扩展laravel 5内置身份验证仅登录"if user == active"

Question

我使用laravel 5.1.6的包含身份验证,并想知道如何扩展它,工作方式如下:

if (Auth::attempt(['email' => $email, 'password' => $password, 'active' => 1])) {
    // The user is active, not suspended, and exists.
}

如果用户不是"活动",则无法登录.我在users表中有一个'active'列,其值为0或1.如何在使用内置身份验证和登录throtteling的同时执行此操作.

编辑:

我在AuthController中没有postLogin函数,只有a use AuthenticatesAndRegistersUsers, ThrottlesLogins;,a __construct(),a validator()和create()函数.我是否必须更改特征中的某些内容,Illuminate\Foundation\Auth\..或者我必须postLogin()在AuthController中添加该函数吗？

Answer 1

您可以getCredentials()在AuthController中覆盖该方法:

class AuthController extends Controller
{
    use AuthenticatesAndRegistersUsers;

    public function getCredentials($request)
    {
        $credentials = $request->only($this->loginUsername(), 'password');

        return array_add($credentials, 'active', '1');
    }
}

这将active = 1在尝试验证用户时添加约束.

编辑:如果你想要一个像BrokenBinary所说的单独的错误消息,那么Laravel允许你定义一个authenticated被调用的方法,该方法在用户通过身份验证后调用,但在重定向之前,允许您进行任何登录后处理.因此,您可以通过检查经过身份验证的用户是否处于活动状态来利用此功能,并抛出异常或显示错误消息,如果不是:

class AuthController extends Controller
{
    use AuthenticatesAndRegistersUsers;

    public function authenticated(Request $request, User $user)
    {
        if ($user->active) {
            return redirect()->intended($this->redirectPath());
        } else {
            // Raise exception, or redirect with error saying account is not active
        }
    }
}

不要忘记导入Request类和User模型类.

Answer 2

我现在已经更改了auth中间件/app/Http/Middleware/Authenticate.php(添加了注释下面的块):

/**
 * Handle an incoming request.
 *
 * @param  \Illuminate\Http\Request  $request
 * @param  \Closure  $next
 * @return mixed
 */
public function handle($request, Closure $next)
{
    if ($this->auth->guest())
    {
        if ($request->ajax())
        {
            return response('Unauthorized.', 401);
        }
        else
        {
            return redirect()->guest('auth/login');
        }
    }

    #logout if user not active
    if($this->auth->check() && $this->auth->user()->active !== 1){
        $this->auth->logout();
        return redirect('auth/login')->withErrors('sorry, this user account is deactivated');
    }

    return $next($request);
}

看来,如果他们已经登录,它也会注销非活动用户.