1

我正在使用 lighthouse-php 制作一个 graphql api，但在更改中间件（在新版本中将被弃用）指令来保护时遇到了麻烦。

extend type Query @middleware(checks: ["auth:api"]) {
    task(id: ID @eq): Task @can(ability: "view" find:"id") @find
    mytasks: [Task!]!
}

使用此代码效果很好。我的意思是，系统会检查用户是否已登录，并检查用户是否可以访问他们的任务，但是当我尝试将指令更改为这样的@middleware指令时@guard：

extend type Query @guard(with: ["api"]){
    task(id: ID @eq): Task @can(ability: "view" find:"id") @find
    mytasks: [Task!]!
}

始终返回用户未经身份验证。但是，在最后一种情况下，如果我删除 @can 指令，系统会检查用户是否已登录（但如果用户可以访问指定的任务，我需要检查策略）。

我正在使用这些版本的软件包：

"joselfonseca/lighthouse-graphql-passport-auth": "^3.0",
    "laravel/framework": "^6.2",
    "laravel/passport": "^8.2",
    "laravel/tinker": "^2.0",
    "mll-lab/laravel-graphql-playground": "^2.0",
    "nuwave/lighthouse": "^4.8"

有人尝试过这个麻烦吗？谢谢。

4

2 回答 2

1

我解决了。

我们必须使用以下内容设置 config/auth.php 文件：

/*
|--------------------------------------------------------------------------
| Authentication Defaults
|--------------------------------------------------------------------------
|
| This option controls the default authentication "guard" and password
| reset options for your application. You may change these defaults
| as required, but they're a perfect start for most applications.
|
*/

'defaults' => [
    'guard' => 'api',
    'passwords' => 'users',
],

/*
|--------------------------------------------------------------------------
| Authentication Guards
|--------------------------------------------------------------------------
|
| Next, you may define every authentication guard for your application.
| Of course, a great default configuration has been defined for you
| here which uses session storage and the Eloquent user provider.
|
| All authentication drivers have a user provider. This defines how the
| users are actually retrieved out of your database or other storage
| mechanisms used by this application to persist your user's data.
|
| Supported: "session", "token"
|
*/

'guards' => [
    'web' => [
        'driver' => 'session',
        'provider' => 'users',
    ],

    'api' => [
        'driver' => 'passport',
        'provider' => 'users',
        'hash' => false,
    ],
],
于 2020-04-20T09:00:30.340 回答
0

与此同时，我找到了文档中提到的另一个解决方案：

https://lighthouse-php.com/master/security/authentication.html#global

所以简而言之，我需要将 AttemptAuthentication 中间件添加到灯塔配置中。我将它与添加到我所有类型的 @auth(guard: "api") 一起使用。

于 2020-05-01T13:54:38.933 回答