manchenkoff / nuxt-auth-sanctum

Nuxt module for Laravel Sanctum authentication
https://manchenkoff.gitbook.io/nuxt-auth-sanctum/
MIT License
146 stars 17 forks source link

[Feature] Verified / Unverified middleware #119

Closed j-jalving closed 1 month ago

j-jalving commented 1 month ago

Have you ever though about adding sanctum:verified and sanctum:unverified middleware?

sanctum:verified This middleware would check if the user is authenticated AND if the user returns a email_verified_at field that is not null.

sanctum:unverified This middleware would check if the user is authenticated AND if the user does not have a email_verified_at field (or it is null).

A new config value for redirect.onUnverifiedOnly should be added so unverified users can be automatically redirected to an e-mail verification page.

manchenkoff commented 1 month ago

Hey @j-jalving, thanks for the suggestion. However, I excluded that feature from the package on purpose, here are the reasons:

  1. User verification is not a part of Sanctum authentication functionality, so it is out of the scope and responsibility of the module.
  2. User model is a very application-specific object, sometimes people have their own validation logic that doesn't depend on a single email_verified_at, or this field may have a different name (since it is not restricted on the backend side). Thus, I would need to add customization in the nuxt.config.ts with a field name or something like that, which will complicate the module and decrease the flexibility.
  3. Verification is not necessarily a part of the application, so I do not want to enforce non-standard implementations to be included in the module. I personally think that this middleware is a better fit for a fully functional Laravel-Nuxt integration rather than a Sanctum authentication module.

With that being said, this part was extracted into breeze-nuxt application template, if you want to contribute, feel free to open a PR there with unverified middleware.

j-jalving commented 1 month ago

Makes sense, thanks for the comprehensive answer! I'll look into adding the unverified middleware and close this request for now.