Custom CP guard support

[artemverbo]

Bug description

Hello, any chance to make it work with a custom guard? Or more like cp guard defined in config/statamic/users

        'cp' => 'statamic',
        'web' => 'web',
    ],

My use case: we have a website, where Statamic admins are separated (file-based) against "user portal" users, which are DB-based. User portal users use default "web" guard for Statamic content/pages protection and out-of-the-box Laravel auth loops to work.

It generally works well, but we wanted to MFA protect the CMS admins, and realised that this plugin (which we successfuly use on other sites) does not work in this setup. Most likely by looking in the source code, due to some guard retrieval just taking Auth->guard() etc, so probably ends up getting "default" vs the "cp" one, which in basic/standard Statamic setup the same thing, but not for us :)

Thank you!

Steps to reproduce

Configure alt auth guard for 'cp'.

users config:

return [

    'repository' => 'file',

    'repositories' => [

        'file' => [
            'driver' => 'file',
            'paths' => [
                'users' => base_path('users'),
                'roles' => resource_path('users/roles.yaml'),
                'groups' => resource_path('users/groups.yaml'),
            ],
        ],

        'eloquent' => [
            'driver' => 'eloquent',
        ],

    ]

    'passwords' => [
        'resets' => 'statamic_resets',
        'activations' => 'statamic_activations',
    ],

    'guards' => [
        'cp' => 'statamic',
        'web' => 'web',
    ],

.....

];

Laravel auth config:

return [

    'defaults' => [
        'guard' => 'web',
        'passwords' => 'portal_users_resets',
    ],


   'guards' => [
        'web' => [
            'driver' => 'session',
            'provider' => 'portal_users',
        ],

        'statamic' => [
            'driver' => 'session',
            'provider' => 'statamic',
        ]
    ],


    'providers' => [
        'portal_users' => [
            'driver' => 'eloquent',
            'model' => App\Models\PortalUser::class,
        ],

        'statamic' => [
            'driver' => 'statamic',
        ],
    ],

    'passwords' => [
        'portal_users_resets' => [
            'provider' => 'portal_users',
            'table' => 'password_reset_tokens',
            'expire' => 60,
            'throttle' => 60,
        ],

        'statamic_resets' => [
            'provider' => 'statamic',
            'table' => 'password_resets',
            'expire' => 60,
            'throttle' => 60,
        ],

        'statamic_activations' => [
            'provider' => 'statamic',
            'table' => 'password_activations',
            'expire' => 4320,
            'throttle' => 60,
        ],
    ],

];

Environment and versions

Environment
Laravel Version: 12.36.1
PHP Version: 8.4.14
Composer Version: 2.8.11
Environment: local
Debug Mode: ENABLED
Maintenance Mode: OFF
Timezone: Pacific/Auckland
Locale: en

Cache
Config: NOT CACHED
Events: NOT CACHED
Routes: NOT CACHED
Views: NOT CACHED

Drivers
Broadcasting: log
Cache: file
Database: mysql
Logs: daily
Mail: ses
Queue: sync
Session: file

Storage
public/storage: NOT LINKED

Sentry
Enabled: MISSING DSN
Environment: local
Laravel SDK Version: 4.18.0
PHP SDK Version: 4.17.1
Release: NOT SET
Sample Rate Errors: 100%
Sample Rate Performance Monitoring: NOT SET
Sample Rate Profiling: NOT SET
Send Default PII: DISABLED

Statamic
Addons: 9
Sites: 2 (New Zealand, Australia)
Stache Watcher: Enabled (auto)
Static Caching: Disabled
Version: 5.67.0 PRO

Statamic Addons
jacksleight/statamic-bard-texstyle: 3.6.0
rias/statamic-color-swatches: 2.3.1
rias/statamic-redirect: 3.12.0
statamic-rad-pack/runway: 8.6.6
statamic/eloquent-driver: 4.34.0
statamic/seo-pro: 6.11.2

Statamic Eloquent Driver
Asset Containers: file
Assets: file
Blueprints: file
Collection Trees: file
Collections: file
Entries: eloquent
Fieldsets: file
Form Submissions: file
Forms: file
Global Sets: file
Global Variables: file
Navigation Trees: file
Navigations: file
Revisions: file
Sites: file
Taxonomies: file
Terms: file
Tokens: file

Additional details

No response

[martyf]

Can look in to this... but first...

Out of curiosity, does impersonating a user in the CP work for you?

Statamic itself just uses guard() - such as in the Impersonate controller - which in your case would return web, no?

I've got a site with DB public users and flat file CP users.

In my env:

AUTH_GUARD=statamic

In my config/auth.php:

    'defaults' => [
        'guard' => env('AUTH_GUARD', 'web'),
        'passwords' => env('AUTH_PASSWORD_BROKER', 'users'),
    ],

I'd be curious to hear if this resolves your issue.

[artemverbo]

Thanks @martyf !

So, imerpsonation of other Statamic admins works yes, but my other users are fully separated and exist as more of a standard Laravel users (db table similarly structured to Laravel default users auth), so I can't impersonate them.

I pretty much have this setup (with some minor changes to how reset tables/loops are called) https://statamic.dev/tips/using-an-independent-authentication-guard

[martyf]

Did tweaking config like above change anything?

I've got a site setup very similar to yours with Two Factor on backend users... the key is setting the default guard - that's the difference between your setup and mine, and I'm wondering if that's the key then.

[artemverbo]

@martyf when I change default guard to statamic, yes the MFA plugin starts working (instead of redirect loop between login -> setup -> login -> setup -> ... etc) it allows me to setup MFA and then use it to log in (for Statamic admins), but that obviously breaks the "non-statamic admins/frontend/app" users login that used web guard (which was default for me and which is the recommended setup here https://statamic.dev/tips/using-an-independent-authentication-guard#non-statamic-routes ).

Logically, I believe it makes sense to any Statamic admin-related auth logic (including this plugin's MFA logic) to specifically use cp guard defined in statamic/users , even Statamic's config comment suggests that? Please correct me if I am wrong.

 /*
    |--------------------------------------------------------------------------
    | Authentication Guards
    |--------------------------------------------------------------------------
    |
    | By default, Statamic will use the `web` authentication guard. However,
    | if you want to run Statamic alongside the default Laravel auth
    | guard, you can configure that for your cp and/or frontend.
    |
    */

    'guards' => [
        'cp' => 'statamic',
        'web' => 'web',
    ],

[martyf]

Sorry for the delay - just catching up after away for a week for Laracon AU - haven't forgotten about this.

[artemverbo]

No worries @martyf , thanks for looking into this overall!