Download the PHP package kakaprodo/presigned-action without Composer

Presigned Action

Presigned Action is a Laravel package for securely authorizing actions on an Eloquent model without requiring the requesting person or service to have a local user account.

It is useful when one service authenticates a user and another service owns the resource being accessed.

Installation

The package registers its service provider through Laravel package discovery. By default, its migrations are loaded automatically. Publish the configuration with:

Generate an access key

Use the facade with an accessible Eloquent model:

The generation options are:

The public response contains an encrypted key and its expiration timestamp:

Key reuse and renewal

When generating a key, the package looks for an existing non-expired key with the same accessible model, whoami, and origin. It reuses that key only when its scopes and permissions also match.

• An unexpired key with matching values is returned unchanged.
• An expired key is ignored; a new key is created.
• A key with different scopes, permissions, or origin produces a new record.

Scopes and permissions are treated as unordered values when comparing keys.

Validate incoming requests

Apply VerifyAccessKeyMiddleware to routes that require a valid access key:

The middleware expects these headers by default:

The verified model is available from the facade or the request:

Configure different header names in config/presigned-action.php under access_key_validation.

Scopes and permissions

Use PresignedActionScopeMiddleware to require one or more scopes. Scope arguments may be comma- or pipe-separated:

The middleware allows the request when at least one requested scope is granted. The access key model also provides helpers for application-level checks:

Register the middleware aliases in your application's HTTP kernel:

Then require an origin or permission on a route:

Artisan command

Generate a key interactively with:

Remove expired keys with:

Custom validators

Validators can be registered from any service provider and are called with the current temporary access key as their first argument:

You can call a given validator using the check method:

If a validator returns false, check() throws a PresignedActionException with Permission denied by default. Pass a third argument to customize the error message:

Configuration

key_expires_after is expressed in minutes. The database migration creates the temporary_access_keys table with nullable JSON permissions and nullable string origin columns.

Why Presigned Action?

In a microservice architecture, a user may be authenticated and authorized by a core service while the entity they need to access belongs to another service. Presigned Action provides controlled cross-service access without duplicating users, roles, or permissions across services.

Official documentation on Yupidoc