class ApiAuthenticate
{
- use ChecksForEmailConfirmation;
-
/**
* Handle an incoming request.
*/
// Return if the user is already found to be signed in via session-based auth.
// This is to make it easy to browser the API via browser after just logging into the system.
if (signedInUser() || session()->isStarted()) {
- $this->ensureEmailConfirmedIfRequested();
- if (!user()->can('access-api')) {
+ if (!$this->sessionUserHasApiAccess()) {
throw new ApiAuthException(trans('errors.api_user_no_api_permission'), 403);
}
// Validate the token and it's users API access
auth()->authenticate();
- $this->ensureEmailConfirmedIfRequested();
+ }
+
+ /**
+ * Check if the active session user has API access.
+ */
+ protected function sessionUserHasApiAccess(): bool
+ {
+ $hasApiPermission = user()->can('access-api');
+
+ return $hasApiPermission && hasAppAccess();
}
/**