使用 guard 的经过身份验证的用户出错，可以访问某些模型

Question

我正在使用 lighthouse-php 制作一个 graphql api 并且我在更改中间件（它将在新版本中被弃用）指令时遇到问题。

extend type Query @middleware(checks: ["auth:api"]) {
    task(id: ID @eq): Task @can(ability: "view" find:"id") @find
    mytasks: [Task!]!
}

使用此代码效果很好。我的意思是，系统检查用户是否已登录并检查用户是否可以访问他们的任务的策略，但是当我尝试将 @middleware 指令更改为 @guard 指令时，如下所示：

extend type Query @guard(with: ["api"]){
    task(id: ID @eq): Task @can(ability: "view" find:"id") @find
    mytasks: [Task!]!
}

始终return 用户未经身份验证。但是，在最后一种情况下，如果我删除 @can 指令，系统会检查用户是否登录（但如果用户可以访问指定的任务，我需要检查策略）。

我正在使用这些版本的软件包：

"joselfonseca/lighthouse-graphql-passport-auth": "^3.0",
    "laravel/framework": "^6.2",
    "laravel/passport": "^8.2",
    "laravel/tinker": "^2.0",
    "mll-lab/laravel-graphql-playground": "^2.0",
    "nuwave/lighthouse": "^4.8"

有人试过这个麻烦吗？谢谢。

Answer 1

我解决了

我们必须使用以下内容设置 config/auth.php 文件：

/*
|--------------------------------------------------------------------------
| Authentication Defaults
|--------------------------------------------------------------------------
|
| This option controls the default authentication "guard" and password
| reset options for your application. You may change these defaults
| as required, but they're a perfect start for most applications.
|
*/

'defaults' => [
    'guard' => 'api',
    'passwords' => 'users',
],

/*
|--------------------------------------------------------------------------
| Authentication Guards
|--------------------------------------------------------------------------
|
| Next, you may define every authentication guard for your application.
| Of course, a great default configuration has been defined for you
| here which uses session storage and the Eloquent user provider.
|
| All authentication drivers have a user provider. This defines how the
| users are actually retrieved out of your database or other storage
| mechanisms used by this application to persist your user's data.
|
| Supported: "session", "token"
|
*/

'guards' => [
    'web' => [
        'driver' => 'session',
        'provider' => 'users',
    ],

    'api' => [
        'driver' => 'passport',
        'provider' => 'users',
        'hash' => false,
    ],
],

Answer 2

同时我发现了文档中提到的另一个解决方案：

https://lighthouse-php.com/master/security/authentication.html#global

简而言之，我需要将 AttemptAuthentication 中间件添加到灯塔配置中。我将它与添加到我所有类型的 @auth(guard: "api") 一起使用。

使用 guard 的经过身份验证的用户出错，可以访问某些模型

Error with authenticated user using guard and can to access to some model

php

laravel

graphql

laravel-lighthouse