Laravel 8 menyediakan sistem authentication untuk SPA (single page application) semacam aplikasi berbasis vuejs atau reactjs, dan juga untuk aplikasi mobile. Sanctum memungkinkan masing-masing user mengenerate beberapa token untuk masing-masing akunnya. Jadi gini, semisal tadinya udah login di aplikasi berbasis web (SPA) terus login lagi di aplikasi berbasis android. User yang login tersebut akan mempunyai 2 token yang berbeda.

Di bagian belakang nanti akan kita bahas pada proses logout-nya. Dimana user bisa logout untuk 1 device atau untuk semua devicenya.

Sekarang kita buat dulu projectnya dengan menjalankan perintah di console atau terminal. Pastikan sudah terinstall composer dan php minimal  versi 7.3.* untuk laravel 8.

Buka terminal dan jalankan perintah.

composer create-project --prefer-dist laravel/laravel demosanctum

Tunggu sampai proses selesai. Masih di dalam terminal, jalankan perintah untuk menginstall laravel/sanctum.

cd demosanctum
composer require laravel/sanctum

Oh ya, siapkan dulu database di mysql. Pada demo ini database saya beri nama blog_sanctum.

Setelah proses instalasi laravel/sanctum selesai, kita lanjut ke step berikutnya. Yaitu publish configuration.

php artisan vendor:publish --provider="Laravel\Sanctum\SanctumServiceProvider"

Kemudian buka folder demosanctum menggunakan editor, kemudian edit file .env pada bagian ini untuk menghubungkan ke database.

DB_CONNECTION=mysql
DB_HOST=127.0.0.1
DB_PORT=3306
DB_DATABASE=blog_sanctum
DB_USERNAME=root
DB_PASSWORD=

Selanjutnya migrate untuk memasukkan table users dan table lainnya.

php artisan migrate

Karena bawaan dari file migrations, field primary key menggunakan bigincrements akan ubah menjadi increments saja. Kita mulai dari migrations users sekalian menambahkan field status.

<?php

use Illuminate\Database\Migrations\Migration;
use Illuminate\Database\Schema\Blueprint;
use Illuminate\Support\Facades\Schema;

class CreateUsersTable extends Migration
{
    /**
     * Run the migrations.
     *
     * @return void
     */
    public function up()
    {
        Schema::create('users', function (Blueprint $table) {
            $table->increments('id');
            $table->string('name');
            $table->string('email')->unique();
            $table->timestamp('email_verified_at')->nullable();
            $table->string('password');
            $table->string('status')->default('aktif');
            $table->rememberToken();
            $table->timestamps();
        });
    }

    /**
     * Reverse the migrations.
     *
     * @return void
     */
    public function down()
    {
        Schema::dropIfExists('users');
    }
}

Kemudian lanjut migrations personal_access_token

<?php

use Illuminate\Database\Migrations\Migration;
use Illuminate\Database\Schema\Blueprint;
use Illuminate\Support\Facades\Schema;

class CreatePersonalAccessTokensTable extends Migration
{
    /**
     * Run the migrations.
     *
     * @return void
     */
    public function up()
    {
        Schema::create('personal_access_tokens', function (Blueprint $table) {
            $table->increments('id');
            // $table->morphs('tokenable');
            $table->string('tokenable_type');
            $table->integer('tokenable_id')->unsigned();
            $table->foreign('tokenable_id')->references('id')->on('users');
            // end table morphs
            $table->string('name');
            $table->string('token', 64)->unique();
            $table->text('abilities')->nullable();
            $table->timestamp('last_used_at')->nullable();
            $table->timestamps();
        });
    }

    /**
     * Reverse the migrations.
     *
     * @return void
     */
    public function down()
    {
        Schema::dropIfExists('personal_access_tokens');
    }
}

Jangan lupa untuk sesuaikan juga file app/Http/Kernel.php pada bagian "api" menjadi seperti berikut.

       'api' => [
            \Laravel\Sanctum\Http\Middleware\EnsureFrontendRequestsAreStateful::class,
            'throttle:api',
            \Illuminate\Routing\Middleware\SubstituteBindings::class,
        ],

Kemudian file model app/Models/User.php kita sesuaikan agar bisa createToken

<?php

namespace App\Models;

use Illuminate\Contracts\Auth\MustVerifyEmail;
use Illuminate\Database\Eloquent\Factories\HasFactory;
use Illuminate\Foundation\Auth\User as Authenticatable;
use Illuminate\Notifications\Notifiable;
use Laravel\Sanctum\HasApiTokens;

class User extends Authenticatable
{
    use HasFactory, Notifiable, HasApiTokens;

    /**
     * The attributes that are mass assignable.
     *
     * @var array
     */
    protected $fillable = [
        'name',
        'email',
        'password',
        'status',
    ];

    /**
     * The attributes that should be hidden for arrays.
     *
     * @var array
     */
    protected $hidden = [
        'password',
        'remember_token',
    ];

    /**
     * The attributes that should be cast to native types.
     *
     * @var array
     */
    protected $casts = [
        'email_verified_at' => 'datetime',
    ];
}

Sekarang kita jalankan migrate:refresh untuk mengenerate ulang table dari migrations.

php artisan migrate:refresh

Agar kita bisa mencoba proses authentication, kita perlu memasukkan data users terlebih dahulu. Sekarang kita buat file UserSeeder.php.

php artisan make:seeder UserSeeder

Isi file UserSeeder.php kita ubah agar bisa menginput data users.

<?php

namespace Database\Seeders;

use Illuminate\Database\Seeder;
use App\Models\User;
class UserSeeder extends Seeder
{
    /**
     * Run the database seeds.
     *
     * @return void
     */
    public function run()
    {
        User::create([
            'email' => '[email protected]',
            'name' => 'Fadlur',
            'password' => \Hash::make('123258'),
            'status' => 'aktif',
        ]);
    }
}

Dan juga file DatabaseSeeder.php agar bisa memanggil UserSeeder.php tadi.

    public function run()
    {
        // \App\Models\User::factory(10)->create();
        $this->call(UserSeeder::class);
    }

Kembali ke terminal dan jalankan seeder yang telah kita buat.

php artisan db:seed

Table dan settingnya sudah kita buat, selanjutnya kita buat controller AuthController.php

php artisan make:controller AuthController.php

Buka file AuthController.php dan ubah menjadi seperti berikut.

<?php

namespace App\Http\Controllers;

use Illuminate\Http\Request;
use Illuminate\Support\Facades\Auth;
use Illuminate\Support\Arr;
use App\Models\User;

class AuthController extends Controller
{
    public function login(Request $request) {
        $validate = \Validator::make($request->all(), [
            'email' => 'required',
            'password' => 'required',
        ]);

        if ($validate->fails()) {
            $respon = [
                'status' => 'error',
                'msg' => 'Validator error',
                'errors' => $validate->errors(),
                'content' => null,
            ];
            return response()->json($respon, 200);
        } else {
            $credentials = request(['email', 'password']);
            $credentials = Arr::add($credentials, 'status', 'aktif');
            if (!Auth::attempt($credentials)) {
                $respon = [
                    'status' => 'error',
                    'msg' => 'Unathorized',
                    'errors' => null,
                    'content' => null,
                ];
                return response()->json($respon, 401);
            }

            $user = User::where('email', $request->email)->first();
            if (! \Hash::check($request->password, $user->password, [])) {
                throw new \Exception('Error in Login');
            }

            $tokenResult = $user->createToken('token-auth')->plainTextToken;
            $respon = [
                'status' => 'success',
                'msg' => 'Login successfully',
                'errors' => null,
                'content' => [
                    'status_code' => 200,
                    'access_token' => $tokenResult,
                    'token_type' => 'Bearer',
                ]
            ];
            return response()->json($respon, 200);
        }
    }

    public function logout(Request $request) {
        $user = $request->user();
        $user->currentAccessToken()->delete();
        $respon = [
            'status' => 'success',
            'msg' => 'Logout successfully',
            'errors' => null,
            'content' => null,
        ];
        return response()->json($respon, 200);
    }

    public function logoutall(Request $request) {
        $user = $request->user();
        $user->tokens()->delete();
        $respon = [
            'status' => 'success',
            'msg' => 'Logout successfully',
            'errors' => null,
            'content' => null,
        ];
        return response()->json($respon, 200);
    }
}

Kita perlu set route api-nya agar bisa diakses, buka file routes/api.php

<?php

use Illuminate\Http\Request;
use Illuminate\Support\Facades\Route;
use App\Http\Controllers\AuthController;// manggil controller sesuai bawaan laravel 8
/*
|--------------------------------------------------------------------------
| API Routes
|--------------------------------------------------------------------------
|
| Here is where you can register API routes for your application. These
| routes are loaded by the RouteServiceProvider within a group which
| is assigned the "api" middleware group. Enjoy building your API!
|
*/

// Route::middleware('auth:api')->get('/user', function (Request $request) {
//     return $request->user();
// });
Route::post('login', '[email protected]');
Route::group(['prefix' => 'auth', 'middleware' => 'auth:sanctum'], function() {
    // manggil controller sesuai bawaan laravel 8
    Route::post('logout', [AuthController::class, 'logout']);
    // manggil controller dengan mengubah namespace di RouteServiceProvider.php biar bisa kayak versi2 sebelumnya
    Route::post('logoutall', '[email protected]');
});

Karena pada versi laravel 8, cara memanggil agar berbeda dengan versi sebelumnya. maka biar bisa dipanggil kayak versi sebelumnya kita perlu mengedit namespace di route api di dalam file RouteServiceProvider.php

        Route::prefix('api')
                ->middleware('api')
                // ->namespace($this->namespace)
                ->namespace('App\Http\Controllers')
                ->group(base_path('routes/api.php'));

Sampai sini sudah selesai, sekarang kita coba menggunakan postman.

1. Login

2. Logout

3. Logout All

Hasil jadinya bisa dilihat di https://github.com/fadlur/demosanctum