solocla/yogibook_aury_new
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fixed 2 bootstrap

Browse Source
This commit is contained in:
Claudio
2026-07-27 14:59:13 +02:00
parent e10774ad33
commit 93124bd3e9
1 changed files with 33 additions and 50 deletions
Download Patch File Download Diff File Expand all files Collapse all files
public/api/_bootstrap.php
+33 -50
View File
@@ -1,59 +1,42 @@
Perfetto, ora ho la conferma totale e la soluzione è chiara. Tutto punta a Sanctum:
<?php
SANCTUM OK — la libreria c'è.
Il login (AuthController.php:51) crea il token con $user->createToken($request->device_name)->plainTextToken — è Sanctum puro. Ecco perché il token ha il formato 4|....
app/User.php usa Laravel\Sanctum\HasApiTokens — il modello utente è predisposto per Sanctum.
declare(strict_types=1);
ini_set('display_errors', 1);
error_reporting(E_ALL);
header('Content-Type: application/json');
Quindi il login genera token Sanctum, ma il _bootstrap.php (ereditato dal multiscuola) li valida col vecchio TokenGuard che cerca api_token. Disallineamento totale. Sistemiamo il bootstrap perché usi Sanctum.
require_once dirname(__DIR__) . '/class/db-functions.php';
$db = DBHandlerSelect::getInstance()->getConnection();
Il _bootstrap.php corretto
require_once dirname(__DIR__, 2) . '/vendor/autoload.php';
Sostituisco il blocco AUTH. Copia-incolla questo intero comando in SSH per riscrivere il file con la validazione Sanctum giusta:
$authHeader = $_SERVER['HTTP_AUTHORIZATION'] ?? $_SERVER['REDIRECT_HTTP_AUTHORIZATION'] ?? '';
if (!preg_match('/Bearer\s+(.*)$/i', $authHeader, $m)) {
http_response_code(401);
echo json_encode(['error' => 'Unauthorized', 'reason' => 'no bearer']);
exit;
}
$bearer = trim($m[1]);
bash
cat > public/api/_bootstrap.php << 'EOF'
<?php
$hash = hash('sha256', explode('|', $bearer, 2)[1] ?? $bearer);
$stmt = $db->prepare("SELECT tokenable_id FROM personal_access_tokens WHERE token = ? LIMIT 1");
$stmt->execute([$hash]);
$row = $stmt->fetch(PDO::FETCH_ASSOC);
declare(strict_types=1);
if (!$row) {
http_response_code(401);
echo json_encode(['error' => 'Unauthorized', 'reason' => 'invalid token']);
exit;
}
ini_set('display_errors', 1);
error_reporting(E_ALL);
$stmt = $db->prepare("SELECT * FROM auth_users WHERE id = ? LIMIT 1");
$stmt->execute([$row['tokenable_id']]);
$userRow = $stmt->fetch(PDO::FETCH_ASSOC);
header('Content-Type: application/json');
if (!$userRow) {
http_response_code(401);
echo json_encode(['error' => 'Unauthorized', 'reason' => 'no user']);
exit;
}
// ==============================
// DB (public/class/db-functions.php)
// ==============================
require_once dirname(__DIR__) . '/class/db-functions.php';
$db = DBHandlerSelect::getInstance()->getConnection();
// ==============================
// BOOTSTRAP LARAVEL (per Sanctum + Eloquent)
// ==============================
require_once dirname(__DIR__, 2) . '/vendor/autoload.php';
$app = require_once dirname(__DIR__, 2) . '/bootstrap/app.php';
$app->make(\Illuminate\Contracts\Http\Kernel::class)
->bootstrap();
// ==============================
// AUTH SANCTUM (TOKEN Bearer)
// ==============================
$authHeader = $_SERVER['HTTP_AUTHORIZATION']
?? $_SERVER['REDIRECT_HTTP_AUTHORIZATION']
?? '';
if (!preg_match('/Bearer\s+(.*)$/i', $authHeader, $m)) {
http_response_code(401);
echo json_encode(['error' => 'Unauthorized', 'reason' => 'no bearer']);
exit;
}
$bearer = trim($m[1]);
$accessToken = \Laravel\Sanctum\PersonalAccessToken::findToken($bearer);
$user = $accessToken?->tokenable;
if (!$user) {
http_response_code(401);
echo json_encode(['error' => 'Unauthorized', 'reason' => 'invalid token']);
exit;
}
$user = (object) $userRow;