73 lines
2.0 KiB
PHP
73 lines
2.0 KiB
PHP
<?php
|
|
|
|
namespace App\Http\Controllers;
|
|
|
|
use App\Http\Traits\ApiResponse;
|
|
use Illuminate\Http\JsonResponse;
|
|
use Illuminate\Http\Request;
|
|
use Illuminate\Support\Facades\Auth;
|
|
use Illuminate\Support\Facades\Cookie;
|
|
|
|
class AuthController extends Controller
|
|
{
|
|
use ApiResponse;
|
|
|
|
/**
|
|
* Utente autenticato corrente (include l'accessor setup_status).
|
|
* Risposta al primo livello, come da convenzione Sanctum SPA.
|
|
*/
|
|
public function me(Request $request): JsonResponse
|
|
{
|
|
return response()->json($request->user());
|
|
}
|
|
|
|
/**
|
|
* Logout: chiude la sessione stateful e ripulisce i cookie.
|
|
* Sovrascrive la rotta omonima di Fortify (registrata dopo → ha precedenza).
|
|
*/
|
|
public function logout(Request $request): JsonResponse
|
|
{
|
|
$this->tearDownSession($request);
|
|
|
|
return $this->forgetAuthCookies($this->messageResponse('auth.logout_success'));
|
|
}
|
|
|
|
/**
|
|
* Cancellazione self-service dell'account: soft-delete + logout.
|
|
* L'anonimizzazione definitiva (GDPR) la fa l'Admin o la retention.
|
|
*/
|
|
public function destroyAccount(Request $request): JsonResponse
|
|
{
|
|
$user = $request->user();
|
|
abort_if($user->is_system, 403);
|
|
|
|
$user->delete();
|
|
$this->tearDownSession($request);
|
|
|
|
return $this->forgetAuthCookies($this->messageResponse('account.deleted'));
|
|
}
|
|
|
|
/**
|
|
* Invalida la sessione corrente e rigenera il token CSRF.
|
|
*/
|
|
private function tearDownSession(Request $request): void
|
|
{
|
|
Auth::guard('web')->logout();
|
|
|
|
if ($request->hasSession()) {
|
|
$request->session()->invalidate();
|
|
$request->session()->regenerateToken();
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Marca per la cancellazione i cookie di sessione e XSRF lato client.
|
|
*/
|
|
private function forgetAuthCookies(JsonResponse $response): JsonResponse
|
|
{
|
|
return $response
|
|
->withCookie(Cookie::forget(config('session.cookie')))
|
|
->withCookie(Cookie::forget('XSRF-TOKEN'));
|
|
}
|
|
}
|