Validating login credential (Middleware)

alex32

I've a laravel MyApp and I'd like to check if a new Flarum user-email has already been registered in MyApp-Dbase. Is't possible to create a middleware , or using another mechanism, to check if the user-email already exists in MyApp-Db before the user is actually registered in Flarum?

Probably, a better option, would be to disable the new user registration in Flarum and allowing only Login using the email already present in MyApp-Dbase. This way Flarum validation is implicitly satisfied.
Thanks

clarkwinkelmann

In the Flarum admin panel in the Permissions page, you can toggle "Sign up" between "Open" / "Closed". Set it to "Closed" if you have an external platform creating the accounts.

If you use the official REST API to create user accounts from your main website, you might need to interact with an API user that has admin permissions in order to still be able to create accounts when signup have been closed.

alex32

Thanks.
I think the easiest way to do what I need is to write a middleware in Laravel so that user's emails get mirrored in Flarum.
Then I'll disable user-registration in Flarum as you've suggested.

alex32

Which algo shall I use to encrypt the password in Flarum?

clarkwinkelmann

alex32 Flarum supports any algorithm supported by PHP's password_hash. Flarum uses bcrypt, but if you store a hash for another compatible algorithm it will work out of the box as well because the algorithm name is stored in the hash itself.

If you create users via the REST API, the password must be sent in plain text though.

If you are managing login without going through Flarum's /login or /api/token endpoints, you can just set the password to any random value when creating the user, or even leaving the password column empty, and programmatically create login tokens for each users.

alex32

Thanks Clark.
I'm not using the API. I'll write directly to the Flarum.User table.
Where do I find the key used by bcrypt to encrypt the user-psw?

clarkwinkelmann

alex32 there's no key, just call password_hash() and store the output in the password column. PHP generates a salt and stores it inside the value itself.

https://www.php.net/manual/en/function.password-hash.php

You can customize the algo and cost properties if you want, Flarum just uses the default values for its own hashing.

alex32

Will try that.
Thank you!