Remove user check and redirection to registration on first landing

app/Api/v1/Controllers/UserController.php

@@ -2,8 +2,8 @@
 
 namespace App\Api\v1\Controllers;
 
-use App\Api\v1\Resources\UserResource;
 use App\Api\v1\Requests\SettingUpdateRequest;
+use App\Api\v1\Resources\UserResource;
 use App\Http\Controllers\Controller;
 use App\Models\User;
 use Illuminate\Http\Request;
@@ -12,20 +12,13 @@ use Illuminate\Support\Arr;
 class UserController extends Controller
 {
     /**
-     * Get detailed information about a user
+     * Get detailed information about the authenticated user
      *
      * @return \App\Api\v1\Resources\UserResource|\Illuminate\Http\JsonResponse
      */
     public function show(Request $request)
     {
-        // 2 cases:
+        return new UserResource($request->user());
-        // - The method is called from a protected route > we return the request's authenticated user
-        // - The method is called from a guest route > we fetch a possible registered user
-        $user = $request->user() ?: User::first();
-
-        return $user
-            ? new UserResource($user)
-            : response()->json(['name' => null], 200);
     }
 
     /**
@@ -81,8 +74,8 @@ class UserController extends Controller
         }
 
         $validated = $request->validated();
-        
+
-        $request->user()['preferences->'.$preferenceName] = $validated['value'];
+        $request->user()['preferences->' . $preferenceName] = $validated['value'];
         $request->user()->save();
 
         return response()->json([

app/Api/v1/Resources/UserResource.php

@@ -8,6 +8,7 @@ use Illuminate\Http\Resources\Json\JsonResource;
  * @property mixed $id
  * @property string $name
  * @property string $email
+ * @property string $is_admin
  */
 class UserResource extends JsonResource
 {
@@ -20,10 +21,10 @@ class UserResource extends JsonResource
     public function toArray($request)
     {
         return [
-            'id'       => $this->when(! is_null($request->user()), $this->id),
+            'id'       => $this->id,
             'name'     => $this->name,
-            'email'    => $this->when(! is_null($request->user()), $this->email),
+            'email'    => $this->email,
-            'is_admin' => $this->when(! is_null($request->user()), $this->is_admin),
+            'is_admin' => $this->is_admin,
         ];
     }
 }

resources/js/views/auth/Login.vue

@@ -1,7 +1,7 @@
 <template>
-    <div v-if="username">
+    <div>
         <!-- webauthn authentication -->
-        <form-wrapper v-if="showWebauthn" :title="$t('auth.forms.webauthn_login')" :punchline="punchline">
+        <form-wrapper v-if="showWebauthn" :title="$t('auth.forms.webauthn_login')" :punchline="$t('auth.welcome_to_2fauth')">
             <div class="field">
                 {{ $t('auth.webauthn.use_security_device_to_sign_in') }}
             </div>
@@ -16,7 +16,7 @@
             </div>
         </form-wrapper>
         <!-- login/password legacy form -->
-        <form-wrapper v-else :title="$t('auth.forms.login')" :punchline="punchline">
+        <form-wrapper v-else :title="$t('auth.forms.login')" :punchline="$t('auth.welcome_to_2fauth')">
             <div v-if="isDemo" class="notification is-info has-text-centered is-radiusless" v-html="$t('auth.forms.welcome_to_demo_app_use_those_credentials')" />
             <div v-if="isTesting" class="notification is-warning has-text-centered is-radiusless" v-html="$t('auth.forms.welcome_to_testing_app_use_those_credentials')" />
             <form id="frmLegacyLogin" @submit.prevent="handleSubmit" @keydown="form.onKeydown($event)">
@@ -25,15 +25,11 @@
                 <form-buttons :isBusy="form.isBusy" :caption="$t('auth.sign_in')" :submitId="'btnSignIn'"/>
             </form>
             <div class="nav-links">
-                <div v-if="!username">
+                <p>{{ $t('auth.forms.forgot_your_password') }}&nbsp;<router-link id="lnkResetPwd" :to="{ name: 'password.request' }" class="is-link" :aria-label="$t('auth.forms.reset_your_password')">{{ $t('auth.forms.request_password_reset') }}</router-link></p>
-                    <p>{{ $t('auth.forms.dont_have_account_yet') }}&nbsp;<router-link id="lnkRegister" :to="{ name: 'register' }" class="is-link">{{ $t('auth.register') }}</router-link></p>
+                <p >{{ $t('auth.sign_in_using') }}&nbsp;
-                </div>
+                    <a id="lnkSignWithWebauthn" role="button" class="is-link" @keyup.enter="showWebauthn = true" @click="showWebauthn = true" tabindex="0" :aria-label="$t('auth.sign_in_using_security_device')">{{ $t('auth.webauthn.security_device') }}</a>
-                <div v-else>
+                </p>
-                    <p>{{ $t('auth.forms.forgot_your_password') }}&nbsp;<router-link id="lnkResetPwd" :to="{ name: 'password.request' }" class="is-link" :aria-label="$t('auth.forms.reset_your_password')">{{ $t('auth.forms.request_password_reset') }}</router-link></p>
+                <p class="mt-4">{{ $t('auth.forms.dont_have_account_yet') }}&nbsp;<router-link id="lnkRegister" :to="{ name: 'register' }" class="is-link">{{ $t('auth.register') }}</router-link></p>
-                    <p >{{ $t('auth.sign_in_using') }}&nbsp;
-                        <a id="lnkSignWithWebauthn" role="button" class="is-link" @keyup.enter="showWebauthn = true" @click="showWebauthn = true" tabindex="0" :aria-label="$t('auth.sign_in_using_security_device')">{{ $t('auth.webauthn.security_device') }}</a>
-                    </p>
-                </div>
             </div>
         </form-wrapper>
         <!-- footer -->
@@ -49,7 +45,6 @@
     export default {
         data(){
             return {
-                username: null,
                 isDemo: this.$root.isDemoApp,
                 isTesting: this.$root.isTestingApp,
                 form: new Form({
@@ -63,12 +58,6 @@
             }
         },
 
-        computed : {
-            punchline: function() {
-                return this.isDemo ? '' : this.$t('auth.welcome_back_x', [this.username])
-            }
-        },
-
         mounted: function() {
             this.csrfRefresher = setInterval(this.refreshToken, 300000); // 5 min
         },
@@ -153,22 +142,6 @@
                 return;
             }
 
-            next(async vm => {
-                const { data } = await vm.axios.get('api/v1/user/name')
-
-                if( data.name ) {
-                    // The email property is only sent when the user is logged in.
-                    // In this case we push the user to the index view.
-                    if( data.email ) {
-                        return next({ name: 'accounts' });
-                    }
-                    vm.username = data.name
-                }
-                else {
-                    return next({ name: 'register' });
-                }
-            });
-
             next();
         },
 

resources/lang/en/auth.php

@@ -25,7 +25,7 @@ return [
     'sign_in_using_security_device' => 'Sign in using a security device',
     'login_and_password' => 'login & password',
     'register' => 'Register',
-    'welcome_back_x' => 'Welcome back {0}',
+    'welcome_to_2fauth' => 'Welcome to 2FAuth',
     'autolock_triggered' => 'Auto lock triggered',
     'autolock_triggered_punchline' => 'The event watched by the Auto Lock feature has fired. You\'ve been automatically disconnected.',
     'change_autolock_in_settings' => 'You can change the behavior of the Autolock feature in Settings > Options tab.',

routes/api/v1.php

@@ -14,11 +14,6 @@ use Illuminate\Support\Facades\Route;
 |--------------------------------------------------------------------------
 */
 
-/**
- * Unprotected routes
- */
-Route::get('user/name', [UserController::class, 'show'])->name('user.show.name');
-
 /**
  * Routes protected by the api authentication guard
  */
@@ -61,5 +56,4 @@ Route::group(['middleware' => ['auth:api-guard', 'admin']], function () {
     Route::post('settings', [SettingController::class, 'store'])->name('settings.store');
     Route::put('settings/{settingName}', [SettingController::class, 'update'])->name('settings.update');
     Route::delete('settings/{settingName}', [SettingController::class, 'destroy'])->name('settings.destroy');
-
 });