feat: v2 auth passport cross tenant

.dockerignore

@@ -19,6 +19,10 @@ info.php
 **/docker-local/
 **/docker-compose.*
 
+# other projects in the repo
+legacy/
+keycloak/
+
 nginx-reverse-proxy.conf
 Dockerfile*
 docker-compose*

.editorconfig

@@ -26,3 +26,6 @@ indent_size = 2
 
 [Makefile]
 indent_style = tab
+
+[composer.lock]
+indent_size = 4

.env.example

@@ -24,18 +24,20 @@ LOG_LEVEL=debug
 LOG_STDOUT_FORMATTER='\\Monolog\\Formatter\\JsonFormatter' # on null, default formatter will be used
 LOG_STDERR_FORMATTER='\\Monolog\\Formatter\\JsonFormatter' # on null, default formatter will be used
 
-DB_CONNECTION=mariadb
+DB_CONNECTION=mariadb_central
 DB_HOST=mariadb
 DB_PORT=3306
 DB_DATABASE=aula_database
 DB_USERNAME=aula_user
 DB_PASSWORD=example
 
+# v1 related
 CENTRAL_DB_HOST=mariadb
 CENTRAL_DB_PORT=3306
 CENTRAL_DB_NAME=aula_database
 CENTRAL_DB_USER=aula_user
 CENTRAL_DB_PASS=example
+# end of v1 related
 
 SESSION_DRIVER=database
 SESSION_LIFETIME=120

.env.testing

@@ -6,7 +6,7 @@
 
 APP_KEY=base64:eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHg=
 
-DB_CONNECTION=mariadb
+DB_CONNECTION=mariadb_central
 DB_HOST=127.0.0.1
 # necessary for manual/local/VSCode
 # (using docker-compose.yml, not .test.yml)

.gitignore

@@ -28,6 +28,7 @@ Homestead.json
 Homestead.yaml
 Thumbs.db
 
+legacy/config/*.key
 !config/*-example
 **/base_config.php
 **/instances_config.php

Makefile

@@ -36,6 +36,7 @@ test:
 xdebug-v2-docker-setup:
 	docker compose exec aula-backend.v2 true
 	docker compose exec aula-backend.v2 sh -c 'apk add php84-pecl-xdebug; echo -e "zend_extension=/usr/lib/php84/modules/xdebug.so\nxdebug.mode=develop,debug\nxdebug.start_with_request=yes\nxdebug.client_host=host.docker.internal\nxdebug.client_port=9013\ndefault_socket_timeout=600" > /usr/local/etc/php/conf.d/docker-xdebug.ini'
+	docker compose exec aula-backend.v2 sh -c 'composer require --dev -m phpunit/phpunit ^12'
 	docker compose restart aula-backend.v2
 	docker compose exec aula-backend.v2 php -i | grep xdebug.client_
 	@echo "Note: ephemeral, might need to rerun after docker compose restart/up/down!"

app/Auth/PassportJwtClaims/AulaClaims.php

@@ -0,0 +1,26 @@
+<?php
+
+namespace App\Auth\PassportJwtClaims;
+
+use App\Models\LegacyUser;
+use CorBosman\Passport\AccessToken;
+
+class AulaClaims
+{
+    /**
+     * Process the generated JWT token, attach aula-specific data to it.
+     *
+     * @param mixed $next
+     */
+    public function handle(AccessToken $token, $next)
+    {
+        $user = LegacyUser::find($token->getUserIdentifier());
+
+        $token->addClaim('user_hash', $user->hash_id);
+        $token->addClaim('temp_pw', !empty($user->temp_pw));
+        $token->addClaim('user_level', $user->userlevel?->value);
+        $token->addClaim('roles', json_decode($user->roles ?? '[]'));
+
+        return $next($token);
+    }
+}

app/Data/User/AbstractUserData.php

@@ -6,8 +6,6 @@
 
 use DateTimeImmutable;
 use Spatie\LaravelData\Data;
-use Spatie\LaravelData\Attributes\MapName;
-use Spatie\LaravelData\Attributes\Validation\Max;
 use App\Enums\UserLevel;
 use App\Enums\UserStatus;
 

app/Data/User/DomainUserData.php

@@ -7,9 +7,7 @@
 use DateTimeImmutable;
 use App\Data\User\AbstractUserData;
 use App\Enums\UserLevel;
-use Spatie\LaravelData\Attributes\MapName;
 use Spatie\LaravelData\Attributes\MapInputName;
-use Spatie\LaravelData\Attributes\MapOutputName;
 
 class DomainUserData extends AbstractUserData
 {

app/Http/Controllers/Auth/RefreshTokenController.php

@@ -2,18 +2,13 @@
 
 namespace App\Http\Controllers\Auth;
 
-use App\Http\Controllers\Controller;
 use App\Models\LegacyUser;
-use App\Services\LegacyJwtService;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
+use Illuminate\Routing\Controller;
 
 class RefreshTokenController extends Controller
 {
-    public function __construct(
-        protected LegacyJwtService $jwtService
-    ) {}
-
     /**
      * Refresh the JWT token.
      * Matches the legacy refresh_token.php behavior.
@@ -22,7 +17,7 @@
     {
         // Extract token from Authorization header
         $authHeader = $request->header('Authorization');
         $token = $this->jwtService->extractBearerToken($authHeader);
 
         if ($token === null) {
             return response()->json([
@@ -70,7 +65,7 @@
         }
 
         // Clear the refresh token flag
         $user->clearRefreshToken();
 
         // Generate new token with fresh user data
         $newToken = $this->jwtService->generateToken($user);