respectively custom session guard

[taxusorg]

When multiple guard users use the sanctum driver, there is a problem that session users are confused.

Example:

config/auth.php

'guards' => [
        'web' => [
            'driver' => 'session',
            'provider' => 'users',
        ],
        'api' => [
            'driver' => 'sanctum',
            'provider' => 'users',
        ],
        'admin' => [
            'driver' => 'session',
            'provider' => 'admins',
        ],
        'admin-api' => [
            'driver' => 'sanctum',
            'provider' => 'admins',
        ],
    ],

config/sanctum.php

'guard' => [
        'web',
        'admin',
    ],

Now login admin guard user, and print all guard user

routes/api.php

Route::get('user', function () {
    $webUser = auth('web')->user();
    $webApiUser = auth('api')->user();
    $adminUser = auth('admin')->user();
    $adminApiUser = auth('admin-api')->user();
    dd(
        'web: ' . ($webUser ? $webUser::class . "[{$webUser['id']}]" : null),
        'api: ' . ($webApiUser ? $webApiUser::class . "[{$webApiUser['id']}]" : null),
        'admin: ' . ($adminUser ? $adminUser::class . "[{$adminUser['id']}]" : null),
        'admin-api: ' . ($adminApiUser ? $adminApiUser::class . "[{$adminApiUser['id']}]" : null),
    );
});

result: api guard return admin user

"web: " // routes\api.php:10
"api: App\Models\Admin[1]" // routes\api.php:10
"admin: App\Models\Admin[1]" // routes\api.php:10
"admin-api: App\Models\Admin[1]" // routes\api.php:10

For this we need to check the type of user or add middleware to fix the problem, but this is not a good idea.

New auth config like:

'guards' => [
        'web' => [
            'driver' => 'session',
            'provider' => 'users',
        ],
        'api' => [
            'driver' => 'sanctum',
            'with_guard' => 'web',
            'provider' => 'users',
        ],
        'admin' => [
            'driver' => 'session',
            'provider' => 'admins',
        ],
        'admin-api' => [
            'driver' => 'sanctum',
            'with_guard' => ['admin'],
            'provider' => 'admins',
        ],
    ],

sanctum driver need to know which guard can be scanned, private, not global.

If there no with_guard field or with_guard is null, driver will use old rules.

[taylorotwell]

Thanks for your pull request to Laravel!

Unfortunately, I'm going to delay merging this code for now. To preserve our ability to adequately maintain the framework, we need to be very careful regarding the amount of code we include.

If applicable, please consider releasing your code as a package so that the community can still take advantage of your contributions!