Login ผ่าน LINE LIFF ใน Laravel ยังไงให้ปลอดภัย และผูกกับบัญชีลูกค้าในระบบ

<?php

namespace App\Services;

use Illuminate\Support\Facades\Http;

class LineLogin
{
    /**
     * @return array{userId: string, displayName: string, pictureUrl: ?string}|null
     */
    public function profile(string $accessToken): ?array
    {
        if (! $this->issuedForThisChannel($accessToken)) {
            return null;
        }

        $response = Http::timeout(10)
            ->withToken($accessToken)
            ->get('https://api.line.me/v2/profile');

        if (! $response->successful() || blank($response->json('userId'))) {
            return null;
        }

        return [
            'userId' => (string) $response->json('userId'),
            'displayName' => (string) $response->json('displayName'),
            'pictureUrl' => $response->json('pictureUrl'),
        ];
    }

    private function issuedForThisChannel(string $accessToken): bool
    {
        $channelId = (string) config('services.line.channel_id');

        if ($channelId === '') {
            return false;
        }

        $response = Http::timeout(10)
            ->get('https://api.line.me/oauth2/v2.1/verify', ['access_token' => $accessToken]);

        return $response->successful()
            && (string) $response->json('client_id') === $channelId
            && (int) $response->json('expires_in') > 0;
    }
}

'line' => [
    'liff_id' => env('LIFF_ID'),
    'channel_id' => env('LIFF_CHANNEL_ID'),
],

import liff from '@line/liff'

const liffId = document.querySelector('meta[name=liff-id]').content
const csrfToken = document.querySelector('meta[name=csrf-token]').content

await liff.init({ liffId, withLoginOnExternalBrowser: true })

const response = await fetch('/liff/verify-token', {
    method: 'POST',
    headers: {
        'Content-Type': 'application/json',
        'Accept': 'application/json',
        'X-CSRF-TOKEN': csrfToken,
    },
    body: JSON.stringify({ access_token: liff.getAccessToken() }),
})

if (!response.ok) {
    throw new Error(`เข้าสู่ระบบด้วย LINE ไม่สำเร็จ (${response.status})`)
}

const { registered } = await response.json()

window.location.replace(registered ? '/liff/account' : '/liff/register')

'guards' => [
    'web' => [
        'driver' => 'session',
        'provider' => 'users',
    ],
    'line' => [
        'driver' => 'session',
        'provider' => 'line-users',
    ],
],

'providers' => [
    'users' => [
        'driver' => 'eloquent',
        'model' => App\Models\User::class,
    ],
    'line-users' => [
        'driver' => 'eloquent',
        'model' => App\Models\LineUser::class,
    ],
],

use Illuminate\Foundation\Auth\User as Authenticatable;

class LineUser extends Authenticatable
{
    public function customer(): BelongsTo
    {
        return $this->belongsTo(Customer::class);
    }
}

public function verifyToken(VerifyLineTokenRequest $request, LineLogin $lineLogin): JsonResponse
{
    $profile = $lineLogin->profile($request->accessToken());

    abort_if($profile === null, 401);

    $user = LineUser::query()->updateOrCreate(
        ['line_internal_id' => $profile['userId']],
        ['line_id' => $profile['displayName'], 'avatar' => $profile['pictureUrl']],
    );

    Auth::guard('line')->login($user);
    $request->session()->regenerate();

    return response()->json(['registered' => $user->customer_id !== null]);
}

Route::post('/liff/verify-token', [LiffController::class, 'verifyToken'])
    ->middleware('throttle:liff-login')
    ->name('liff.verify-token');

Route::middleware('auth:line')->group(function () {
    // หน้าของลูกค้า
});

RateLimiter::for('liff-login', fn (Request $request) => Limit::perMinute(30)->by($request->ip()));

->withMiddleware(function (Middleware $middleware): void {
    $middleware->redirectGuestsTo(fn (Request $request) => $request->is('liff/*')
        ? route('liff.index')
        : route('login'));
})

public function hasLineAvatar(): bool
{
    return is_string($this->avatar)
        && parse_url($this->avatar, PHP_URL_SCHEME) === 'https'
        && parse_url($this->avatar, PHP_URL_HOST) === 'profile.line-scdn.net';
}

public function handle(Request $request, Closure $next): Response
{
    if ($request->user('line')->customer_id === null) {
        return redirect()->route('liff.register');
    }

    return $next($request);
}

public function __invoke(Customer $customer): string
{
    $code = (string) random_int(100000, 999999);

    Cache::put("line-link:{$customer->id}", Hash::make($code), now()->addMinutes(15));

    return $code;
}

public function store(LinkLineRequest $request): RedirectResponse
{
    $customer = Customer::query()->where('tel', $request->phone())->first();
    $hash = $customer ? Cache::get("line-link:{$customer->id}") : null;

    if ($hash === null || ! Hash::check($request->code(), $hash)) {
        return back()->withErrors(['code' => 'เบอร์โทรหรือรหัสไม่ถูกต้อง']);
    }

    if ($customer->line()->exists()) {
        return back()->withErrors(['phone' => 'บัญชีนี้ผูกกับ LINE อื่นอยู่แล้ว ติดต่อร้านเพื่อยกเลิกก่อน']);
    }

    Cache::forget("line-link:{$customer->id}");
    $request->user('line')->update(['customer_id' => $customer->id]);

    return to_route('liff.account');
}

Route::middleware('auth:line')->group(function () {
    Route::get('/liff/register', [RegisterController::class, 'index'])->name('liff.register');
    Route::post('/liff/register', [RegisterController::class, 'store'])
        ->middleware('throttle:liff-register')
        ->name('liff.register.store');

    Route::middleware(EnsureLineLinked::class)->group(function () {
        Route::get('/liff/account', [AccountController::class, 'index'])->name('liff.account');
    });
});

RateLimiter::for('liff-register', fn (Request $request) => Limit::perMinute(5)->by($request->user('line')->id));

public function impersonate(Customer $customer): RedirectResponse
{
    Gate::authorize('impersonate', $customer);

    abort_if($customer->line === null, 404);

    Auth::guard('line')->login($customer->line);

    return to_route('liff.account');
}

Route::get('/liff/admin/{customer}/impersonate', [LiffController::class, 'impersonate'])
    ->middleware('auth')
    ->name('liff.admin.impersonate');

use App\Models\LineUser;
use Illuminate\Support\Facades\Http;

beforeEach(function () {
    config(['services.line.channel_id' => '1650000000']);
    Http::preventStrayRequests();
});

test('logs in the user LINE vouches for, ignoring identity in the body', function () {
    Http::fake([
        'api.line.me/oauth2/v2.1/verify*' => Http::response(['client_id' => '1650000000', 'expires_in' => 2591659]),
        'api.line.me/v2/profile' => Http::response(['userId' => 'U0001', 'displayName' => 'ลูกค้า ก']),
    ]);

    $this->postJson(route('liff.verify-token'), [
        'access_token' => 'valid-token',
        'userId' => 'U9999',
    ])->assertOk();

    $this->assertAuthenticatedAs(LineUser::query()->where('line_internal_id', 'U0001')->sole(), 'line');
});

test('a token issued to another channel does not log in', function () {
    Http::fake([
        'api.line.me/oauth2/v2.1/verify*' => Http::response(['client_id' => '1999999999', 'expires_in' => 100]),
    ]);

    $this->postJson(route('liff.verify-token'), ['access_token' => 'foreign-token'])
        ->assertUnauthorized();

    $this->assertGuest('line');
});