2025-12-25 06:33:21 +01:00
|
|
|
<?php
|
|
|
|
|
|
2026-01-20 20:58:32 +01:00
|
|
|
declare(strict_types=1);
|
|
|
|
|
|
2025-12-25 06:33:21 +01:00
|
|
|
namespace App\Models;
|
|
|
|
|
|
2026-01-20 20:58:32 +01:00
|
|
|
use Database\Factories\UserFactory;
|
Feature (#16)
* feat: add email verification endpoints and tests
Add comprehensive CI/CD pipeline using GitHub Actions
- Run Pest tests on PHP 8.3 and 8.4 with MySQL 8.0
- Automated code style checks with Pint
- Static analysis with Larastan/PHPStan
- Parallel job execution for faster builds
- Composer dependency caching
- MySQL service container with health checks
* feat: implement password reset flow with secure tokens , add forgot password and reset password functionality
- Created password_reset_tokens table migration
- Added POST /api/v1/forgot-password endpoint
- Added POST /api/v1/reset-password endpoint
- Both endpoints rate-limited to 6 requests per minute
- Integrated with Laravel's Password facade for secure token management
- Revokes all user tokens upon successful password reset
- Created ForgotPasswordRequest and ResetPasswordRequest with validation
- Added comprehensive test suite (6 test cases)
Password reset uses signed, time-limited tokens stored in the database.
All user sessions are invalidated after successful reset for security.
* feat: add reusable API middleware examples , Implement three production-ready middleware patterns for APIs
ForceJsonResponse:
- Ensures all API responses are JSON formatted
- Sets Accept: application/json header automatically
- Handles non-JSON responses gracefully
LogApiRequests:
- Logs API requests with timestamp, method, URL, IP, user ID, status
- Tracks and logs response time in milliseconds
- Adds X-Response-Time header to all responses
- Configurable via APP_LOG_API_REQUESTS env variable
EnsureEmailVerified:
- Protects routes requiring verified emails
- Returns 403 with descriptive message for unverified users
- Works with MustVerifyEmail contract
All middleware registered as aliases in bootstrap/app.php:
'force.json', 'log.api', 'verified'
These provide common API patterns that developers can apply to routes as needed.
* docs: update README with new API endpoints , Update API endpoints table with email verification and password reset routes
- Added 4 new endpoint rows to API documentation
- Updated rate limits for protected routes (60/min -> 120/min)
- Documented email verification endpoints
- Documented password reset endpoints
- All new endpoints properly documented with auth requirements"
* Update 0001_01_01_000000_create_users_table.php
* Fix test suite configuration and update route names to standard Laravel conventions
* style: fix code formatting per Laravel Pint standards
* refactor: revert password_reset_tokens back to users create_users migration
* Update 0001_01_01_000000_create_users_table.php
* fix: resolve all code style and type safety issues
Pint fixes:
- Fixed concat_space issues
- Removed unused imports (MustVerifyEmail from EnsureEmailVerified)
- Fixed not_operator_with_successor_space formatting
Rector fixes:
- Applied EncapsedStringsToSprintfRector for better type safety
- All code quality improvements applied
PHPStan fixes:
- Changed all middleware return types from Response to mixed (Laravel standard)
- Added Response type guard in LogApiRequests before accessing methods
- Removed redundant instanceof MustVerifyEmail check (User always implements it)
2026-01-29 04:16:33 +01:00
|
|
|
use Illuminate\Contracts\Auth\MustVerifyEmail;
|
2026-03-30 17:59:00 +02:00
|
|
|
use Illuminate\Database\Eloquent\Attributes\Fillable;
|
|
|
|
|
use Illuminate\Database\Eloquent\Attributes\Hidden;
|
2025-12-25 06:33:21 +01:00
|
|
|
use Illuminate\Database\Eloquent\Factories\HasFactory;
|
|
|
|
|
use Illuminate\Foundation\Auth\User as Authenticatable;
|
|
|
|
|
use Illuminate\Notifications\Notifiable;
|
2026-01-20 20:58:32 +01:00
|
|
|
use Illuminate\Support\Carbon;
|
2025-12-25 06:33:21 +01:00
|
|
|
use Laravel\Sanctum\HasApiTokens;
|
|
|
|
|
|
2026-01-20 20:58:32 +01:00
|
|
|
/**
|
|
|
|
|
* @property int $id
|
|
|
|
|
* @property string $name
|
|
|
|
|
* @property string $email
|
|
|
|
|
* @property Carbon|null $email_verified_at
|
|
|
|
|
* @property string $password
|
|
|
|
|
* @property Carbon|null $created_at
|
|
|
|
|
* @property Carbon|null $updated_at
|
|
|
|
|
*/
|
2026-03-30 17:59:00 +02:00
|
|
|
#[Fillable([
|
|
|
|
|
'name',
|
|
|
|
|
'email',
|
|
|
|
|
'password',
|
|
|
|
|
])]
|
|
|
|
|
#[Hidden([
|
|
|
|
|
'password',
|
|
|
|
|
'remember_token',
|
|
|
|
|
])]
|
Feature (#16)
* feat: add email verification endpoints and tests
Add comprehensive CI/CD pipeline using GitHub Actions
- Run Pest tests on PHP 8.3 and 8.4 with MySQL 8.0
- Automated code style checks with Pint
- Static analysis with Larastan/PHPStan
- Parallel job execution for faster builds
- Composer dependency caching
- MySQL service container with health checks
* feat: implement password reset flow with secure tokens , add forgot password and reset password functionality
- Created password_reset_tokens table migration
- Added POST /api/v1/forgot-password endpoint
- Added POST /api/v1/reset-password endpoint
- Both endpoints rate-limited to 6 requests per minute
- Integrated with Laravel's Password facade for secure token management
- Revokes all user tokens upon successful password reset
- Created ForgotPasswordRequest and ResetPasswordRequest with validation
- Added comprehensive test suite (6 test cases)
Password reset uses signed, time-limited tokens stored in the database.
All user sessions are invalidated after successful reset for security.
* feat: add reusable API middleware examples , Implement three production-ready middleware patterns for APIs
ForceJsonResponse:
- Ensures all API responses are JSON formatted
- Sets Accept: application/json header automatically
- Handles non-JSON responses gracefully
LogApiRequests:
- Logs API requests with timestamp, method, URL, IP, user ID, status
- Tracks and logs response time in milliseconds
- Adds X-Response-Time header to all responses
- Configurable via APP_LOG_API_REQUESTS env variable
EnsureEmailVerified:
- Protects routes requiring verified emails
- Returns 403 with descriptive message for unverified users
- Works with MustVerifyEmail contract
All middleware registered as aliases in bootstrap/app.php:
'force.json', 'log.api', 'verified'
These provide common API patterns that developers can apply to routes as needed.
* docs: update README with new API endpoints , Update API endpoints table with email verification and password reset routes
- Added 4 new endpoint rows to API documentation
- Updated rate limits for protected routes (60/min -> 120/min)
- Documented email verification endpoints
- Documented password reset endpoints
- All new endpoints properly documented with auth requirements"
* Update 0001_01_01_000000_create_users_table.php
* Fix test suite configuration and update route names to standard Laravel conventions
* style: fix code formatting per Laravel Pint standards
* refactor: revert password_reset_tokens back to users create_users migration
* Update 0001_01_01_000000_create_users_table.php
* fix: resolve all code style and type safety issues
Pint fixes:
- Fixed concat_space issues
- Removed unused imports (MustVerifyEmail from EnsureEmailVerified)
- Fixed not_operator_with_successor_space formatting
Rector fixes:
- Applied EncapsedStringsToSprintfRector for better type safety
- All code quality improvements applied
PHPStan fixes:
- Changed all middleware return types from Response to mixed (Laravel standard)
- Added Response type guard in LogApiRequests before accessing methods
- Removed redundant instanceof MustVerifyEmail check (User always implements it)
2026-01-29 04:16:33 +01:00
|
|
|
final class User extends Authenticatable implements MustVerifyEmail
|
2025-12-25 06:33:21 +01:00
|
|
|
{
|
2026-01-20 20:58:32 +01:00
|
|
|
use HasApiTokens;
|
|
|
|
|
|
|
|
|
|
/** @use HasFactory<UserFactory> */
|
|
|
|
|
use HasFactory;
|
|
|
|
|
|
|
|
|
|
use Notifiable;
|
2025-12-25 06:33:21 +01:00
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* Get the attributes that should be cast.
|
|
|
|
|
*
|
|
|
|
|
* @return array<string, string>
|
|
|
|
|
*/
|
|
|
|
|
protected function casts(): array
|
|
|
|
|
{
|
|
|
|
|
return [
|
|
|
|
|
'email_verified_at' => 'datetime',
|
|
|
|
|
'password' => 'hashed',
|
|
|
|
|
];
|
|
|
|
|
}
|
|
|
|
|
}
|