[8.x] Auth: Allows to use a callback in credentials array

[DarkGhostHunter]

What?

Allows to use a callback on the Auth::attempt() credentials array:

Auth::attempt([
    'email' => '[email protected]',
    function ($builder) {
        $builder->where('subscription_expires_at', '<', now());
    }
]);

Why?

Both EloquentUserProvider and DatabaseUserProvider only support where() and whereIn() clauses when these receive a credentials array value. This allows to make further adjustments if the value is a callback.

The difference between this and attemptWith() is that this affects the query directly, which is useful to short-circuit the authentication procedure on user retrieval instead of using the aforementioned helper. In some cases, this may help reduce memory consumption as the model/row may not be retrieved before further checks.

BC

None, as is not expected a developer used callbacks in the attempt() array.

Notes

This may be also good for other packages as these can include their own callbacks into the credentials array.

[derekmd]

String values can be passed into the additional conditions payload so the new conditional may have to be $value instanceof Closure or add ! is_string($value) && is_callable($value) which still allows invokable objects to modify the query. Otherwise this may introduce the same issue as #20692

e.g.,

Auth::attempt([
    'email' => 'foo@bar',
    'password' => 'baz',
    'department' => 'mail',
]);

is_callable('mail') is true because the mail() function exists in the global namespace. mail() is called instead of SQL AND department = 'mail' being appended.

Some other case-insensitive values additional conditions couldn't use include assert, collect, copy, file, e, max, min, link, optional, stat, and view.

[DarkGhostHunter]

You're right. Using a value with the same name as a function is a red flag. Try with "mail" => "dd".

It should be strictly a Closure. Totally forgot to force Closures where UGC values may come in as 101.

[DarkGhostHunter]

👌 Italo Baeza C.

…

El 01-11-2021, a la(s) 14:43, Taylor Otwell ***@***.***> escribió:  Merged #39420 into 8.x. — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub, or unsubscribe.