README.md

Lighthouse Sanctum

Add Laravel Sanctum support to Lighthouse

Requirements

• laravel/laravel:^8.36.2
• laravel/sanctum:^2.0
• nuwave/lighthouse:^5.0

Installation

1. Install using composer:

composer require daniel-de-wit/lighthouse-sanctum

2. Publish configuration and schema

php artisan vendor:publish --tag=lighthouse-sanctum

3. Import the published schema into your main GraphQL schema (./graphql/schema.graphql)

type Query
type Mutation

#import sanctum.grapqhl

4. HasApiTokens

Apply the Laravel\Sanctum\HasApiTokens trait to your Authenticatable model as described in the Laravel Sanctum documentation.

use Illuminate\Auth\Authenticatable;
use Laravel\Sanctum\Contracts\HasApiTokens as HasApiTokensContract;
use Laravel\Sanctum\HasApiTokens;

class User extends Authenticatable implements HasApiTokensContract
{
    use HasApiTokens;
}

5. Configuration

This package relies on API Token Authentication, which uses stateless Bearer tokens to authenticate requests.

By default, Laravel Sanctum assumes that requests made from localhost should use the stateful Spa Authentication instead. To disable this behaviour, remove any lines in your sanctum configuration:

// File: ./config/sanctum.php

    /*
    |--------------------------------------------------------------------------
    | Stateful Domains
    |--------------------------------------------------------------------------
    |
    | Requests from the following domains / hosts will receive stateful API
    | authentication cookies. Typically, these should include your local
    | and production domains which access your API via a frontend SPA.
    |
    */

    'stateful' => [
        // Remove entries here    
    ],

Make sure the following middleware is enabled for Lighthouse:

// File: ./config/lighthouse.php
    'middleware' => [
        ...
        
        \Nuwave\Lighthouse\Support\Http\Middleware\AttemptAuthentication::class,

        ...
    ],

Usage

• Login
• Logout
• Register
• Email Verification
• Forgot Password

Login

Authenticate the user to receive a Bearer token.

mutation Login {
    login(input: {
        email: "john.doe@gmail.com"
        password: "secret"
    }) {
        token
    }
}

Apply the Authorization header on subsequent calls using the token

  "Authorization": "Bearer 1|lJo1cMhrW9tIUuGwlV1EPjKnvfZKzvgpGgplbwX9"

Logout

Revoke the current token.

mutation Logout {
    logout {
        status
        message
    }
}

Register

Successfully registering a user will immediately yield a bearer token (unless email verification is required).

mutation Register {
    register(input: {
        name: "John Doe"
        email: "john.doe@gmail.com"
        password: "secret"
        password_confirmation: "secret"
    }) {
        token
        status
    }
}

When registering a user in combination with the MustVerifyEmail contract you can optionally define the url for email verification. Both __ID__ and __HASH__ will be replaced with the proper values.

mutation Register {
    register(input: {
        name: "John Doe"
        email: "john.doe@gmail.com"
        password: "secret"
        password_confirmation: "secret"
        verification_url: {
            url: "https://my-front-end.com/verify-email?id=__ID__&token=__HASH__"
        }
    }) {
        token
        status
    }
}

Email Verification

mutation VerifyEmail {
  verifyEmail(input: {
    id: "1"
    hash: "af269947ed80d4a7bc3f78a6dfd05ec369373f9d"
  }) {
    name
    email
  }
}

Forgot Password

Sends a reset password notification.

Optionally use custom reset url using both __EMAIL__ and __TOKEN__ placeholders.

mutation ForgotPassword {
    forgotPassword(input: {
        email: "john.doe@gmail.com"
        reset_password_url: {
            url: "https://my-front-end.com/reset-password?email=__EMAIL__&token=__TOKEN__"
        }
    }) {
        status
        message
    }
}

Reset Password

Reset the user's password.

mutation ResetPassword {
    resetPassword(input: {
        email: "john.doe@gmail.com",
        token: "af269947ed80d4a7bc3f78a6dfd05ec369373f9d"
        password: "secret"
        password_confirmation: "secret"
    }) {
        status
        message
    }
}

Testing

composer test

Coverage

composer coverage

Static Analysis

composer analyze

Contributing

Please see CONTRIBUTING for details.

Credits

• Daniel de Wit
• wimski
• All Contributors

License

The MIT License (MIT). Please see License File for more information.