feat: mobile regist and login

2026-05-22 16:35:07 +02:00
parent 9fe51e8064
commit 055ebbf658
9 changed files with 248 additions and 88 deletions
@@ -17,6 +17,7 @@ use Illuminate\Http\RedirectResponse;
 use Illuminate\Http\Request;
 use Illuminate\Http\Resources\Json\JsonResource;
 use Illuminate\Support\Arr;
+use Illuminate\Support\Facades\Auth;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Hash;
 use Illuminate\Support\Facades\Password;
@@ -24,83 +25,71 @@ use Illuminate\Support\Facades\Storage;
 use Illuminate\Support\Str;
 use Illuminate\Support\ValidatedInput;
 use Illuminate\View\View;
+use Laravel\Sanctum\PersonalAccessToken;
 use Throwable;

 class AuthController extends Controller
 {
    public function register(RegisterRequest $request): JsonResponse
    {
-        $data = $request->validated();
+        $user = $this->createRegisteredUser($request);

-        $avatarPath = null;
-        if ($request->hasFile('avatar')) {
-            $avatarPath = $request->file('avatar')->store('avatars', 'public');
+        if ($user instanceof JsonResponse) {
+            return $user;
        }

-        $userAttributes = $this->userAttributesFromRequestData($data);
-        $userAttributes['email'] = strtolower($data['email']);
-        $userAttributes['password'] = Hash::make($data['password']);
-        $userAttributes['avatar_url'] = $avatarPath;
-
-        $user = User::create($userAttributes);
-
-        try {
-            $user->sendEmailVerificationNotification();
-        } catch (Throwable $exception) {
-            report($exception);
-
-            $user->forceDelete();
-
-            if ($avatarPath !== null) {
-                Storage::disk('public')->delete($avatarPath);
-            }
-
-            return response()->json([
-                'message' => __('api.auth.verification_email_failed'),
-            ], 503);
-        }
-
-        $token = $user->createToken('api', ['user'])->plainTextToken;
+        $this->startWebSession($request, $user);

        return response()->json([
            'message' => __('api.auth.registered_unverified'),
            'user' => new UserResource($user),
-        ], 201)->cookie('token', $token, 60 * 24 * 30);
+        ], 201);
    }

    public function login(LoginRequest $request): JsonResponse
    {
        $data = $request->validated();
+        $user = $this->getLoginUser($data);

-        $user = User::where('email', strtolower($data['email']))->first();
-
-        if (! $user || ! Hash::check($data['password'], $user->password)) {
-            return response()->json([
-                'message' => __('api.auth.invalid_credentials'),
-            ], 401);
+        if ($user instanceof JsonResponse) {
+            return $user;
        }

-        if ($user->isSuspended()) {
-            return response()->json([
-                'message' => __('api.auth.suspended'),
-            ], 403);
-        }
-
-        if (isset($data['locale']) && $user->locale !== $data['locale']) {
-            $user->forceFill(['locale' => $data['locale']])->save();
-        }
-
-        if (! $user->hasVerifiedEmail()) {
-            return response()->json([
-                'message' => __('api.auth.email_not_verified'),
-            ], 403);
-        }
-
-        $token = $user->createToken('api')->plainTextToken;
+        $this->startWebSession($request, $user);

        return response()->json([
            'user' => new UserResource($user),
-        ])->cookie('token', $token, 60 * 24 * 30);
+        ]);
+    }
+
+    public function mobileRegister(RegisterRequest $request): JsonResponse
+    {
+        $user = $this->createRegisteredUser($request);
+
+        if ($user instanceof JsonResponse) {
+            return $user;
+        }
+
+        return response()->json([
+            'message' => __('api.auth.registered_unverified'),
+            'token' => $this->createMobileToken($user, $request->validated('device_name')),
+            'user' => new UserResource($user),
+        ], 201);
+    }
+
+    public function mobileLogin(LoginRequest $request): JsonResponse
+    {
+        $data = $request->validated();
+        $user = $this->getLoginUser($data);
+
+        if ($user instanceof JsonResponse) {
+            return $user;
+        }
+
+        return response()->json([
+            'token' => $this->createMobileToken($user, $data['device_name'] ?? null),
+            'user' => new UserResource($user),
+        ]);
    }

    public function verifyEmail(Request $request, string $id, string $hash): JsonResponse|View
@@ -224,11 +213,21 @@ class AuthController extends Controller
    public function logout(): JsonResponse
    {
        $request = request();
-        $request->user()->currentAccessToken()->delete();
+        $accessToken = $request->user()?->currentAccessToken();
+
+        if ($accessToken instanceof PersonalAccessToken) {
+            $accessToken->delete();
+        }
+
+        if ($request->hasSession()) {
+            Auth::guard('web')->logout();
+            $request->session()->invalidate();
+            $request->session()->regenerateToken();
+        }

        return response()->json([
            'message' => __('api.auth.logout'),
-        ])->withoutCookie('token');
+        ]);
    }

    public function me(): JsonResource|JsonResponse
@@ -304,9 +303,101 @@ class AuthController extends Controller
            Storage::disk('public')->delete($storagePaths);
        }

+        if ($request->hasSession()) {
+            Auth::guard('web')->logout();
+            $request->session()->invalidate();
+            $request->session()->regenerateToken();
+        }
+
        return response()->json([
            'message' => __('api.auth.deleted'),
-        ])->withoutCookie('token');
+        ]);
+    }
+
+    private function createRegisteredUser(RegisterRequest $request): User|JsonResponse
+    {
+        $data = $request->validated();
+
+        $avatarPath = null;
+        if ($request->hasFile('avatar')) {
+            $avatarPath = $request->file('avatar')->store('avatars', 'public');
+        }
+
+        $userAttributes = $this->userAttributesFromRequestData($data);
+        $userAttributes['email'] = strtolower($data['email']);
+        $userAttributes['password'] = Hash::make($data['password']);
+        $userAttributes['avatar_url'] = $avatarPath;
+
+        $user = User::create($userAttributes);
+
+        try {
+            $user->sendEmailVerificationNotification();
+        } catch (Throwable $exception) {
+            report($exception);
+
+            $user->forceDelete();
+
+            if ($avatarPath !== null) {
+                Storage::disk('public')->delete($avatarPath);
+            }
+
+            return response()->json([
+                'message' => __('api.auth.verification_email_failed'),
+            ], 503);
+        }
+
+        return $user;
+    }
+
+    /**
+     * @param  array<string, mixed>  $data
+     */
+    private function getLoginUser(array $data): User|JsonResponse
+    {
+        $user = User::where('email', strtolower((string) $data['email']))->first();
+
+        if (! $user || ! Hash::check((string) $data['password'], $user->password)) {
+            return response()->json([
+                'message' => __('api.auth.invalid_credentials'),
+            ], 401);
+        }
+
+        if ($user->isSuspended()) {
+            return response()->json([
+                'message' => __('api.auth.suspended'),
+            ], 403);
+        }
+
+        if (isset($data['locale']) && $user->locale !== $data['locale']) {
+            $user->forceFill(['locale' => $data['locale']])->save();
+        }
+
+        if (! $user->hasVerifiedEmail()) {
+            return response()->json([
+                'message' => __('api.auth.email_not_verified'),
+            ], 403);
+        }
+
+        return $user;
+    }
+
+    private function startWebSession(Request $request, User $user): void
+    {
+        if (! $request->hasSession()) {
+            return;
+        }
+
+        Auth::login($user);
+        $request->session()->regenerate();
+    }
+
+    private function createMobileToken(User $user, mixed $deviceName): string
+    {
+        $tokenName = is_string($deviceName) && trim($deviceName) !== ''
+            ? trim($deviceName)
+            : 'mobile';
+
+        return $user->createToken($tokenName)->plainTextToken;
    }

    private function isPublicStoragePath(?string $path): bool