Check for active user state with laravel

Question

This is pretty standard login function and validation that works nicely. But I also want to check that the user is active. I have set up a column in my users table with 'active' set to either 0 or 1.

public function post_login() 
{
    $input = Input::all();

    $rules = array(
        'email' => 'required|email',
        'password' => 'required',
    );  

    $validation = Validator::make($input, $rules);

    if ($validation->fails())
    {
        return Redirect::to_route('login_user')
            ->with_errors($validation->errors)->with_input();
    }

    $credentials = array(
        'username' => $input['email'],
        'password' => $input['password'],
    );

    if (Auth::attempt($credentials)) 
    {
        // Set remember me cookie if the user checks the box
        $remember = Input::get('remember');
        if ( !empty($remember) )
        {
            Auth::login(Auth::user()->id, true);
        }

        return Redirect::home();

    } else {
        return Redirect::to_route('login_user')
            ->with('login_errors', true);
    }
}

I've tried something like this already:

$is_active = Auth::user()->active;

if (!$is_active == 1)
{
    echo "Account not activated";
}

But this can only be used within the 'auth attempt' if statement and at that point the users credentials(email and pass) are already validated. So even if the users account if not active at this point they are already logged in.

I need a way to return validation to let them know they still need to activate their account and check if their account is set at the same time their email and pass are being checked.

score 8 · Answer 1 · answered Oct 16 '14 at 16:20

Filters are the way to go. It's easy and clean to solve this problem, see my example below.

Route::filter('auth', function()
{
    if (Auth::guest())
{
    if (Request::ajax())
    {
        return Response::make('Unauthorized', 401);
    }
    else
    {
        return Redirect::guest('login');
    }
}
else
{
    // If the user is not active any more, immidiately log out.
    if(Auth::check() && !Auth::user()->active)
    {
        Auth::logout();

        return Redirect::to('/');
    }
}
});

score 4 · Answer 2 · answered May 25 '13 at 15:01

4

Can't you use something like this:

if (Auth::once($credentials))
{
    if(!Auth::user()->active) {
        Auth::logout();

        echo "Account not activated";
    }
}

answered May 25 '13 at 15:01

Antonio Carlos Ribeiro

86,191
22
213
204

Good thinking I like this, I was just hoping for a more elegant solution than unnecessarily having to log a user in and out though. – Stephan-v May 25 '13 at 15:16
This is what I was looking for. Thanks – Ariful Haque Feb 13 '16 at 18:47

score 3 · Answer 3 · answered Oct 12 '14 at 15:59

Just make the active field one of the confirmations. You can do this:

$credentials = array(
        'username' => $input['email'],
        'password' => $input['password'],
        'active' => 1
    );

    if (Auth::attempt($credentials)) 
    {
        // User is active and password was correct
    }

If you want to specifically tell the user they are not active - you can follow it up with this:

    if (Auth::validate(['username' => $input['email'], 'password' => $input['password'], 'active' => 0]))
    {
        return echo ('you are not active');
    }

PottyBert · Accepted Answer · 2013-05-26T11:51:44.910

A better solution might be to create an Auth driver that extends the Eloquent Auth driver already in use and then override the attempt method.

Then change your auth config to use your driver.

Something like:

<?php

class Myauth extends Laravel\Auth\Drivers\Eloquent {

    /**
     * Attempt to log a user into the application.
     *
     * @param  array $arguments
     * @return void
     */
    public function attempt($arguments = array())
    {
        $user = $this->model()->where(function($query) use($arguments)
        {
            $username = Config::get('auth.username');

            $query->where($username, '=', $arguments['username']);

            foreach(array_except($arguments, array('username', 'password', 'remember')) as $column => $val)
            {
                $query->where($column, '=', $val);
            }
        })->first();

        // If the credentials match what is in the database we will just
        // log the user into the application and remember them if asked.
        $password = $arguments['password'];

        $password_field = Config::get('auth.password', 'password');

        if ( ! is_null($user) and Hash::check($password, $user->{$password_field}))
        {
            if ($user->active){
                return $this->login($user->get_key(), array_get($arguments, 'remember'));
            } else {
                Session::flash('authentication', array('message' => 'You must activate your account before you can log in'));
            }
        }

        return false;
    }
}
?>

In your login screen, check for Session::get('authentication') and handle accordingly.

Alternatively, allow them to log in but don't let them access any pages other than one that offers a link to resend the activation email.

score 0 · Answer 5 · answered Feb 04 '16 at 11:47

This is what I do:

if (\Auth::attempt(['EmailWork' => $credentials['EmailWork'], 'password' => $credentials['Password']], $request->has('remember'))) {
    if (\Auth::once(['EmailWork' => $credentials['EmailWork'], 'password' => $credentials['Password']])) {
        if (!\Auth::user()->FlagActive == 'Active') {
            \Auth::logout();
            return redirect($this->loginPath())
                ->withInput($request->only('EmailWork', 'RememberToken'))
                ->withErrors([
                    'Active' => 'You are not activated!',
                ]);
        }
    }

    return redirect('/');
}

return redirect($this->loginPath())
    ->withInput($request->only('EmailWork', 'RememberToken'))
    ->withErrors([
        'EmailWork' => $this->getFailedLoginMessage(),
    ]);

Check for active user state with laravel

5 Answers5

Linked