Laravel-permission: Laravel Sanctum guard issue

[ScriptMintSolution]

Hello,

I am using Laravel AirLock to authenticate SPA. The auth.config file has default guard as "web" and the order of guards array also contains first key as "web".

When I create any roles or permissions using Role::create(['name' => 'admin')] or Permission::create(['name' => 'access-config']) it creates with guard name as "airlock".

Do we need to change any configuration if use AirLock authentication method?

[hkan]

Seems like setting auth.defaults.guard config as sanctum (or airlock) solves it. I don't know if it would make any difference but I should probably mention that my Laravel app is an API only app. Both the HTTP tests (using Sanctum::actingAs()) and the Vue SPA work perfectly right now.

[drbyte]

If your roles/permissions are intended to be used with a specific guard, then when you create the role/permission be sure to pass the desired guard_name for which it applies, else it will guess based on the order listed in the auth config file.

[hkan]

I can't see any benefits for taking the first item from auth.guards config. Why not just use auth.defaults.guard? Is there a specific reason for doing it that way?

[drbyte]

I can't see any benefits for taking the first item from auth.guards config. Why not just use auth.defaults.guard? Is there a specific reason for doing it that way?

Legacy stuff introduced in v2.0

There's a PR open to potentially change it, but I'm concerned about it being breaking-changes because of the long-time use of that approach for several years. So it'll probably mean bumping a major version to bring it in.

That said, there's still plenty of reason for you to be specific about which guard you want used when creating roles/permissions, because they are ALWAYS guard-specific, not generic.

[Ragash]

the problem it's still here and it's worse than it seems.

i've just clean installed Sanctum, moving from passport, and the package discovered the guards on it's own as soon as sanctum were installed, even without altering the pristine auth config, which would contain auth.default.guard = web and having only webinto the defined guards

since sanctum (seems) to work ontop of the web guards, it would be more logical imho to just dont let the package discover guards automatically at all:
that's not only for sanctum, but for every other possible implementation of a guard which doesn't declare itself explicitly.
it would be "Safer" to just let the dev provide explicitly into permission.php config which guards to list.

[hkan]

@Ragash yeah the whole auto-discovery thing is rather flimsy. See the last commit on my fork for the simplest way to change it.

[IsidroMar95]

hi there i'm using Sanctum to autenticate my SPA, so when i create a role the guard is web is this fine or the guard has to be `sanctum?

[Ragash]

@hkan thanks for the insight mate, for now i simply declared explicitly in my controller which guard to use, but yes your solution is something spatie should take in consideration imho :)

@IsidroMar95 yep, you HAVE to use the web guard (sanctum operates on top of that)