Xây dựng Web Service cho chức năng đăng ký, đăng nhập… trên Laravel

CREATE TABLE users ( 
  id INT UNSIGNED AUTO_INCREMENT PRIMARY KEY, 
  name VARCHAR(255) NOT NULL, 
  email VARCHAR(255) NOT NULL UNIQUE, 
  password VARCHAR(255) NOT NULL, 
  email_verified_at DATETIME, 
  remember_token VARCHAR(100), 
  created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP, 
  updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP
);

protected $policies = [
  'App\Models\Model' => 'App\Policies\ModelPolicy', 
];

'guards' => [
  'web' => [
    'driver' => 'session',
    'provider' => 'users',
  ],

  'api' => [
    'driver' => 'passport', 
    'provider' => 'users',
  ],
],

<?php 

namespace App\Models;

// use Illuminate\Contracts\Auth\MustVerifyEmail;
use Illuminate\Database\Eloquent\Factories\HasFactory;
use Illuminate\Foundation\Auth\User as Authenticatable;
use Illuminate\Notifications\Notifiable;
use Laravel\Passport\HasApiTokens;
use Illuminate\Foundation\Auth\VerifiesEmails; 
use Illuminate\Database\Eloquent\Model; 


class User extends Authenticatable
{
    use HasApiTokens, HasFactory, Notifiable;

    /**
     * The attributes that are mass assignable.
     *
     * @var array<int, string>
     */
    protected $fillable = [
        'name',
        'email',
        'password',
    ];

    /**
     * The attributes that should be hidden for serialization.
     *
     * @var array<int, string>
     */
    protected $hidden = [
        'password',
        'remember_token',
    ];

    /**
     * The attributes that should be cast.
     *
     * @var array<string, string>
     */
    protected $casts = [
        'email_verified_at' => 'datetime',
    ];

    public static $registerRules = [
        'name' => 'required|string|max:255',
        'email' => 'required|string|email|max:255|unique:users',
        'password' => 'required|string|min:6|confirmed',
    ];

    public static $updatePasswordRules = [
        'current_password' => 'required',
        'password' => 'required|string|min:6|confirmed',
    ];
}

<?php 
namespace App\Http\Controllers; 
use App\Models\User; 
use Illuminate\Http\Request; 
use Illuminate\Support\Facades\Auth; 
use Illuminate\Support\Facades\Validator; 

class UserController extends Controller { 
    public function register(Request $request) { 
        $validator = Validator::make($request->all(), User::$registerRules);
        if ($validator->fails()) {
            return response()->json(['errors' => $validator->errors()], 422);
        }

        $user = new User();
        $user->name = $request->name;
        $user->email = $request->email;
        $user->password = bcrypt($request->password);
        $user->save();

        return response()->json(['message' => 'Successfully registered'], 201);
    }

    public function verify(Request $request)
    {
        $user = User::find($request->id);
        $user->email_verified_at = now();
        $user->save();

        return response()->json(['message' => 'Successfully verified'], 200);
    }

    public function login(Request $request)
    {
        $validator = Validator::make($request->all(), [
            'email' => 'required|email',
            'password' => 'required',
        ]);
        if ($validator->fails()) {
            return response()->json(['errors' => $validator->errors()], 422);
        }

        $credentials = $request->only(['email', 'password']);
        if (Auth::attempt($credentials)) {
            $user = Auth::user();
            if (!$user->email_verified_at) {
                return response()->json(['errors' => 'Email not verified'], 401);
            }
            $token = $user->createToken('Laravel Password Grant Client')->accessToken;
            return response()->json(['token' => $token], 200);
        } else {
            return response()->json(['errors' => 'Email or password is incorrect'], 401);
        }
    }
}

public function changePassword(Request $request)
{
    // Validate the request
    $validator = Validator::make($request->all(), [
        'password' => 'required|string|min:6',
    ]);
    if ($validator->fails()) {
        return response()->json(['errors' => $validator->errors()], 422);
    }

    // Check if the request has a valid Bearer token
    if ($request->bearerToken()) {
        // Get the authenticated user
        $user = $request->user();
        // Update the user's password
        $user->password = bcrypt($request->password);
        $user->save();
        return response()->json(['message' => 'Password changed successfully'], 200);
    } else {
        // Return error if the request doesn't have a valid Bearer token
        return response()->json(['error' => 'Unauthorized'], 401);
    }
}

Route::put('/user/change-password', 'App\Http\Controllers\UserController@changePassword')->middleware('auth:api');

<?php 
use Illuminate\Http\Request; 
use Illuminate\Support\Facades\Route; 
use App\Http\Controllers\UserController; 
/* |-------------------------------------------------------------------------- | API Routes |-------------------------------------------------------------------------- | | Here is where you can register API routes for your application. These | routes are loaded by the RouteServiceProvider within a group which | is assigned the "api" middleware group. Enjoy building your API! | */ 

Route::post('user/register', 'App\Http\Controllers\UserController@register'); 
Route::post('user/verify', 'App\Http\Controllers\UserController@verify'); 
Route::post('user/authenticate', 'App\Http\Controllers\UserController@authenticate'); 
Route::post('user/password', 'App\Http\Controllers\UserController@updatePassword'); 
Route::post('user/login', 'App\Http\Controllers\UserController@login'); 
Route::get('login', 'App\Http\Controllers\UserController@login'); 

Route::get('/user/{id}', 'App\Http\Controllers\UserController@getUser')->middleware('auth:api');
Route::put('/user/change-password', 'App\Http\Controllers\UserController@changePassword')->middleware('auth:api');

curl -X POST \
  http://localhost:8000/api/user/register \
  -H 'Content-Type: application/json' \
  -d '{
  "name": "test",
	"email": "user@example.com",
	"password": "password123",
  "password_confirmation: "password123"
}'

curl -X POST \
  http://localhost:8000/api/user/verify \
  -H 'Content-Type: application/json' \
  -d '{
	"email": "user@example.com",
	"verification_code": "123456"
}'

curl -X POST \
  http://localhost:8000/api/user/authenticate \
  -H 'Content-Type: application/json' \
  -d '{
	"email": "user@example.com",
	"password": "password"
}'

curl -X POST \
  http://localhost:8000/api/user/password \
  -H 'Authorization: Bearer ' \
  -H 'Content-Type: application/json' \
  -d '{
	"password": "newpassword"
}'