Allow guests to join presence channels

So I have this use case that I have a simple collaborative code editor. The route contains an identifier/secret as a parameter so that visitors can only open the page when they know the URL. For example:

example.com/code/ba6d98ab76n87hs6

To visit the page however it is not necessary to be authenticated (guests should be allowed to visit the page as well). Now I want to have a presence channel so I can see every connection (user) on that page. Unfortunately presence channels always check if the user is authenticated. Meaning a guest can visit the page, but cannot join the presence channel.

// \Illuminate\Broadcasting\Broadcasters\Broadcaster.php
public function auth($request)
{
    $channelName = $this->normalizeChannelName($request->channel_name);

    if (empty($request->channel_name) ||
        ($this->isGuardedChannel($request->channel_name) &&
        ! $this->retrieveUser($request, $channelName))) {
        throw new AccessDeniedHttpException;
    }

    return parent::verifyUserCanAccessChannel(
        $request, $channelName
    );
}

The retrieveUser method tries to get the user by using the normal Laravel guards behavior.

Now the actual question: Is there any elegant laravely way to allow guest to join a presence channel? The authorization callback (Broadcast::channel(...)) is being checked after the guard authentication logic, so this doesn't help. The only way I can think of is to overwrite the /broadcasting/auth-Route and add my own logic. But I actually wouldn't want to do that since there is a lot of channel name validation and other stuff being done and I would have to basically copy it all.

There must be a way for public presence channels, right?

Thanks in advance.

dennisprudlo

1 year ago

Best Answer

Level 7

Ok I think I got it.

I found the following article: https://glueck.dev/blog/allowing-guests-to-join-laravel-echo-presence-channels-using-laravel-11

didn't work like that, since the Auth::hasUser() always said that there is no user, even if I was authenticated. But I got it working like so:

// channels.php
Broadcast::routes([
    'middleware' => ['web', AuthenticateBroadcastGuests::class],
]);

// AuthenticateBroadcastGuests.php
public function handle(Request $request, Closure $next): Response
{
    if (Auth::guard('web')->check()) {
        return $next($request);
    }

    Auth::login(Account::make([
        'id' => (int) str_replace('.', '', microtime(true)),
        'uid' => (string) Str::ulid(),
    ]));

    return $next($request);
}

And thats it (Well, there were some dependencies in my account model I had to add fallbacks to). Non-authenticated visitors now get a virtual account I can use in the authentication callbacks.

Easier than I initially thought but it would still be great if there was guest-presence support included.

1 like

Please or to participate in this conversation.