have some difficulties. For some routes, I need to check that the user is authorized (but this is an optional condition) and if it is true I need to write user id to the database. For me it was a surprise that

Auth :: check

returned false though I was authorized. After some searches I learned that the session that starts after authorization is not connected with the API and I was recommended to use Passport. I can not understand the following things

1. Do I need to use a passport if requests are sent from my application from vueJs?

2. How to register users? Do I have to issue my token for each new user?

3. How can I verify that the user is authorized?

4. In some cases I need to check that the user is authorized but if it is not so then do not interfere with the request. How can I do that?

Maybe in my case I do not need a passport at all?

Answer 1

Passport is an oAuth2 server implementation, essentially, it allows you to authenticate users by passing a token with each request. If you do not want to authenticate a user, then you do not need to pass the token and passport doesn't get involved.

In terms of a Laravel app, if you are consuming your API from your own frontend, you probably just want to use the implicit grant. Here's how you set that up:

1) Install passport and add it the PassportServiceProvider to config/app.php

2) php artisan migrate to setup the passport migrations

3) php artisan passport:install - to set up your oAuth server

4) In the User model add the Laravel\Passport\HasApiTokens trait, like so:

namespace App;

use Laravel\Passport\HasApiTokens;
use Illuminate\Notifications\Notifiable;
use Illuminate\Foundation\Auth\User as Authenticatable;

class User extends Authenticatable
{
    use HasApiTokens, Notifiable;
    // Other model methods
}

5) Setup the passport routes by adding the following to the boot method of your app\Providers\AuthServiceProviders.php:

\Laravel\Passport\Passport::routes();

6) Change your api driver in config/auth.php to token:

'guards' => [
    'web' => [
        'driver' => 'session',
        'provider' => 'users',
    ],

    'api' => [
        'driver' => 'passport',
        'provider' => 'users',
    ],
],

That sets up passport, now all you need to do to allow your app to consume your api is to add the CreateFreshApiToken Middleware to web in app/Http/Kernel.php, which handles all the token logic:

'web' => [
    // ..Other middleware...
    \Laravel\Passport\Http\Middleware\CreateFreshApiToken::class,
],

Now all you need to do to protect a route is to use the auth:api middleware on that route:

Route::middleware('auth:api')->get('/profile','Api\UsersController@edit');

That should all work fine, but you'll also want to register a new user. All you do is add the auth routes as normal to web.php:

Route::post('/login', 'Auth\LoginController@login');
Route::post('/logout', 'Auth\LoginController@logout');
Route::post('/register', 'Auth\RegisterController@register');

You can then simply maks a post request to those routes and Laravel will handle all the token stuff for you.

That handles api routes that require authentication, however, you also mentioned that you want to check if a user is authenticated, but not necessarily lock the route, to do that you can simply use:

Auth::guard('api')->user();

Which will get the authenticated user, so you could do something like:

public function getGreeting(){
  $user = Auth::guard('api')->user();

  if($user !== null) {
    return response()->json(["message" => "Hello {$user->name}"], 200);
  }

  return response()->json(["message" => "Hello Guest"], 200);
}

That's it. Hopefully, I've covered everything there.