User Authentication & Authorization

Relevant source files

The following files were used as context for generating this wiki page:

• app/Http/Controllers/Api/AuthController.php
• routes/api.php
• routes/web.php
• resources/views/welcome.blade.php
• resources/views/dashboard/pos/users.blade.php
• resources/views/layouts/dashboard.blade.php

The QashierWise backend employs a dual authentication system to secure both its API and web interfaces. For the API, it uses Laravel Sanctum to provide stateless, token-based authentication, which is ideal for Single Page Applications (SPAs) or mobile clients. For its web routes, it utilizes Laravel's standard session-based authentication.

The system manages user registration, login, and logout. Authorization is handled through a combination of middleware for route protection and a role-based access control (RBAC) system, particularly for the Point of Sale (POS) module, which defines roles such as Admin, Cashier, and Manager.

API Authentication (Laravel Sanctum)

The core of the application's security for client-side interactions is handled by Laravel Sanctum, providing a robust token-based authentication mechanism.

Sources: app/Http/Controllers/Api/AuthController.php, routes/api.php

API Endpoints

The authentication system exposes several public and protected endpoints for managing the user's authentication state.

Method	Endpoint	Controller Action	Description	Protection
POST	/api/register	AuthController@register	Registers a new user and returns a token.	Public
POST	/api/login	AuthController@login	Authenticates a user and returns a token.	Public
POST	/api/logout	AuthController@logout	Revokes the user's current access token.	auth:sanctum
GET	/api/me	AuthController@me	Retrieves the currently authenticated user's data.	auth:sanctum

Sources: routes/api.php:19-22, 30-32

Registration Flow

A new user can be created via the /api/register endpoint. The controller validates the input, creates a new user record, and generates a Sanctum API token.

The diagram below illustrates the user registration process.

Registration Validation

Field	Rules
name	required, string, max:255
email	required, string, email, max:255, unique:users
password	required, string, min:8, confirmed

Sources: app/Http/Controllers/Api/AuthController.php:17-21

Login Flow

Authenticated is handled by the /api/login endpoint. It validates credentials and, upon success, generates a new Sanctum API token for the user.

This sequence diagram shows the login process.

Login Validation

Field	Rules
email	required, email
password	required

Sources: app/Http/Controllers/Api/AuthController.php:53-56

Token Management

API tokens are the primary method for authenticating with protected API endpoints.

• Creation: A new token is generated upon successful registration or login. The token has a defined expiration, which is pulled from a configuration file (config('sanctum.expiration', 43200)), defaulting to 30 days (43200 minutes).
  Sources: app/Http/Controllers/Api/AuthController.php:35-37, 75-77
• Revocation: When a user logs out via the /api/logout endpoint, their currentAccessToken() is retrieved and deleted, invalidating it for future requests.
  Sources: app/Http/Controllers/Api/AuthController.php:90-105, resources/views/layouts/dashboard.blade.php:25-35

Web Authentication

In addition to the API, the application uses Laravel's built-in session-based authentication to protect web-facing dashboard routes.

Sources: routes/web.php, resources/views/welcome.blade.php

Route Protection

Web routes for the dashboard are grouped and protected by the check.web.auth middleware. This ensures that only authenticated users can access pages like /dashboard.

// routes/web.php:19-58
Route::middleware(['web', 'check.web.auth'])->group(function () {
    Route::get('/dashboard', function () {
        return view('dashboard.index');
    })->name('dashboard');

    // ... other dashboard routes
});

Sources: routes/web.php:19-58

UI Logic

The frontend conditionally renders UI elements based on the user's authentication status using Blade's @auth directive. For example, the main landing page shows a "Dashboard" link to authenticated users and "Login" links to guests.

// resources/views/welcome.blade.php:441-449
@if (Route::has('login'))
    @auth
        <a href="{{ url('/dashboard') }}" class="text-gray-600 hover:text-primary font-medium transition">Dashboard</a>
    @else
        <a href="/login" class="text-gray-600 hover:text-primary font-medium transition">Lihat Demo</a>
        <a href="/login" class="bg-primary text-white px-5 py-2.5 rounded-lg font-medium hover:bg-primary/90 transition-all">
            Coba Gratis 14 Hari
        </a>
    @endauth
@endif

Sources: resources/views/welcome.blade.php:441-449

Authorization

Authorization is implemented through middleware for route protection and a role-based system for finer-grained control.

Route Protection

• API: All sensitive API routes are grouped under the auth:sanctum middleware, which ensures a valid Sanctum token is present in the request.
  Sources: routes/api.php:28
• Web: Dashboard web routes are protected by the check.web.auth middleware.
  Sources: routes/web.php:19

Role-Based Access Control (RBAC)

The POS module utilizes a role-based system to manage staff permissions. While the model implementations are not shown, the POS user management interface reveals the existence of Roles and their assignment to users.

• Roles: The system includes roles such as Admin, Cashier, and Manager.
  Sources: resources/views/dashboard/pos/users.blade.php:230
• Assignment: The UI allows assigning a User to a specific Store and Role, creating a PosUser entity.
  Sources: resources/views/dashboard/pos/users.blade.php:180-205

The following diagram illustrates the inferred relationships between Users, POS Users, Roles, and Stores.