AuthorizationController gets TokenGuard instead of StatefulGuard

[pontoffeltier]

• Passport Version: 11.3.0
• Laravel Version: 9.42.2
• PHP Version: 8.1.13
• Database Driver & Version: mysql 8.0.30

Description:

I followed the documentation for Passport to implement "Authorization Code Grant with PKCE". When I am trying to send a GET request to /oauth/authorize, I get the following error message:

Laravel\\Passport\\Http\\Controllers\\AuthorizationController::__construct(): Argument #3 ($guard) must be of type Illuminate\\Contracts\\Auth\\StatefulGuard, Laravel\\Passport\\Guards\\TokenGuard given

What I found in the source code was, that with the PR 1577 the Laravel\\Passport\\Http\\Controllers\\AuthorizationController now has a third parameter with the type of Illuminate\\Contracts\\Auth\\StatefulGuard. The problem is, the only guard in this package (which is bound in the Laravel\Passport\PassportServiceProvider) is the TokenGuard - which does not implement the StatefulGuard interface.

I totally expect that I am missing something important here, but for now I think this is a bug.

Steps To Reproduce:

As stated in the documentation:

• Install laravel/passport
• In config/app.php set guards.api.driver to passport

   'guards' => [
        'web' => [
            'driver' => 'session',
            'provider' => 'users',
        ],
        'api' => [
            'driver' => 'passport',
            'provider' => 'users',
        ],
    ],

• Create a client: php artisan passport:client --public with ID set to 1 and default values for name and redirect
• Make a GET request (I used postman) to /oauth/authorize - I tested with and without the query parameters, both give the same error response

[driesvints]

@hafezdivandari can you weigh in here?

[hafezdivandari]

@pontoffeltier I guess your default guard (the auth.defaults.guard config value) is not web right?
Would you please add 'guard' => 'web' to config/passport.php configuration file and try again?

[pontoffeltier]

@pontoffeltier I guess your default guard (the auth.defaults.guard config value) is not web right? Would you please add 'guard' => 'web' to config/passport.php configuration file and try again?

Thanks, that was it. So sorry for the confusion, my config/passport.php did not contain any guard value so I simply overlooked it. Should'nt there be a default value?

[hafezdivandari]

@pontoffeltier I sent a PR for that: #1603

[jlambe]

@driesvints @hafezdivandari We installed the package on a project and we're facing the same issue. There is a mistake either in source code or either in the official documentation of Laravel Passport which leads to some confusion here.

For example, the official documentation says the following:

Finally, in your application's config/auth.php configuration file, you should define an api authentication guard and set the driver option to passport. This will instruct your application to use Passport's TokenGuard when authenticating incoming API requests:

'guards' => [
    'web' => [
        'driver' => 'session',
        'provider' => 'users',
    ],
 
    'api' => [
        'driver' => 'passport',
        'provider' => 'users',
    ],
],

But as mentionned in the original comment, the AuthorizationController as a type of StatefulGuard while the TokenGuard class is only implementing the Guard class.

The solution mentioned from @hafezdivandari is to use the default web guard... which works because it returns a StatefulGuard instance...

So the question is why bother having a TokenGuard under the passport guard key and explicitly tell the users to do so if the solution is to keep the default web guard. If the TokenGuard class is supposed to be used, then it is broken because it does not implement the right interface or it's the AuthorizationController that should require a Guard instance as a dependency instead of the StatefulGuard one.

Currently the TokenGuard class seems to be pointless in the package. Of course it works to use the web guard but something is misleading the users here.

Do you think you can share more feedback on this issue please ?

Thanks

[hafezdivandari]

@jlambe Your app uses Passport driver for its api guard (uses TokenGuard) and Passport uses web guard to authorize the user (needs a StatefulGuard). So by default:

• config/passport.php config file contains 'guard' => 'web'

  passport/config/passport.php

  Lines 5 to 16 in b33fa25

  	/*
  	|--------------------------------------------------------------------------
  	| Passport Guard
  	|--------------------------------------------------------------------------
  	|
  	| Here you may specify which authentication guard Passport will use when
  	| authenticating users. This value should correspond with one of your
  	| guards that is already present in your "auth" configuration file.
  	|
  	*/
  	'guard' => 'web',

• config/auth.php config file contains

  'guards' => [
      'web' => [
          'driver' => 'session',
          'provider' => 'users',
      ],
      'api' => [
          'driver' => 'passport',
          'provider' => 'users',
      ],
  ],

You shouldn't face any issue with a fresh install and following the instruction of the official docs.

[jlambe]

@hafezdivandari In our implementation, I had to provide a custom guard called oauth because the api one is already using a token driver for a third-party package.

So the docs got me confused a bit here, but thanks to your message, it strikes to me that the passport configuration guard is for "users" requests only. So when a client is trying to access a resource from our server with an access token, we must declare the endpoints to use the auth middleware with our custom guard that uses the passport driver, am I correct ?

This means that resources that require an access token must be declared like so for example:

// Based on our custom guard...
Route::get('endpoint', function () {
    // return json
})->middleware('auth:oauth');

Let me know if I'm not correct! Thanks for your feedback.