php - 在 Laravel 中允许多个密码重置 token

Question

Laravel (5.7) 密码重置系统的默认行为是在删除该用户的任何其他 token 后在 password_resets 表中创建一个新 token 。此行为是在 \Illuminate\Auth\Passwords\DatabaseTokenRepository 中确定的，并且似乎不可配置。

protected function deleteExisting(CanResetPasswordContract $user)
{
    return $this->getTable()->where('email', $user->getEmailForPasswordReset())->delete();
}

有太多的继承，我不知道要扩展哪些类，以便插入我自己的规则。

是否可以在不侵入 Laravel 核心文件的情况下允许一定数量的密码重置同时存在？我需要扩展哪些类(class)？

Answer 1

提供的答案并没有帮助我覆盖正确的类，但它确实给了我一些如何处理这个问题的想法。所以我最终创建了三个类，所有这些类都扩展了内置类:

DatabaseTokenRepository

这是我从 the parent class 进行覆盖的地方允许我的自定义行为；创建新的重置 token 时保留两个最新条目，并在执行重置时检查多个 token 。

<?php

namespace App\Services;

use Illuminate\Contracts\Auth\CanResetPassword as CanResetPasswordContract;
use Illuminate\Auth\Passwords\DatabaseTokenRepository as DatabaseTokenRepositoryBase;

class DatabaseTokenRepository extends DatabaseTokenRepositoryBase
{
    /**
     * Create a new token record.
     *
     * @param  \Illuminate\Contracts\Auth\CanResetPassword  $user
     * @return string
     */
    public function create(CanResetPasswordContract $user)
    {
        $email = $user->getEmailForPasswordReset();

        $this->deleteSomeExisting($user);

        // We will create a new, random token for the user so that we can e-mail them
        // a safe link to the password reset form. Then we will insert a record in
        // the database so that we can verify the token within the actual reset.
        $token = $this->createNewToken();

        $this->getTable()->insert($this->getPayload($email, $token));

        return $token;
    }

    /**
     * Determine if a token record exists and is valid.
     *
     * @param  \Illuminate\Contracts\Auth\CanResetPassword  $user
     * @param  string  $token
     * @return bool
     */
    public function exists(CanResetPasswordContract $user, $token)
    {
        $records = $this->getTable()
            ->where("email", $user->getEmailForPasswordReset())
            ->get();

        foreach ($records as $record) {
            if (
               ! $this->tokenExpired($record->created_at) &&
                 $this->hasher->check($token, $record->token)
            ) {
                return true;
            }
        }
        return false;
    }

    /**
     * Delete SOME existing reset tokens from the database.
     *
     * @param  \Illuminate\Contracts\Auth\CanResetPassword  $user
     * @return int
     */
    protected function deleteSomeExisting($user)
    {
        // TODO: make this configurable in app config
        $limit = 3;
        $records = $this->getTable()
            ->where("email", $user->getEmailForPasswordReset())
            ->orderBy("created_at");
        $ct = $records->count() - $limit + 1;
        return ($ct > 0) ? $records->limit($ct)->delete() : 0;
    }
}

PasswordBrokerManager

这只是确保使用上面的自定义存储库类。该函数完全复制自 the parent class ，但当然是在不同的命名空间中。

<?php

namespace App\Services;

use Illuminate\Support\Str;
use Illuminate\Auth\Passwords\PasswordBrokerManager as PasswordBrokerManagerBase;

class PasswordBrokerManager extends PasswordBrokerManagerBase
{
    /**
     * Create a token repository instance based on the given configuration.
     *
     * @param  array  $config
     * @return \Illuminate\Auth\Passwords\TokenRepositoryInterface
     */
    protected function createTokenRepository(array $config)
    {
        $key = $this->app['config']['app.key'];

        if (Str::startsWith($key, 'base64:')) {
            $key = base64_decode(substr($key, 7));
        }

        $connection = $config['connection'] ?? null;

        return new DatabaseTokenRepository(
            $this->app['db']->connection($connection),
            $this->app['hash'],
            $config['table'],
            $key,
            $config['expire']
        );
    }
}

PasswordResetServiceProvider

同样，只需确保返回自定义类即可。同样，只有命名空间从 the original 发生变化。 .

<?php

namespace App\Providers;

use App\Services\PasswordBrokerManager;
use Illuminate\Auth\Passwords\PasswordResetServiceProvider as PasswordResetServiceProviderBase;

class PasswordResetServiceProvider extends PasswordResetServiceProviderBase
{
    /**
     * Register the password broker instance.
     *
     * @return void
     */
    protected function registerPasswordBroker()
    {
        $this->app->singleton("auth.password", function ($app) {
            return new PasswordBrokerManager($app);
        });

        $this->app->bind("auth.password.broker", function ($app) {
            return $app->make("auth.password")->broker();
        });
    }
}

最后，应用程序配置已更新为使用我的提供程序而不是原始提供程序:

    // Illuminate\Auth\Passwords\PasswordResetServiceProvider::class,
    App\Providers\PasswordResetServiceProvider::class,

一切都很顺利。