EnAccess / EnAccess/micropowermanager

[Feature Request]: Unify `auth` controller governance

Open
#1,390 0 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
PHP
Stars
27
Forks
19
Avg merge
1d 18h
Merged PRs (30d)
27

Description

### Preflight Checklist

- [x] I have read the [Contributing Guidelines](https://github.com/EnAccess/micropowermanager/blob/main/CONTRIBUTING.md) for this project, if it exists.
- [x] I agree to follow the [Code of Conduct](https://github.com/EnAccess/micropowermanager/blob/main/CODE_OF_CONDUCT.md) that this project adheres to.
- [x] I have searched the [issue tracker](https://github.com/EnAccess/micropowermanager/issues) for a feature request that matches the one I want to file, without success.

### Problem Description

In our (backend) code base there is currently no single point of truth for auth governance.

- Some routes define a `auth` middleware in their route definition, for example [`solar-home-systems`](https://github.com/EnAccess/micropowermanager/blob/main/src/backend/routes/api.php#L385-L391)
- Other routes, don't for example [`e-bikes`](https://github.com/EnAccess/micropowermanager/blob/main/src/backend/routes/api.php#L392-L398)

How does this even work?

It does because the [`UserDefaultDatabaseConnectionMiddleware`]( https://github.com/EnAccess/micropowermanager/blob/main/src/backend/app/Http/Middleware/UserDefaultDatabaseConnectionMiddleware.php) effectively re-implements the auth-gate logic again, by calling `$guard = auth('agent_api');` and `$guard = auth('api');` hardcodedly.

This creates ambiguity and confusion amongst developers. There should be one and only one plays that defines the auth structure.

### Proposed Solution

Please use the route definition as source of truth for auth-gates. Every route should define their correct `auth` middle ware

For example like so

```php
Route::group(['prefix' => 'e-bikes', 'middleware' => 'auth:api'], static function () {
Route::get('/', [EBikeController::class, 'index']);
Route::post('/', [EBikeController::class, 'store']);
Route::get('/search', [EBikeController::class, 'search']);
Route::get('/{serialNumber}', [EBikeController::class, 'show']);
Route::post('/switch', [EBikeController::class, 'switch']);
});
```

This seems to be the most idiomatic approach in Laravel world. That let Laravel’s auth system flow naturally through middleware + policies/gates.

Then, change `UserDefaultDatabaseConnectionMiddleware` to apply it's logic based on the available `auth` middleware, instead of hardcoding routes.

### Alternatives Considered

N/A

### Additional Information

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.