Laravel Sentinel – Analyse der Route-Schutz-Middleware

// Bisheriges Verfahren (etwa im TelescopeServiceProvider)
Gate::before(function ($user) {
    return $user->isAdmin() ? true : null;
});

composer require laravel/sentinel

// src/Drivers/Laravel.php
public function authorize(Request $request): bool
{
    if (! $this->app()->environment('local')) {
        return true; // Außerhalb von local immer erlauben
    }

    // Warnung bei Zugriff über Tunnel-Dienste
    if ($this->isPrivateIp($request->ip())
        && ! $request->isFromTrustedProxy()
        && Str::endsWith($request->host(), ['.sharedwithexpose.com', '.ngrok-free.app', '.ngrok.io'])) {
        throw new RuntimeException(
            'Unable to access "..." using "local" environment, ...'
        );
    }

    // Docker-Lokalumgebung erlauben
    if ($this->isRunningOnDockerLocally($request)) {
        return true;
    }

    // Zugriff über Reverse-Proxies prüfen
    return $this->authorizeAccessingViaReverseProxies($request);
}

// src/Drivers/Driver.php
protected function isRunningOnDockerLocally(Request $request): bool
{
    return $request->server->get('REMOTE_ADDR') === '127.0.0.1'
        && file_exists(base_path('.dockerenv'));
}

use Laravel\Sentinel\Http\Middleware\SentinelMiddleware;

Route::middleware(SentinelMiddleware::class)->group(function () {
    Route::get('/telescope', function () { /* ... */ });
    Route::get('/horizon', function () { /* ... */ });
    Route::get('/pulse', function () { /* ... */ });
});

Route::middleware([SentinelMiddleware::class . ':custom-driver'])->group(function () {
    // Autorisierung durch benutzerdefinierten Treiber
});

// src/Http/Middleware/SentinelMiddleware.php
public function handle(Request $request, Closure $next, ?string $driver = null)
{
    abort_unless(Sentinel::driverOrFallback($driver)->authorize($request), 401);

    return $next($request);
}

use Laravel\Sentinel\Sentinel;
use Laravel\Sentinel\Drivers\Driver;
use Illuminate\Http\Request;

Sentinel::extend('admin-only', function ($app) {
    return new class extends Driver {
        public function authorize(Request $request): bool
        {
            // Nur authentifizierte Nutzer mit admin-Rolle erlauben
            $user = $request->user();

            return $user !== null && $user->hasRole('admin');
        }
    };
});

public function authorize(Request $request): bool
{
    // In der Produktion nur private IPs erlauben
    if ($this->app()->environment('production')) {
        return $this->isPrivateIp($request->ip());
    }

    // Lokal nur Docker oder Direktzugriff erlauben
    return $this->isRunningOnDockerLocally($request)
        || $this->authorizeAccessingViaReverseProxies($request);
}

// src/SentinelManager.php
class SentinelManager extends Manager
{
    protected function createLaravelDriver()
    {
        return new Laravel(fn () => $this->getContainer());
    }

    public function getDefaultDriver()
    {
        return 'laravel';
    }

    public function driverOrFallback(?string $driver)
    {
        return rescue(
            fn () => $this->driver($driver),
            value(fn () => $this->driver()),
            false  // nicht loggen
        );
    }
}

// src/SentinelServiceProvider.php
public function register(): void
{
    $this->app->scoped(SentinelManager::class, fn ($app) => new SentinelManager($app));
}