ajax call \Sentinel::check() always return null.

[baotao2006]

Summary of issue

in revisions table, user_id always is null.

Steps to reproduce

go to the en/backend/translation/translations page, x-edit some translation.

System Details

• Operating System
• PHP Version
• Laravel Version
• Asgardcms/Platform 2.0

[nWidart]

Hello,

Sorry for the late reply.
This seems to be an issue with revisionable package.

[baotao2006]

REST API call ignore session user.

[baotao2006]

in Modules\User\Http\Middleware\AuthorisedApiToken.php:
private function isValidToken($token)
{
$found = $this->userToken->findByAttributes(['access_token' => $this->parseToken($token)]);

    if ($found === null) {
        return false;
    }

    //for rest api current user
    \Sentinel::setUser($found->user);

    return true;
}

in Modules\User\Http\Middleware\AuthorisedApiTokenAdmin.php:

private function isValidToken($token)
{
    $found = $this->userToken->findByAttributes(['access_token' => $this->parseToken($token)]);

    if ($found === null) {
        return false;
    }

    //for rest api current user
    \Sentinel::setUser($found->user);

    if ($found->user->hasRoleName('admin') === false) {
        return false;
    }

    return true;
}

[nWidart]

Thanks! I will try those out.

[nWidart]

Hello,

Sorry for late reply.
I just tested this and it seems to work, thanks! 👍

I'm not super happy with the fact that it couples sentinel though.

[nWidart]

@armababy pointed out ot me that we shouldn't be able to access the session in an API, to have a correct RESTful api, which makes sense.

We'd need to find a way to set that user in API requests found via the token.
And finally Revisionable should have a way to send that user to them, instead of them having to figure it out.

[nWidart]

Related: VentureCraft/revisionable#251

[shincha3517]

@nWidart , do you have any update to get user by token without access the session?

[nWidart]

Yes, you can use this trait: https://github.com/AsgardCms/Platform/blob/2.0/Modules/User/Traits/CanFindUserWithBearerToken.php

[shincha3517]

Thanks for help.