Lanjit memisahkan proses menemukan user, menjaga session login, dan memeriksa izin. Authentication manager tersedia sebagai auth, sedangkan authorization gate tersedia sebagai gate.
User provider
Daftarkan provider yang menyediakan pencarian user berdasarkan ID dan credentials.
app.make('auth').useProvider({
retrieveById: (id) => User.find(id),
async retrieveByCredentials(credentials) {
return User.query().where('email', credentials.email).first();
},
async validateCredentials(user, credentials) {
return app.make('hash').check(credentials.password, user.password);
},
});Login
Route login harus memakai middleware session agar identitas dapat disimpan.
Route.post('/login', async (request, response) => {
const credentials = await request.validate({
email: ['required', 'email'],
password: ['required', 'string'],
});
const authenticated = await app.make('auth').attempt(request, credentials);
if (!authenticated) return response.json({ message: 'Credentials invalid.' }, 422);
return response.redirect('/dashboard');
}).middleware('session', 'csrf');Melindungi route
Pasang session sebelum auth agar middleware autentikasi dapat membaca session.
Route.get('/dashboard', dashboard)
.middleware('session', 'auth');User yang ditemukan tersedia pada request.user.
Authorization gate
app.make('gate').define('update-post', (user, post) => {
return user.id === post.user_id;
});
app.make('gate').authorize('update-post', request.user, post);authorize() melempar HTTP exception 403 bila ability ditolak. Gunakan allows() jika Anda hanya memerlukan nilai boolean.
Password hashing
const password = await app.make('hash').make('secret-password');
const valid = await app.make('hash').check('secret-password', password);Jangan menyimpan password dalam bentuk asli atau memakai layanan enkripsi reversibel untuk password.