Laravel-auditing: User Type and User ID Are Null On All Laravel /api Routes

[WDC]

| Q | A
| ----------------- | ---
| Bug? | yes
| New Feature? | no
| Framework | Laravel
| Framework version | 7
| Package version | 10.0
| PHP version | 7.3

Actual Behaviour

user_type and user_id columns are not populating when models change based on requests to /api/* routes. When models change from /web/* routes, the user_type and user_id are populated as expected.

Expected Behaviour

user_type and user_id columns to populate when AJAX calls to /api routes are made.

Steps to Reproduce

1. Install Laravel Auditing in a vanilla Laravel project.
2. Add the Auditable trait to the model of interest.
3. Modify a model record using a /web route. (the user_id and user_type columns populate)
4. Modify a model record using a /api route (the user_id and user_type columns do not get populated)

Possible Solutions

I have tried changing the middleware responsible for my /api routes, but then I am faced with a 401 Unauthorized error when making calls to those endpoints. It would appear that there is no way to get my Laravel User into the /api routes, and that is causing Auditing's UserResolver to not pick up on the user that is currently logged-in.

I would like to audit all model record changes, regardless of which guard was used to bring the HTTP request into the system. I cannot figure out how to load the User into my /api routes, and of course, Auditable cannot persist user information that it is not provided.

Thank you!

[Sekaiichi]

I founded such an error on laravel 8 too.

[deepaksharma-507]

I just encountered the same issue. Did you happen to find any solution ?

[WDC]

The solution I found had nothing to do with Laravel-auditing, rather, my User was never making into the middleware. I was using Sanctum/Airlock and the API requests were not being authenticated, and Laravel-auditing was unable to store the information.

I would recommend debugging your authentication scheme to ensure the User was being injected to the middleware.

[almando]

I Guess i have the same problem. How i check it the user is going to the middleware. I have no ideia how to do it.

The solution I found had nothing to do with Laravel-auditing, rather, my User was never making into the middleware. I was using Sanctum/Airlock and the API requests were not being authenticated, and Laravel-auditing was unable to store the information.

I would recommend debugging your authentication scheme to ensure the User was being injected to the middleware.

[WDC]

The $request is passed into your Middleware's handle() function. You can dump the User like this:

    public function handle($request, Closure $next)
    {
        dd($request->user());
    }

If you get a null value put on the screen by dd() you know that your User is not being injected, however you are getting there. Once you start seeing the User, Laravel-Auditing will be able to record that data, because it will have the users.id value needed for the audits table.