[#34722] Add Authentication and Authorization to api routes #90
Conversation
jglass-st
added
the
On Hold
| ->where('uid', $this->id); | ||
| }); | ||
| })->get(); | ||
| } |
There was a problem hiding this comment.
Seems like this sort of query should normally be a hasManyThrough, but given the number of joins this is probably the best way to do it. 👍
There was a problem hiding this comment.
Unfortunately the many to many nature of the current schema prevents hasManyThrough from working and I tried using this package to provide the ability to have that many to many deep relationship as a default eloquent collection. The issue that kept cropping up was that the database tables don't follow Laravel conventions so none of it would play nicely which meant we ended up with a permissions getter method instead.
There was a problem hiding this comment.
Oh, neat I hadn't seen that package before. Yeah, not being able to rely on standard naming conventions is tough. But I think you've made it as clean as possible given the legacy table constraints.
| public function isVocabularyEditor() | ||
| { | ||
| $permissions = $this->getPermissions(); | ||
| $vocabEditor = Permission::where('label', 'Edit Vocabulary')->first(); | ||
|
|
||
| return $permissions->contains($vocabEditor); |
There was a problem hiding this comment.
So much cleaner! Big improvement.
There was a problem hiding this comment.
Nice api auth!
Sticking with Sanctum's pattern and adding a new table for API tokens is probably the right decision. The alternative would be trying to overload the existing legacy api_keys table, which would complicate things considering how differently they behave.
And given we shouldn't need to use any extra token functionality like abilities, only authenticate the user, this should handle everything we need from an authentication perspective.
jglass-st
removed
the
On Hold
…utes, update axios bootstrapping
nevinsm
force-pushed
the
nsm/34722-api-auth
branch
from
9379f48 to
60fc862
Compare
nevinsm
changed the title
|
@jglass-st This should be ready for another review. |
Link to Ticket:
https://app.shortcut.com/snac/story/34722/require-user-to-be-an-authenticated-editor-for-any-post-put-delete-actions-on-concept-vocabulary
PR Summary:
Sets up authentication and authorization for api routes. Also adds in
artisan user:addhelper commandTesting Instructions:
ddev artisan testartisan user:addcan be used to interactively add a user to the systemNotes: