diff --git a/config/config.php b/config/config.php
index 542b3c78..f64be64f 100644
--- a/config/config.php
+++ b/config/config.php
@@ -95,6 +95,7 @@
'middleware' => [
'api',
+ //auth.sanctum,
DispatchRestifyStartingEvent::class,
AuthorizeRestify::class,
],
diff --git a/docs-v2/content/en/api/actions.md b/docs-v2/content/en/api/actions.md
index b30b8d40..1cea1ab5 100644
--- a/docs-v2/content/en/api/actions.md
+++ b/docs-v2/content/en/api/actions.md
@@ -1,5 +1,8 @@
---
-title: Actions menuTitle: Actions category: API position: 4
+title: Actions
+menuTitle: Actions
+category: API
+position: 4
---
Restify allow you to define extra actions for your repositories. Let's say you have a list of posts, and you have to
diff --git a/docs-v2/content/en/api/rest-methods.md b/docs-v2/content/en/api/rest-methods.md
index d2847bb7..10abbcf7 100644
--- a/docs-v2/content/en/api/rest-methods.md
+++ b/docs-v2/content/en/api/rest-methods.md
@@ -2,7 +2,7 @@
title: REST Methods
menuTitle: REST Methods
category: API
-position: 1
+position: 2
---
## Introduction
diff --git a/docs-v2/content/en/auth/authentication.md b/docs-v2/content/en/auth/authentication.md
index 02b17c2b..aa6918ba 100644
--- a/docs-v2/content/en/auth/authentication.md
+++ b/docs-v2/content/en/auth/authentication.md
@@ -22,7 +22,18 @@ php artisan vendor:publish --provider="Laravel\Sanctum\SanctumServiceProvider"
php artisan migrate
```
-- Make sure your authenticatable entity (usually `App\Models\User`) implements: `Illuminate\Contracts\Auth\Authenticatable` (or simply extends the `Illuminate\Foundation\Auth\User` class as it does into a fresh laravel app.)
+- Define your authenticatable class in the config file:
+
+```php
+// config/restify.php
+
+'auth' => [
+ ...
+ 'user_model' => \App\Models\User::class,
+]
+```
+
+- Make sure your authenticatable class (usually `App\Models\User`) implements: `Illuminate\Contracts\Auth\Authenticatable` (or simply extends the `Illuminate\Foundation\Auth\User` class as it does into a fresh laravel app.)
- Make sure the `App\Models\User` model implements the `Binaryk\LaravelRestify\Contracts\Sanctumable` contract.
@@ -48,420 +59,20 @@ These are default routes provided by restify:
| **POST** | `/api/restify/resetPassword` | reset password |
| **POST** | `/api/restify/verify/{id}/{emailHash}` | verify user |
-All of these routes are handle by default, so you can just use them. However, you can customize each of them by defining your own auth routes, and still benefit of the Restify AuthController by extending it.
-
-Let's take a closer look over each route in part.
-
-## Publish controllers
-
-After installation user can publish controllers for full control on it.
-
-```shell script
-php artisan restify:publish-controllers
-```
-
-On run this command is no need anymore to import
-
-```php
-Route::restifyAuth();
-```
-
-in your `routes/api.php`, it will be set automatically.
-
-The command above:
-
-- Creates on path `app/Http/Controllers/Restify/Auth` controllers files
-- Creates mail required folder on path `app/Mail/Restify/Auth` with `ForgotPasswordMail.php` file
-- Creates specific blade file on `resources/views/Restify/Auth` with `reset-password.blade.php`
-- Registers the route in `app/Providers/RestifyServiceProvider.php`
-
-## Register users
-
-- Define a register route to an action controller:
-
-```php
-Route::post('register', 'AuthController@register');
-```
-
-- Inject the AuthService into your controller and call the register method:
-
-```php
-use Illuminate\Http\Request;
-use Illuminate\Http\Response;
-use Binaryk\LaravelRestify\Services\AuthService;
-
-class AuthController
-{
- /**
- * @var AuthService
- */
- protected $authService;
-
- public function __construct(AuthService $authService)
- {
- $this->authService = $authService;
- }
- /**
- * This will validate the input,
- * will register the user and return it back to the api
- *
- * @param Request $request
- * @return JsonResponse
- */
- public function register(Request $request)
- {
- $user = $this->authService->register($request->all());
-
- return Response::make(['data' => $user], 201);
- }
-```
-
-- Validating the input
-
-Restify will automatically validate the data send from the request to the `register` method.
-
-Used validation FormRequest is: `Binaryk\LaravelRestify\Http\Requests\RestifyRegisterRequest`
-f you want to validate the registration payload yourself you can disable the built in validation by nullifying `$registerFormRequest`:
-
-```php
-public function register(UserRegisterRequest $request)
-{
- AuthService::$registerFormRequest = null;
-
- $user = $this->authService->register($request->only(array_keys($request->rules())));
-
- return Response::make(['data' => $user], 201);
-}
-```
-
-Or you could simply set the `$registerFormRequest` with your custom FormRequest:
-
-```php
-public function register(Request $request)
-{
- AuthService::$registerFormRequest = UserRegisterRequest::class;
-
- $user = $this->authService->register($request->all());
-
- return Response::make(['data' => $user], 201);
-}
-```
-
-- Exceptions
-
-If something went wrong inside the register method, the AuthService will thrown few suggestive exceptions you can handle in the controller:
-
- > `\Binaryk\LaravelRestify\Exceptions\AuthenticatableUserException` - Make sure your authenticatable entity (usually `User`) is implementing the `Illuminate\Contracts\Auth\Authenticatable` interface.
-
- > `\Binaryk\LaravelRestify\Exceptions\Eloquent\EntityNotFoundException` - Class (usually `App\User`) defined in the configuration `auth.providers.users.model` could not been instantiated (may be abstract or missing at all)
-
-- After successfully registering user, an `Illuminate\Auth\Events\Registered` event will be dispatched.
-
-## Verifying users (optional)
-
-This is an optional feature, but sometimes we may want users to validation the registered email.
-
-- Prerequisites
-
-Make sure `User` model implementing the `Illuminate\Contracts\Auth\MustVerifyEmail` contract.
-
-The `MustVerifyEmail` contract will wait for a `sendEmailVerificationNotification` method definition.
-
-This method could look like this:
-
-```php
-// app/User.php
-
-public function sendEmailVerificationNotification()
-{
- $this->notify(new \Binaryk\LaravelRestify\Notifications\VerifyEmail);
-}
-```
-
-The `VerifyEmail` should send the notification email to the user. This email should include two required data:
-
-> the sha1 hash of the user email
-
-> user id
-
-so your frontend application could easily make a verify call to the API with this data.
-
-Example of notification:
-
-```php
-namespace Binaryk\LaravelRestify\Notifications;
-
-use Illuminate\Notifications\Messages\MailMessage;
-use Illuminate\Notifications\Notification;
-use Illuminate\Support\Carbon;
-use Illuminate\Support\Facades\Config;
-use Illuminate\Support\Facades\Lang;
-use Illuminate\Support\Facades\URL;
-use Illuminate\Auth\Notifications\VerifyEmail as VerifyEmailLaravel;
-
-class VerifyEmail extends VerifyEmailLaravel
-{
- /**
- * Get the verification URL for the given notifiable.
- *
- * @param mixed $notifiable
- * @return string
- */
- protected function verificationUrl($notifiable)
- {
- $withToken = str_replace(['{id}'], $notifiable->getKey(), config('restify.auth.user_verify_url'));
- $withEmail = str_replace(['{emailHash}'], sha1($notifiable->getEmailForVerification()), $withToken);
-
- return url($withEmail);
- }
-}
-```
-
-As you may notice it uses a route, let's scaffolding a verify route example as well:
+All of these routes are handle by default, so you can just use them. However, you can customize each of them by exporting auth controllers:
-```php
-Route::get('api/verify/{id}/{hash}', 'AuthController@verify')
- ->name('register.verify')
- ->middleware([ 'throttle:6,1' ]);
+```shell
+php artisan restify:auth
```
+So you have all auth controllers, blade email files exported into your project.
-So your frontend could call this route with the `id` and `hash` received into verify email.
-
-- Next let's define the controller action:
+Next, add the `auth:sanctum` middleware after the `api` middleware in your config file to protect all restify routes:
```php
-use Illuminate\Http\Request;
-use Illuminate\Http\Response;
-use Binaryk\LaravelRestify\Services\AuthService;
-
-class AuthController
-{
- /**
- * @var AuthService
- */
- protected $authService;
-
- public function __construct(AuthService $authService)
- {
- $this->authService = $authService;
- }
-
- /**
- * This will mark the email verified if the email sha1 hash and user id matches
- *
- * @param Request $request
- * @return JsonResponse
- * @throws AuthorizationException - thrown if hash or id doesn't match
- * @throws \Binaryk\LaravelRestify\Exceptions\Eloquent\EntityNotFoundException - thrown if the user not found
- */
- public function verify(Request $request, $id, $hash = null)
- {
- $user = $this->authService->verify($request, $id, $hash);
-
- return Response::make(['data' => $user]);
- }
-}
-```
-
-- After verifying with success an `Illuminate\Auth\Events\Verified` event is dispatched.
-
-## Login users (issue token)
-After having user registered and verified (if the case) the API should be able to issue personal authorization tokens.
-
-- Define a login route to an action controller:
-
-```php
-Route::post('login', 'AuthController@login');
-```
-
-- Inject the AuthService into your controller and call the login method:
-
-```php
-use Illuminate\Http\Request;
-use Illuminate\Http\Response;
-use Binaryk\LaravelRestify\Services\AuthService;
-use Binaryk\LaravelRestify\Exceptions\UnverifiedUser;
-use Binaryk\LaravelRestify\Exceptions\CredentialsDoesntMatch;
-
-class AuthController
-{
- /**
- * @var AuthService
- */
- protected $authService;
-
- public function __construct(AuthService $authService)
- {
- $this->authService = $authService;
- }
- /**
- * This will validate the input,
- * will register the user and return it back to the api
- *
- * @param Request $request
- * @return JsonResponse
- */
- public function login(Request $request)
- {
- try {
- $token = $this->authService->login($request);
-
- return Response::make(compact('token'));
- } catch (CredentialsDoesntMatch | UnverifiedUser) {
- return Response::make('Something went wrong.', 401);
- }
- }
-}
-```
-
-The login method will thrown few exceptions:
-> `Binaryk\LaravelRestify\Exceptions\CredentialsDoesntMatch` - when email or password doesn't match
-
-> `Binaryk\LaravelRestify\Exceptions\UnverifiedUser` - when `User` model implements `Illuminate\Contracts\Auth\MustVerifyEmail`
-and he did not verified the email
-
-- After login with success a personal token is issued and an `Binaryk\LaravelRestify\Events\UserLoggedIn` event is dispatched.
-
-## Forgot password
-
-Forgot password is the action performing by user in terms of recovering his lost password. Usually the API should send an email
-with a unique URL that allow users to reset password.
-
-- Prerequisites:
-
-If you want your users to be able to reset their passwords, make sure your `User` model implements the
-`Illuminate\Contracts\Auth\CanResetPassword` contract.
-
-This contract requires the `sendPasswordResetNotification` to be implemented. It could looks like this:
-
-```php
-/**
- * Send the password reset notification.
- *
- * @param string $token
- * @return void
- */
-public function sendPasswordResetNotification($token)
-{
- Illuminate\Auth\Notifications\ResetPassword::createUrlUsing(function ($notifiable, $token) {
- $withToken = str_replace(['{token}'], $token, config('restify.auth.password_reset_url'));
- $withEmail = str_replace(['{email}'], $notifiable->getEmailForPasswordReset(), $withToken);
-
- return url($withEmail);
- });
-
- $this->notify(new Illuminate\Auth\Notifications\ResetPassword($token));
-}
+/config/restify.php
+ 'middleware' => [
+ 'api',
+ 'auth:sanctum',
+ ...
+ ],
```
-
-As you can see, you can simply use the `ResetPassword` builtin notification.
-
-The `getEmailForPasswordReset` method simply returns the user email:
-
-```php
-/**
- * @inheritDoc
- */
-public function getEmailForPasswordReset()
-{
- return $this->email;
-}
-```
-
-- Define a forgot password route to an action controller:
-
-```php
-Route::post('api/forgotPassword', 'AuthController@forgotPassword');
-```
-
-- Inject the AuthService into your controller and call the `sendResetPasswordLinkEmail` method:
-
-```php
-use Binaryk\LaravelRestify\Exceptions\Eloquent\EntityNotFoundException;use Binaryk\LaravelRestify\Exceptions\PasswordResetException;use Illuminate\Http\Request;
-use Illuminate\Http\Response;
-use Binaryk\LaravelRestify\Services\AuthService;use Illuminate\Validation\ValidationException;
-
-class AuthController
-{
- /**
- * @var AuthService
- */
- protected $authService;
-
- public function __construct(AuthService $authService)
- {
- $this->authService = $authService;
- }
-
- /**
- * This will validate the request input (email exists for example) and will send an reset passw
- *
- * @param Request $request
- * @return JsonResponse
- */
- public function forgotPassword(Request $request)
- {
- try {
- $this->authService->forgotPassword($request);
-
- return Response::make('', 204);
- } catch (EntityNotFoundException $e) {
- // Defined in the configuration auth.providers.users.model could not been instantiated (may be abstract or missing at all)
- } catch (PasswordResetException $e) {
- // Something unexpected from the Broker class
- } catch (ValidationException $e) {
- // The email is not valid
- }
- }
-```
-
-## Reset password
-
-Finally we have to reset the users passwords. This can easily be done by using Restify AuthService as well.
-
-- Define a reset password route to an action controller:
-
-```php
-Route::post('api/resetPassword', 'AuthController@resetPassword')->name('password.reset');
-```
-
-- Inject the AuthService into your controller and call the resetPassword method:
-
-```php
-use Illuminate\Http\Request;
-use Illuminate\Http\Response;
-use Binaryk\LaravelRestify\Services\AuthService;
-
-class AuthController
-{
- /**
- * @var AuthService
- */
- protected $authService;
-
- public function __construct(AuthService $authService)
- {
- $this->authService = $authService;
- }
-
- /**
- * @param Request $request
- * @return JsonResponse
- * @throws \Binaryk\LaravelRestify\Exceptions\Eloquent\EntityNotFoundException
- * @throws \Illuminate\Contracts\Container\BindingResolutionException
- * @throws \Illuminate\Validation\ValidationException
- */
- public function resetPassword(Request $request)
- {
- try {
- $this->authService->resetPassword($request);
-
- return Response::make(__('Password reset'));
- } catch (PasswordResetException|PasswordResetInvalidTokenException $e) {
- return Response::make('Something went wrong', 401);
- }
- }
-
-```
-
-After successfully password reset an `Illuminate\Auth\Events\PasswordReset` event is dispatched.
diff --git a/docs-v2/content/en/auth/authorization.md b/docs-v2/content/en/auth/authorization.md
index 9866dfca..a30c311f 100644
--- a/docs-v2/content/en/auth/authorization.md
+++ b/docs-v2/content/en/auth/authorization.md
@@ -2,7 +2,7 @@
title: Authorization
menuTitle: Authorization
category: Auth
-position: 2
+position: 1
---
After setting up the Restify configuration, and the authentication. The next logical step is to protect your API Repositories against unauthorized users.
@@ -21,11 +21,9 @@ Restify injects the `RestifyApplicationServiceProvider`, it is injected in your
- Then `RestifyApplicationServiceProvider` is booted, this will define the gate, will load repositories and make the auth routes macro. You have the full control over this provider.
-- The `RestifyInjector` will be handled. It will register `RestifyCustomRoutesProvider` which load all the custom routes (defined in the `routes` static method in repositories) and will check if this request is a restify one - in which case it will register a new service provider `RestifyServiceProvider`
+- The `RestifyInjector` will be handled. It will register all routes.
-- If the `RestifyServiceProvider` was registered, it will load all the other CRUD routes Restify provides and will try to bind a custom exception handler defined in the `restify.php` configuration.
-
-- If the request route is a Restify route, Laravel will handle other middlewares defined in the `restify.php` -> `middleware`.
+- On each request, if the request route is a Restify route, Laravel will handle other middlewares defined in the `restify.php` -> `middleware`.
## View Restify
@@ -34,15 +32,11 @@ Since we are now aware of how Restify boot itself, let's see how to guard it.
Let's take a closer look to the package global gate:
+ This gate is only active in a non-local environment.
+
```php
// app/Providers/RestifyServiceProvider.php
-/**
- * Register the Restify gate.
- *
- * This gate determines who can access Restify in non-local environments.
- *
- * @return void
- */
+
protected function gate()
{
Gate::define('viewRestify', function ($user) {
@@ -56,28 +50,26 @@ protected function gate()
This is the first gate to access the Restify repositories. In a real life project, you may allow every authenticated user to have access to repositories, and just after that, using policies you can restrict specific actions. To do so:
```php
- Gate::define('viewRestify', function ($user) {
- return true;
- });
+ Gate::define('viewRestify', function ($user) {
+ return true;
+ });
```
If you want to allow unauthenticated users to be authorized to see restify routes, you can nullify the `$user`:
```php
- Gate::define('viewRestify', function ($user = null) {
- return true;
- });
+ Gate::define('viewRestify', function ($user = null) {
+ return true;
+ });
```
From this point, it's highly recommended having a policy for each model have exposed via Restify. Otherwise, users may access unauthorized resources, which is not what we want.
## Policies
-If you are not aware of what a policy is, I highly recommend reading the [documentation](https://laravel.com/docs/authorization#creating-policies) before you move forward.
-
-Restify uses CRUD classic naming to authorize specific actions.
+If you are not aware of what a policy is, we highly recommend reading the [documentation](https://laravel.com/docs/authorization#creating-policies) before you move forward.
-However, you can use the Laravel command for generating a policy, it's recommended to generate a policy using Restify command, because it will scaffold Restify CRUD authorization methods for you:
+You can use the Laravel command for generating a policy, it's recommended to generate a policy using Restify command, because it will scaffold Restify CRUD authorization methods for you:
```shell script
php artisan restify:policy UserPolicy
@@ -86,7 +78,7 @@ php artisan restify:policy UserPolicy
It will automatically detect the `User` model (the word before `Policy`). However, you can specify the model:
```shell script
-php artisan restify:policy SuperUserPolicy --model=User
+php artisan restify:policy PostPolicy --model=User
```
diff --git a/docs-v2/content/en/auth/profile.md b/docs-v2/content/en/auth/profile.md
index 9fe95d1b..19436bac 100644
--- a/docs-v2/content/en/auth/profile.md
+++ b/docs-v2/content/en/auth/profile.md
@@ -2,19 +2,27 @@
title: User Profile
menuTitle: Profile
category: Auth
-position: 3
+position: 1
---
-To ensure you can get your profile, you should add the `Authenticate` middleware to your restify, this can be easily
-done by using the `Binaryk\LaravelRestify\Http\Middleware\RestifySanctumAuthenticate::class` into
-your `restify.middleware` [configuration file](../quickstart.html#configurations);
+To ensure you can get your profile, you should add the `Authenticate` middleware to your restify, this can be easily done by using the `auth:sanctum` into your `restify.middleware`:
+
+```php
+// config/restify.php
+
+'middleware' => [
+ 'api',
+ 'auth:sanctum',
+ Binaryk\LaravelRestify\Http\Middleware\DispatchRestifyStartingEvent::class,
+ Binaryk\LaravelRestify\Http\Middleware\AuthorizeRestify::class,
+]
+```
Laravel Restify expose the user profile via `GET: /api/restify/profile` endpoint.
## Get profile using repository
-When retrieving the user profile, by default it is serialized using the `UserRepository` if there is once (Restify will
-find the repository based on the `User` model).
+When retrieving the user profile, by default it is serialized using the `UserRepository`.
```http request
GET: /api/restify/profile
@@ -358,28 +366,3 @@ The payload should be a form-data, with an image under `avatar` key:
```
If you have to customize path or disk of the storage file, check the [image field](../repository-pattern/field.html#file-fields)
-
-### Avatar without repository
-
-If you don't use the repository for updating the user profile, Restify provides a separate endpoint for updating the avatar.
-
-```http request
-POST: api/restify/profile/avatar
-```
-
-The default path for storing avatar is: `/avatars/{user_key}/`, and it uses by default the `public` disk.
-
-You can modify that by modifying property in a `boot` method of any service provider:
-
-```php
-Binaryk\LaravelRestify\Http\Requests\ProfileAvatarRequest::$path = 'users';
-Binaryk\LaravelRestify\Http\Requests\ProfileAvatarRequest::$disk = 's3';
-```
-
-Or if you need the request to make the path:
-
-```php
-Binaryk\LaravelRestify\Http\Requests\ProfileAvatarRequest::usingPath(function(Illuminate\Http\Request $request) {
- return 'avatars/' . $request->user()->uuid
-})
-```
diff --git a/docs-v2/content/en/index.md b/docs-v2/content/en/index.md
index 4b93832f..f173c978 100644
--- a/docs-v2/content/en/index.md
+++ b/docs-v2/content/en/index.md
@@ -5,8 +5,7 @@ menuTitle: Introduction
category: Getting Started
---
-Laravel Restify helps you build APIs faster, easier and with more consistency.
-Laravel Restify is MIT Licensed and can be freely by anyone.
+Laravel Restify is an extraordinary tool for building robust, modern API. And, it will become a breeze to do that.
## Features
@@ -15,7 +14,9 @@ Laravel Restify is MIT Licensed and can be freely by anyone.
'Authentication with Sanctum',
'Handy Response maker',
'Powerful Search',
-'JSON:API consistency'
+'JSON:API consistency',
+'Customizable',
+'Laravel Compatible Authorization'
]">
@@ -23,7 +24,7 @@ Laravel Restify is MIT Licensed and can be freely by anyone.
You can find the [full course here](https://www.binarcode.com/learn/restify) with features and insights about how Laravel Restify works.
-