Laravel 9, Sanctum - Authenticate using a separate table for user, email & password

Question

I've got 3 tables for Laravel authentication.

UserMeta, UserEmail and UserPassword.

We've set it up this way so users can add multiple emails to their account, we can track password changes (&revert if necessary).

This obviously makes authentication a bit tricky and I'm wondering how I'd go about this?

I've tried making a custom Auth::attempt and it does seem to log the user in, but when I'm checking the guard via a route I get the error:

"message": "Object of type Illuminate\\Auth\\AuthManager is not callable",

when trying to access a auth:sanctum guarded route (like using the code below)

Route::group(['middleware' => ['auth:sanctum']], function () {
    Route::get('/account/me',  function (\Illuminate\Http\Request $request) {
        return $request->user();
    });
});

Here is my LoginController.php

public function authenticate(Request $request)

{
    $authenticate = new Authenticate;

    $returnArray = [
        'success' => false,
        'message' => null,
        'userId' => null,
        'token' => null,
    ];

    if (Auth::check()) {
        $returnArray['message'] = 'ALREADY_LOGGED_IN';
        $returnArray['userId'] = Auth::id();

    } else {
        $authAttempt = $authenticate->auth($request->emailAddress, $request->password)['success'];
        if ($authAttempt) {
            $token = $request->user()->createToken('USER AUTHENTICATION TOKEN', ['*']);

            $returnArray['message'] = 'SUCCESS';
            $returnArray['success'] = true;
            $returnArray['userId'] = $request->user()->id;
            $returnArray['token'] = $token->plainTextToken;

        } else {
            $returnArray['message'] = 'Invalid email address or password.';
        }
    }

    return $returnArray;
}

And when I hit the login route:

{
    "success": true,
    "message": "SUCCESS",
    "userId": 1,
    "token": "10|0fgn5XfZyaIuaLOxOOSkIqQdqplc8G1y7SLUKyzD"
}

which does insert into the database.

Auth:

 'providers' => [
        'users' => [
            'driver' => 'eloquent',
            'model' => \App\Models\User\UserMeta::class,
        ],

Models:

App\Models\User\UserMeta:

<?php

namespace App\Models\User;

use App\Models\BaseAuthenticatableModel;
use App\Models\BaseModel;
use Illuminate\Database\Eloquent\Factories\HasFactory;
use Illuminate\Foundation\Auth\User as Authenticatable;
use Illuminate\Notifications\Notifiable;
use Laravel\Sanctum\HasApiTokens;

class UserMeta extends BaseAuthenticatableModel
{
    use HasApiTokens, HasFactory, Notifiable;

    protected $table = 'UserMeta';

    public function emailAddressList()
    {
        return $this->hasMany(UserEmail::class);
    }

    public function emailAddressLatest()
    {
        return $this->hasMany(UserEmail::class)->latest()->emailAddress;
    }

    public function passwordList()
    {
        return $this->hasMany(UserPassword::class);
    }

    public function passwordLatest()
    {
        return $this->hasMany(UserPassword::class)->latest()->value;
    }

UserPassword:

<?php

namespace App\Models\User;

use App\Models\BaseModel;

class UserPassword extends BaseModel
{
    protected $table = 'UserPassword';

    public function user()
    {
        return $this->belongsTo(UserMeta::class);
    }
}

UserEmail

<?php

namespace App\Models\User;

use App\Models\BaseModel;

class UserEmail extends BaseModel
{
    protected $table = 'UserEmail';

    public function user()
    {
        return $this->belongsTo(UserMeta::class);
    }
}

I've been stuck on this for a few days - tried using Passport, JWT & Sanctum but I'm now really at a loss.

Thank you

Why don't you take the approach of keeping user's primary email & current password in **users** table & have **user_emails** table & **user_passwords** table linked to **users** table. Like **User->hasMany-UserEmails*** & **User->hasMany-UserPasswords**. That way you can use standard `laravel/sanctum` authentication still be able to have multiple emails for users & also track their passwords. When a user updates password - update the entry in **users** table & via model event create a new record in **user_passwords** table with the old password — Donkarnash, Jun 07 '22 at 22:22
Then when you want to revert any password you can pick it up from the **user_passwords** table. You can even set a limit to store 3 or 5 old passwords for each user. Or when a user tries to update password, you can look up the **user_passwords** table & disallow the update if the new value exists in **user_passwords** table — Donkarnash, Jun 07 '22 at 22:28
Please share your models (UserMeta, UserPassword, UserEmail) code, and what model is registered in config/auth.php? — zjbarg, Jun 08 '22 at 00:04
@Donkarnash I've considered this but don't really want to add a fix, more get it to actually work as it should — XLR, Jun 08 '22 at 09:58

Laravel 9, Sanctum - Authenticate using a separate table for user, email & password

0 Answers0