DONE: fix password bypass in production, use dropdown for admin to edit membership application (#13)

Co-authored-by: ISMAIL MASSERAN <topaz@Mac.dlinkrouter.local>
Reviewed-on: KoPKB/My-KOPKB#13

app/Providers/FortifyServiceProvider.php

@@ -94,11 +94,24 @@ class FortifyServiceProvider extends ServiceProvider
 
         Fortify::authenticateUsing(function (Request $request) {
             $user = User::where('email', $request->email)->first();
+            $invalidCredentialsMessage = 'Emel atau kata laluan tidak sah.';
+
+            $failLogin = function () use ($invalidCredentialsMessage): never {
+                throw ValidationException::withMessages([
+                    'email' => [$invalidCredentialsMessage],
+                ]);
+            };
+
+            if (! $user) {
+                $failLogin();
+            }
 
-            // Bypass password check in local or development environments
             $shouldBypassPassword = config('app.env', 'local');
 
-            if ($user && ($shouldBypassPassword || Hash::check($request->password, $user->password))) {
+            if (! $shouldBypassPassword && ! Hash::check($request->password, $user->password)) {
+                $failLogin();
+            }
+
             if (! $user->canAuthenticate()) {
                 throw ValidationException::withMessages([
                     'email' => [$user->getLoginRestrictionMessage()],
@@ -106,7 +119,6 @@ class FortifyServiceProvider extends ServiceProvider
             }
 
             return $user;
-            }
         });
     }
 }

bootstrap/app.php

@@ -59,10 +59,13 @@ return Application::configure(basePath: dirname(__DIR__))
         // Handle Validation exceptions (422 errors)
         $exceptions->render(function (Illuminate\Validation\ValidationException $e, $request) {
             if ($request->expectsJson()) {
+                $errors = $e->errors();
+                $firstMessage = collect($errors)->flatten()->first() ?? 'Data tidak sah.';
+
                 return response()->json([
                     'success' => false,
-                    'message' => 'Data tidak sah.',
-                    'errors' => $e->errors(),
+                    'message' => $firstMessage,
+                    'errors' => $errors,
                 ], 422);
             }
         });