DONE: improve auth security, add email verification when register, add mailpit to docker service

app/Http/Controllers/AuthMobile/AuthController.php

@@ -14,10 +14,12 @@ use Illuminate\Support\Facades\Validator;
 use Illuminate\Support\Str;
 use Illuminate\Support\Facades\Mail;
 use App\Mail\ResetPassword;
+use App\Mail\VerifyEmail;
 
 class AuthController extends Controller
 {
-    public function register(Request $request) {
+    public function register(Request $request)
+    {
         // dd($request->all);
             $validator = Validator::make($request->all(), [
             'name' => 'required|string',
@@ -56,6 +58,7 @@ class AuthController extends Controller
         
         $currentdate = Carbon::now();
         $currentdate = $currentdate->toDateTimeString();
+        $verificationToken = Str::random(60);
         
         $user = new User;
         $user->name = $fields['name'];
@@ -69,34 +72,57 @@ class AuthController extends Controller
         $user->status = 'active';
         $user->user_type = 2; //type 2 = pembida
         $user->alamat = $fields['alamat'];
+        $user->token = $verificationToken;
+        $user->is_verified = 0;
+        $user->email_verified_at = null;
         $user->save();
 
-        // if($user->save())
-        // {
-        //     $images = $request->images;
-        //     foreach($images as $img)
-        //     {
-        //         $file = new File;
-        //         $file->user_id = $user->id;
-        //         $file->file_type = $img['file_type'];
-        //         $file->filename = $img['filename'];
-        //         $file->save();
+        $verifyUrl = url('/api/verifyEmail') . '?' . http_build_query([
+            'email' => $user->email,
+            'token' => $verificationToken,
+        ]);
 
-        //     }
+        Mail::to($user->email)->send(new VerifyEmail($user->name, $verifyUrl));
 
-            
-        // }
-        
-        $token = $user->createToken('myapptoken')->plainTextToken;
         $response = [
             'success' => true,
+            'message' => 'Pendaftaran berjaya. Sila semak emel anda untuk pautan pengesahan.',
             'user' => $user,
-            'token' => $token
         ];
  
         return response($response, 201);
     }
 
+    public function verifyEmail(Request $request)
+    {
+        $redirectBase = rtrim(config('app.app_pembida'), '/');
+
+        $validator = Validator::make($request->all(), [
+            'email' => 'required|email',
+            'token' => 'required|string',
+        ]);
+
+        if ($validator->fails()) {
+            return redirect()->away($redirectBase . '?email_verified=0&message=' . urlencode('Pautan pengesahan tidak sah.'));
+        }
+
+        $user = User::where('email', $request->email)
+            ->where('token', $request->token)
+            ->where('is_verified', 0)
+            ->first();
+
+        if (!$user) {
+            return redirect()->away($redirectBase . '?email_verified=0&message=' . urlencode('Pautan pengesahan tidak sah atau emel telah disahkan.'));
+        }
+
+        $user->is_verified = 1;
+        $user->email_verified_at = Carbon::now();
+        $user->token = null;
+        $user->save();
+
+        return redirect()->away($redirectBase . '?email_verified=1&message=' . urlencode('Emel berjaya disahkan.'));
+    }
+
     public function loginUser(Request $request)
     {
         $fields = $request->validate([
@@ -120,7 +146,13 @@ class AuthController extends Controller
                         'message2' => "Sila login menggunakan url " . env('APP_URL'),
                     ]);
                 } else {
-                    if ($user->status == 'active') {
+                    if (is_null($user->email_verified_at)) {
+                        return response([
+                            'statusAkaun' => 7,
+                            'message' => 'Sila sahkan emel anda sebelum log masuk. Semak peti masuk anda untuk pautan pengesahan.',
+                        ]);
+                    } else if ($user->status == 'active') {
+                        $user->tokens()->delete();
                         $token = $user->createToken('myapptoken')->plainTextToken;
                         return response([
                             'statusAkaun' => 1,
@@ -158,13 +190,14 @@ class AuthController extends Controller
         }
     }
 
-    public function logoutUser(Request $request){
-        auth()->user()->currentAccessToken()->delete();
-
-        return [
-            'message' => 'Logged Out'
-        ];
+    public function logoutUser(Request $request)
+    {
+        $token = $request->user()?->currentAccessToken();
+        if ($token) {
+            $token->delete();
+        }
 
+        return response()->json(['message' => 'Logged Out']);
     }
 
     public function forgotPassword(Request $request)

app/Mail/VerifyEmail.php

@@ -0,0 +1,31 @@
+<?php
+
+namespace App\Mail;
+
+use Illuminate\Bus\Queueable;
+use Illuminate\Mail\Mailable;
+use Illuminate\Queue\SerializesModels;
+
+class VerifyEmail extends Mailable
+{
+    use Queueable, SerializesModels;
+
+    public $name;
+    public $verifyUrl;
+
+    public function __construct($name, $verifyUrl)
+    {
+        $this->name = $name;
+        $this->verifyUrl = $verifyUrl;
+    }
+
+    public function build()
+    {
+        $user['name'] = $this->name;
+        $user['verify_url'] = $this->verifyUrl;
+
+        return $this->from(config('mail.from.address'), config('mail.from.name'))
+            ->subject('ArrahnBid - Pengesahan Emel')
+            ->view('template.verify-email', ['user' => $user]);
+    }
+}