DONE: improve auth security, add email verification when register, add mailpit to docker service

This commit is contained in:
2026-10-05 11:31:18 +08:00
parent b1d393b1a1
commit 67228628b1
12 changed files with 219 additions and 357 deletions
+2 -2
View File
@@ -278,12 +278,12 @@ REDIS_PASSWORD=null
REDIS_PORT=6379
MAIL_MAILER=smtp
MAIL_HOST=mailhog
MAIL_HOST=mailpit
MAIL_PORT=1025
MAIL_USERNAME=null
MAIL_PASSWORD=null
MAIL_ENCRYPTION=null
MAIL_FROM_ADDRESS=null
MAIL_FROM_ADDRESS=noreply@lelong.local
MAIL_FROM_NAME="${APP_NAME}"
AWS_ACCESS_KEY_ID=
+3 -3
View File
@@ -3,7 +3,7 @@ APP_ENV=local
APP_KEY=base64:ezY+zzzO7+TOh5WtUG544ffDFNCqNQr4c9/uxFCVywo=
APP_DEBUG=true
APP_URL=http://localhost:8082
APP_PEMBIDA=http://localhost:8080/
APP_PEMBIDA=http://localhost:8083/
API_URL=http://host.docker.internal:8080/
API_URL_KAUNTER=http://host.docker.internal:8081/
API_VERIFY=false
@@ -43,12 +43,12 @@ REDIS_PASSWORD=null
REDIS_PORT=6379
MAIL_MAILER=smtp
MAIL_HOST=mailhog
MAIL_HOST=mailpit
MAIL_PORT=1025
MAIL_USERNAME=null
MAIL_PASSWORD=null
MAIL_ENCRYPTION=null
MAIL_FROM_ADDRESS=null
MAIL_FROM_ADDRESS=noreply@lelong.local
MAIL_FROM_NAME="${APP_NAME}"
AWS_ACCESS_KEY_ID=
-323
View File
@@ -1,323 +0,0 @@
APP_NAME=Laravel
APP_ENV=local
APP_KEY=
APP_DEBUG=true
APP_URL=http://localhost
APP_PEMBIDA=http://localhost:8080/
API_URL=https://api_arrahn.test/lelong/
API_URL_KAUNTER=http://kaunter.test/
API_VERIFY = false
LOG_CHANNEL=stack
LOG_DEPRECATIONS_CHANNEL=null
LOG_LEVEL=debug
DB_CONNECTION=mysql
DB_HOST=127.0.0.1
DB_PORT=3306
DB_DATABASE=lelong
DB_USERNAME=root
DB_PASSWORD=G0dz!ll4@2020
DB_CONNECTION_MAIN=mysql
DB_HOST_MAIN=192.168.0.101
DB_PORT_MAIN=3306
DB_DATABASE_MAIN=online_arrahn
DB_USERNAME_MAIN=spider
DB_PASSWORD_MAIN=G0dz!ll42020
DB_CONNECTION_KB2=mysql
DB_HOST_KB2=192.168.0.101
DB_PORT_KB2=3306
DB_DATABASE_KB2=arrahn_kb2
DB_USERNAME_KB2=spider
DB_PASSWORD_KB2=G0dz!ll42020
DB_CONNECTION_WCY=mysql
DB_HOST_WCY=192.168.0.101
DB_PORT_WCY=3306
DB_DATABASE_WCY=arrahn_wcy
DB_USERNAME_WCY=spider
DB_PASSWORD_WCY=G0dz!ll42020
DB_CONNECTION_1STOP=mysql
DB_HOST_1STOP=192.168.0.101
DB_PORT_1STOP=3306
DB_DATABASE_1STOP=arrahn_1stop
DB_USERNAME_1STOP=spider
DB_PASSWORD_1STOP=G0dz!ll42020
DB_CONNECTION_020301=mysql
DB_HOST_020301=192.168.0.101
DB_PORT_020301=3306
DB_DATABASE_020301=arrahn_jlwt
DB_USERNAME_020301=spider
DB_PASSWORD_020301=G0dz!ll42020
DB_CONNECTION_WB=mysql
DB_HOST_WB=192.168.0.101
DB_PORT_WB=3306
DB_DATABASE_WB=arrahn_wb
DB_USERNAME_WB=spider
DB_PASSWORD_WB=G0dz!ll42020
DB_CONNECTION_ALS=mysql
DB_HOST_ALS=192.168.0.101
DB_PORT_ALS=3306
DB_DATABASE_ALS=arrahn_kls
DB_USERNAME_ALS=spider
DB_PASSWORD_ALS=G0dz!ll42020
DB_CONNECTION_020306=mysql
DB_HOST_020306=192.168.0.101
DB_PORT_020306=3306
DB_DATABASE_020306=arrahn_pp
DB_USERNAME_020306=spider
DB_PASSWORD_020306=G0dz!ll42020
DB_CONNECTION_ARM=mysql
DB_HOST_ARM=192.168.0.101
DB_PORT_ARM=3306
DB_DATABASE_ARM=arrahn_mace
DB_USERNAME_ARM=spider
DB_PASSWORD_ARM=G0dz!ll42020
DB_CONNECTION_KB1=mysql
DB_HOST_KB1=192.168.0.101
DB_PORT_KB1=3306
DB_DATABASE_KB1=arrahn_kb1
DB_USERNAME_KB1=spider
DB_PASSWORD_KB1=G0dz!ll42020
DB_CONNECTION_APM=mysql
DB_HOST_APM=192.168.0.101
DB_PORT_APM=3306
DB_DATABASE_APM=arrahn_pm
DB_USERNAME_APM=spider
DB_PASSWORD_APM=G0dz!ll42020
DB_CONNECTION_010311=mysql
DB_HOST_010311=192.168.0.101
DB_PORT_010311=3306
DB_DATABASE_010311=arrahn_gm
DB_USERNAME_010311=spider
DB_PASSWORD_010311=G0dz!ll42020
DB_CONNECTION_GC=mysql
DB_HOST_GC=192.168.0.101
DB_PORT_GC=3306
DB_DATABASE_GC=arrahn_gcl
DB_USERNAME_GC=spider
DB_PASSWORD_GC=G0dz!ll42020
DB_CONNECTION_JLI=mysql
DB_HOST_JLI=192.168.0.101
DB_PORT_JLI=3306
DB_DATABASE_JLI=arrahn_jli
DB_USERNAME_JLI=spider
DB_PASSWORD_JLI=G0dz!ll42020
DB_CONNECTION_ARP=mysql
DB_HOST_ARP=192.168.0.101
DB_PORT_ARP=3306
DB_DATABASE_ARP=arrahn_rp
DB_USERNAME_ARP=spider
DB_PASSWORD_ARP=G0dz!ll42020
DB_CONNECTION_010621=mysql
DB_HOST_010621=192.168.0.101
DB_PORT_010621=3306
DB_DATABASE_010621=arrahn_ktn
DB_USERNAME_010621=spider
DB_PASSWORD_010621=G0dz!ll42020
DB_CONNECTION_010136=mysql
DB_HOST_010136=192.168.0.101
DB_PORT_010136=3306
DB_DATABASE_010136=arrahn_pg
DB_USERNAME_010136=spider
DB_PASSWORD_010136=G0dz!ll42020
DB_CONNECTION_011235=mysql
DB_HOST_011235=192.168.0.101
DB_PORT_011235=3306
DB_DATABASE_011235=arrahn_skudai
DB_USERNAME_011235=spider
DB_PASSWORD_011235=G0dz!ll42020
DB_CONNECTION_011227=mysql
DB_HOST_011227=192.168.0.101
DB_PORT_011227=3306
DB_DATABASE_011227=arrahn_pttn
DB_USERNAME_011227=spider
DB_PASSWORD_011227=G0dz!ll42020
DB_CONNECTION_010620=mysql
DB_HOST_010620=192.168.0.101
DB_PORT_010620=3306
DB_DATABASE_010620=arrahn_btg
DB_USERNAME_010620=spider
DB_PASSWORD_010620=G0dz!ll42020
DB_CONNECTION_010617=mysql
DB_HOST_010617=192.168.0.101
DB_PORT_010617=3306
DB_DATABASE_010617=arrahn_raub
DB_USERNAME_010617=spider
DB_PASSWORD_010617=G0dz!ll42020
DB_CONNECTION_010915=mysql
DB_HOST_010915=192.168.0.101
DB_PORT_010915=3306
DB_DATABASE_010915=arrahn_kgr
DB_USERNAME_010915=spider
DB_PASSWORD_010915=G0dz!ll42020
DB_CONNECTION_011228=mysql
DB_HOST_011228=192.168.0.101
DB_PORT_011228=3306
DB_DATABASE_011228=arrahn_sdk
DB_USERNAME_011228=spider
DB_PASSWORD_011228=G0dz!ll42020
DB_CONNECTION_010219=mysql
DB_HOST_010219=192.168.0.101
DB_PORT_010219=3306
DB_DATABASE_010219=arrahn_sp
DB_USERNAME_010219=spider
DB_PASSWORD_010219=G0dz!ll42020
DB_CONNECTION_011229=mysql
DB_HOST_011229=192.168.0.101
DB_PORT_011229=3306
DB_DATABASE_011229=arrahn_twu
DB_USERNAME_011229=spider
DB_PASSWORD_011229=G0dz!ll42020
DB_CONNECTION_011230=mysql
DB_HOST_011230=192.168.0.101
DB_PORT_011230=3306
DB_DATABASE_011230=arrahn_api2
DB_USERNAME_011230=spider
DB_PASSWORD_011230=G0dz!ll42020
DB_CONNECTION_011013=mysql
DB_HOST_011013=192.168.0.101
DB_PORT_011013=3306
DB_DATABASE_011013=arrahn_kjg
DB_USERNAME_011013=spider
DB_PASSWORD_011013=G0dz!ll42020
DB_CONNECTION_011412=mysql
DB_HOST_011412=192.168.0.101
DB_PORT_011412=3306
DB_DATABASE_011412=arrahn_rl
DB_USERNAME_011412=spider
DB_PASSWORD_011412=G0dz!ll42020
DB_CONNECTION_011231=mysql
DB_HOST_011231=192.168.0.101
DB_PORT_011231=3306
DB_DATABASE_011231=arrahn_bfort
DB_USERNAME_011231=spider
DB_PASSWORD_011231=G0dz!ll42020
DB_CONNECTION_011232=mysql
DB_HOST_011232=192.168.0.101
DB_PORT_011232=3306
DB_DATABASE_011232=arrahn_kbelud
DB_USERNAME_011232=spider
DB_PASSWORD_011232=G0dz!ll42020
DB_CONNECTION_011234=mysql
DB_HOST_011234=192.168.0.101
DB_PORT_011234=3306
DB_DATABASE_011234=arrahn_tuaran
DB_USERNAME_011234=spider
DB_PASSWORD_011234=G0dz!ll42020
DB_CONNECTION_011233=mysql
DB_HOST_011233=192.168.0.101
DB_PORT_011233=3306
DB_DATABASE_011233=arrahn_kngau
DB_USERNAME_011233=spider
DB_PASSWORD_011233=G0dz!ll42020
DB_CONNECTION_020303=mysql
DB_HOST_020303=192.168.0.101
DB_PORT_020303=3306
DB_DATABASE_020303=arrahn_tm
DB_USERNAME_020303=spider
DB_PASSWORD_020303=G0dz!ll42020
DB_CONNECTION_010618=mysql
DB_HOST_010618=192.168.0.101
DB_PORT_010618=3306
DB_DATABASE_010618=arrahn_tmlh
DB_USERNAME_010618=spider
DB_PASSWORD_010618=G0dz!ll42020
# DB_CONNECTION_011237=mysql
# DB_HOST_011237=192.168.0.101
# DB_PORT_011237=3306
# DB_DATABASE_011237=arrahn_semporna
# DB_USERNAME_011237=spider
# DB_PASSWORD_011237=G0dz!ll42020
BROADCAST_DRIVER=log
CACHE_DRIVER=file
FILESYSTEM_DRIVER=local
QUEUE_CONNECTION=sync
SESSION_DRIVER=file
SESSION_LIFETIME=120
MEMCACHED_HOST=127.0.0.1
REDIS_HOST=127.0.0.1
REDIS_PASSWORD=null
REDIS_PORT=6379
MAIL_MAILER=smtp
MAIL_HOST=mailhog
MAIL_PORT=1025
MAIL_USERNAME=null
MAIL_PASSWORD=null
MAIL_ENCRYPTION=null
MAIL_FROM_ADDRESS=null
MAIL_FROM_NAME="${APP_NAME}"
AWS_ACCESS_KEY_ID=
AWS_SECRET_ACCESS_KEY=
AWS_DEFAULT_REGION=us-east-1
AWS_BUCKET=
AWS_USE_PATH_STYLE_ENDPOINT=false
PUSHER_APP_ID=
PUSHER_APP_KEY=
PUSHER_APP_SECRET=
PUSHER_APP_CLUSTER=mt1
MIX_PUSHER_APP_KEY="${PUSHER_APP_KEY}"
MIX_PUSHER_APP_CLUSTER="${PUSHER_APP_CLUSTER}"
MARHUN_CAMERAS="Doccamera"
WABOT_API=https://md.wabot.my/api/send.php
WABOT_INSTANCES_ID=63C26B7AAD21A
WABOT_TOKEN_KEYS=cbee7e95cf3ffbfa0531d5fddfd44f87
# wabot use for blast message to pembida
WABOT_API_SECOND=https://md.wabot.my/api/send.php
WABOT_INSTANCES_ID_SECOND=64892FD7440A6
WABOT_TOKEN_KEYS_SECOND=cbee7e95cf3ffbfa0531d5fddfd44f87
# for config STORAGE_DIRECTORY, set value without slash at the end
# STORAGE_DIRECTORY=/Users/UTM/Sites/lelong/storage
ADMIN_EMAIL="admin_1@example.com,admin_2@example.com"
# fill in phone number for local testing
ADMIN_PHONE_NUMBER=601234566789
ONE_WAY_SMS_USERNAME=apiusername
ONE_WAY_SMS_PASSWORD=apipassword
@@ -14,10 +14,12 @@ use Illuminate\Support\Facades\Validator;
use Illuminate\Support\Str;
use Illuminate\Support\Facades\Mail;
use App\Mail\ResetPassword;
use App\Mail\VerifyEmail;
class AuthController extends Controller
{
public function register(Request $request) {
public function register(Request $request)
{
// dd($request->all);
$validator = Validator::make($request->all(), [
'name' => 'required|string',
@@ -56,6 +58,7 @@ class AuthController extends Controller
$currentdate = Carbon::now();
$currentdate = $currentdate->toDateTimeString();
$verificationToken = Str::random(60);
$user = new User;
$user->name = $fields['name'];
@@ -69,34 +72,57 @@ class AuthController extends Controller
$user->status = 'active';
$user->user_type = 2; //type 2 = pembida
$user->alamat = $fields['alamat'];
$user->token = $verificationToken;
$user->is_verified = 0;
$user->email_verified_at = null;
$user->save();
// if($user->save())
// {
// $images = $request->images;
// foreach($images as $img)
// {
// $file = new File;
// $file->user_id = $user->id;
// $file->file_type = $img['file_type'];
// $file->filename = $img['filename'];
// $file->save();
$verifyUrl = url('/api/verifyEmail') . '?' . http_build_query([
'email' => $user->email,
'token' => $verificationToken,
]);
// }
Mail::to($user->email)->send(new VerifyEmail($user->name, $verifyUrl));
// }
$token = $user->createToken('myapptoken')->plainTextToken;
$response = [
'success' => true,
'message' => 'Pendaftaran berjaya. Sila semak emel anda untuk pautan pengesahan.',
'user' => $user,
'token' => $token
];
return response($response, 201);
}
public function verifyEmail(Request $request)
{
$redirectBase = rtrim(config('app.app_pembida'), '/');
$validator = Validator::make($request->all(), [
'email' => 'required|email',
'token' => 'required|string',
]);
if ($validator->fails()) {
return redirect()->away($redirectBase . '?email_verified=0&message=' . urlencode('Pautan pengesahan tidak sah.'));
}
$user = User::where('email', $request->email)
->where('token', $request->token)
->where('is_verified', 0)
->first();
if (!$user) {
return redirect()->away($redirectBase . '?email_verified=0&message=' . urlencode('Pautan pengesahan tidak sah atau emel telah disahkan.'));
}
$user->is_verified = 1;
$user->email_verified_at = Carbon::now();
$user->token = null;
$user->save();
return redirect()->away($redirectBase . '?email_verified=1&message=' . urlencode('Emel berjaya disahkan.'));
}
public function loginUser(Request $request)
{
$fields = $request->validate([
@@ -120,7 +146,13 @@ class AuthController extends Controller
'message2' => "Sila login menggunakan url " . env('APP_URL'),
]);
} else {
if ($user->status == 'active') {
if (is_null($user->email_verified_at)) {
return response([
'statusAkaun' => 7,
'message' => 'Sila sahkan emel anda sebelum log masuk. Semak peti masuk anda untuk pautan pengesahan.',
]);
} else if ($user->status == 'active') {
$user->tokens()->delete();
$token = $user->createToken('myapptoken')->plainTextToken;
return response([
'statusAkaun' => 1,
@@ -158,13 +190,14 @@ class AuthController extends Controller
}
}
public function logoutUser(Request $request){
auth()->user()->currentAccessToken()->delete();
return [
'message' => 'Logged Out'
];
public function logoutUser(Request $request)
{
$token = $request->user()?->currentAccessToken();
if ($token) {
$token->delete();
}
return response()->json(['message' => 'Logged Out']);
}
public function forgotPassword(Request $request)
+31
View File
@@ -0,0 +1,31 @@
<?php
namespace App\Mail;
use Illuminate\Bus\Queueable;
use Illuminate\Mail\Mailable;
use Illuminate\Queue\SerializesModels;
class VerifyEmail extends Mailable
{
use Queueable, SerializesModels;
public $name;
public $verifyUrl;
public function __construct($name, $verifyUrl)
{
$this->name = $name;
$this->verifyUrl = $verifyUrl;
}
public function build()
{
$user['name'] = $this->name;
$user['verify_url'] = $this->verifyUrl;
return $this->from(config('mail.from.address'), config('mail.from.name'))
->subject('ArrahnBid - Pengesahan Emel')
->view('template.verify-email', ['user' => $user]);
}
}
+1 -1
View File
@@ -30,7 +30,7 @@ return [
|
*/
'expiration' => null,
'expiration' => 60 * 2, // 2 hours
/*
|--------------------------------------------------------------------------
@@ -0,0 +1,24 @@
<?php
use Illuminate\Database\Migrations\Migration;
use Illuminate\Support\Facades\DB;
class BackfillEmailVerifiedAtForActiveUsers extends Migration
{
public function up()
{
// Existing active users predate email verification; keep them able to log in.
DB::table('users')
->where('status', 'active')
->whereNull('email_verified_at')
->update([
'email_verified_at' => DB::raw('COALESCE(t_daftar, NOW())'),
'is_verified' => 1,
]);
}
public function down()
{
// Irreversible data backfill.
}
}
+10 -4
View File
@@ -9,16 +9,22 @@ services:
- "8082:8000"
volumes:
- ./:/var/www/html:cached
environment:
APP_ENV: local
APP_DEBUG: "true"
# Lets PHP resolve host.docker.internal to the host machine (Linux Docker; Desktop already provides this).
extra_hosts:
- "host.docker.internal:host-gateway"
networks:
- default
- api_arrahn_default
mailpit:
image: axllent/mailpit
container_name: lelong-mailpit
restart: unless-stopped
ports:
- "8025:8025" # Web UI
- "1025:1025" # SMTP
networks:
- default
networks:
api_arrahn_default:
external: true
@@ -0,0 +1,17 @@
<p style="margin:100px 0 12px 0;font-size:14px;font-family:Arial,sans-serif;">
Terima Kasih,
</p>
<p style="margin:0 0 12px 0;font-size:14px;font-family:Arial,sans-serif;">
ArrahnBid
</p>
</td>
</tr>
</table>
</td>
</tr>
</table>
</td>
</tr>
</table>
</body>
</html>
@@ -0,0 +1,52 @@
<!DOCTYPE html>
<html lang="en" xmlns="http://www.w3.org/1999/xhtml" xmlns:o="urn:schemas-microsoft-com:office:office">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width,initial-scale=1">
<meta name="x-apple-disable-message-reformatting">
<title></title>
<style>
table,
td,
div,
h1,
p {
font-weight: 500;
font-family: Arial, sans-serif;
}
.btn {
margin: 10px 0px;
border-radius: 4px;
text-decoration: none;
color: #fff !important;
height: 46px;
padding: 10px 20px;
font-size: 16px;
font-weight: 600;
background-image: linear-gradient(to right top, #021d68, #052579, #072d8b, #09369d, #093fb0) !important;
}
.btn:hover {
text-decoration: none;
opacity: .8;
}
</style>
</head>
<body style="margin:0;padding:0;">
<table role="presentation"
style="width:100%;border-collapse:collapse;border:0;border-spacing:0;background:#ffffff;">
<tr>
<td align="center" style="padding:0;">
<table role="presentation"
style="width:600px;border-collapse:collapse;border:1px solid #cccccc;border-spacing:0;text-align:left;">
<tr style="border-collapse:collapse;border:1px solid #cccccc;border-spacing:0;">
<td align="left" style="padding:10px 25px;background:#fff; display: flex; align-items: center;">
<span style="font-weight: bold; padding-top: 10px;"> ArrahnBid</span>
</td>
</tr>
<tr>
<td style="padding:36px 30px 42px 30px;">
<table role="presentation"
style="width:100%;border-collapse:collapse;border:0;border-spacing:0;">
<tr>
<td style="padding:0 0 36px 0;color:#153643;">
@@ -0,0 +1,21 @@
@include('template.partials.header')
<p style="font-weight:bold;margin:0 0 20px 0;font-family:Arial,sans-serif;">
Hello {{ $user['name'] ?? '' }},
</p>
<p style="margin:0 0 12px 0;font-size:14px;line-height:24px;font-family:Arial,sans-serif;">
Terima kasih kerana mendaftar di ArrahnBid. Sila sahkan alamat emel anda dengan mengklik butang di bawah:
</p>
<p style="text-align: center;">
<a href="{{ $user['verify_url'] }}" class="btn">Sahkan Emel Anda</a>
</p>
<p style="margin:10px 0 12px 0;font-size:14px;line-height:24px;font-family:Arial,sans-serif;">
Jika butang tidak berfungsi, salin dan tampal pautan ini ke pelayar anda:
</p>
<p style="margin:0 0 12px 0;font-size:12px;line-height:20px;font-family:Arial,sans-serif;word-break:break-all;">
{{ $user['verify_url'] }}
</p>
@include('template.partials.footer')
+1
View File
@@ -23,6 +23,7 @@ use App\Http\Controllers\ApiController;
//Public routes
Route::post('/register', [AuthController::class, 'register']);
Route::get('/verifyEmail', [AuthController::class, 'verifyEmail']);
Route::post('/user/login', [AuthController::class, 'loginUser']);
Route::post('/forgotPassword', [AuthController::class, 'forgotPassword']);