├── .idea
├── .gitignore
├── misc.xml
├── modules.xml
└── php.xml
├── .phpunit.result.cache
├── .styleci.yml
├── CHANGELOG.md
├── CONTRIBUTING.md
├── LICENSE.md
├── README.md
├── composer.json
├── config
└── passwordHistory.php
├── database
└── migrations
│ └── 2019_12_02_141717_create_password_history_table.php
├── phpunit.xml
└── src
├── Console
└── ClearOldPasswordHistory.php
├── LaravelPasswordHistoryValidationServiceProvider.php
├── Models
├── PasswordHistory.php
└── PasswordHistoryRepo.php
├── Observers
└── UserObserver.php
├── Rules
└── NotFromPasswordHistory.php
└── Traits
└── PasswordHistoryTrait.php
/.idea/.gitignore:
--------------------------------------------------------------------------------
1 | # Default ignored files
2 | /workspace.xml
--------------------------------------------------------------------------------
/.idea/misc.xml:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 |
6 |
7 |
--------------------------------------------------------------------------------
/.idea/modules.xml:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 |
6 |
7 |
8 |
--------------------------------------------------------------------------------
/.idea/php.xml:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 |
6 |
7 |
8 |
9 |
10 |
11 |
12 |
13 |
14 |
15 |
16 |
17 |
18 |
19 |
20 |
21 |
22 |
23 |
24 |
25 |
26 |
27 |
28 |
29 |
30 |
31 |
32 |
33 |
34 |
35 |
36 |
37 |
38 |
39 |
40 |
41 |
42 |
43 |
44 |
45 |
46 |
47 |
48 |
49 |
50 |
51 |
52 |
53 |
54 |
55 |
56 |
57 |
58 |
59 |
60 |
61 |
62 |
63 |
64 |
65 |
66 |
67 |
68 |
69 |
70 |
71 |
72 |
73 |
74 |
75 |
76 |
77 |
78 |
79 |
80 |
81 |
82 |
83 |
84 |
85 |
86 |
87 |
88 |
89 |
90 |
91 |
92 |
93 |
94 |
95 |
96 |
97 |
98 |
99 |
100 |
101 |
102 |
103 |
104 |
--------------------------------------------------------------------------------
/.phpunit.result.cache:
--------------------------------------------------------------------------------
1 | C:37:"PHPUnit\Runner\DefaultTestResultCache":226:{a:2:{s:7:"defects";a:1:{s:77:"Infinitypaul\LaravelPasswordHistoryValidation\Tests\ExampleTest::true_is_true";i:4;}s:5:"times";a:1:{s:77:"Infinitypaul\LaravelPasswordHistoryValidation\Tests\ExampleTest::true_is_true";d:0.172;}}}
--------------------------------------------------------------------------------
/.styleci.yml:
--------------------------------------------------------------------------------
1 | preset: laravel
2 |
3 | disabled:
4 | - single_class_element_per_statement
5 |
--------------------------------------------------------------------------------
/CHANGELOG.md:
--------------------------------------------------------------------------------
1 | # Changelog
2 |
3 | All notable changes to `laravel-password-history-validation` will be documented in this file
4 |
5 | ## 1.0.0 - 201X-XX-XX
6 |
7 | - initial release
8 |
--------------------------------------------------------------------------------
/CONTRIBUTING.md:
--------------------------------------------------------------------------------
1 | # Contributing
2 |
3 | Contributions are **welcome** and will be fully **credited**.
4 |
5 | Please read and understand the contribution guide before creating an issue or pull request.
6 |
7 | ## Etiquette
8 |
9 | This project is open source, and as such, the maintainers give their free time to build and maintain the source code
10 | held within. They make the code freely available in the hope that it will be of use to other developers. It would be
11 | extremely unfair for them to suffer abuse or anger for their hard work.
12 |
13 | Please be considerate towards maintainers when raising issues or presenting pull requests. Let's show the
14 | world that developers are civilized and selfless people.
15 |
16 | It's the duty of the maintainer to ensure that all submissions to the project are of sufficient
17 | quality to benefit the project. Many developers have different skillsets, strengths, and weaknesses. Respect the maintainer's decision, and do not be upset or abusive if your submission is not used.
18 |
19 | ## Viability
20 |
21 | When requesting or submitting new features, first consider whether it might be useful to others. Open
22 | source projects are used by many developers, who may have entirely different needs to your own. Think about
23 | whether or not your feature is likely to be used by other users of the project.
24 |
25 | ## Procedure
26 |
27 | Before filing an issue:
28 |
29 | - Attempt to replicate the problem, to ensure that it wasn't a coincidental incident.
30 | - Check to make sure your feature suggestion isn't already present within the project.
31 | - Check the pull requests tab to ensure that the bug doesn't have a fix in progress.
32 | - Check the pull requests tab to ensure that the feature isn't already in progress.
33 |
34 | Before submitting a pull request:
35 |
36 | - Check the codebase to ensure that your feature doesn't already exist.
37 | - Check the pull requests to ensure that another person hasn't already submitted the feature or fix.
38 |
39 | ## Requirements
40 |
41 | If the project maintainer has any additional requirements, you will find them listed here.
42 |
43 | - **[PSR-2 Coding Standard](https://github.com/php-fig/fig-standards/blob/master/accepted/PSR-2-coding-style-guide.md)** - The easiest way to apply the conventions is to install [PHP Code Sniffer](https://pear.php.net/package/PHP_CodeSniffer).
44 |
45 | - **Add tests!** - Your patch won't be accepted if it doesn't have tests.
46 |
47 | - **Document any change in behaviour** - Make sure the `README.md` and any other relevant documentation are kept up-to-date.
48 |
49 | - **Consider our release cycle** - We try to follow [SemVer v2.0.0](https://semver.org/). Randomly breaking public APIs is not an option.
50 |
51 | - **One pull request per feature** - If you want to do more than one thing, send multiple pull requests.
52 |
53 | - **Send coherent history** - Make sure each individual commit in your pull request is meaningful. If you had to make multiple intermediate commits while developing, please [squash them](https://www.git-scm.com/book/en/v2/Git-Tools-Rewriting-History#Changing-Multiple-Commit-Messages) before submitting.
54 |
55 | **Happy coding**!
56 |
--------------------------------------------------------------------------------
/LICENSE.md:
--------------------------------------------------------------------------------
1 | MIT License
2 |
3 | Copyright (c) Edward Paul
4 |
5 | Permission is hereby granted, free of charge, to any person obtaining a copy
6 | of this software and associated documentation files (the "Software"), to deal
7 | in the Software without restriction, including without limitation the rights
8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9 | copies of the Software, and to permit persons to whom the Software is
10 | furnished to do so, subject to the following conditions:
11 |
12 | The above copyright notice and this permission notice shall be included in all
13 | copies or substantial portions of the Software.
14 |
15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21 | SOFTWARE.
--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
1 | # Laravel Password History Validation
2 |
3 | [](https://packagist.org/packages/infinitypaul/laravel-password-history-validation)
4 | [](https://travis-ci.org/infinitypaul/laravel-password-history-validation)
5 | [](https://scrutinizer-ci.com/g/infinitypaul/laravel-password-history-validation)
6 | [](https://packagist.org/packages/infinitypaul/laravel-password-history-validation)
7 |
8 | Prevent users from reusing recently used passwords.
9 |
10 | ## Installation
11 |
12 | You can install the package via composer:
13 |
14 | ```bash
15 | composer require infinitypaul/laravel-password-history-validation
16 | ```
17 |
18 | ## Configuration
19 |
20 | To get started, you'll need to publish the config file, and migrate the database:
21 |
22 | ```bash
23 | php artisan vendor:publish --tag=password-config
24 | ```
25 | Modify the config file according to your project, then migrate the database
26 |
27 | ```bash
28 | php artisan migrate
29 | ```
30 |
31 | ## Usage
32 | This package will observe the created and updated event of the models (check the config file for settings) and records the password hashes automatically.
33 |
34 | In Your Form Request or Inline Validation, All You Need To Do Is Instantiate The `NotFromPasswordHistory` class passing the current user as an argument
35 | ``` php
36 | validate($request, [
40 | 'password' => [
41 | 'required',
42 | new NotFromPasswordHistory($request->user())
43 | ]
44 | ]);
45 | ```
46 |
47 | ### Cleaning Up Old Record - (Optional)
48 |
49 | Because We Are Storing The Hashed Password In Your Database, Your Database Can Get Long When You Have Lots Of Users
50 |
51 | Add PasswordHistoryTrait To Your User Model
52 | ``` php
53 | 'password_histories',
9 |
10 | /**
11 | * The shows the number of password you want to keep and check for the current user.
12 | */
13 | 'keep' => 2,
14 |
15 | /**
16 | * The models to be observed on and your password column name.
17 | */
18 | 'observe' => [
19 | 'model' => \App\Models\User::class,
20 | 'column' => 'password',
21 | ],
22 |
23 | //Supported: "integer", "uuid"
24 | 'primary_id_type' => 'integer',
25 | ];
26 |
--------------------------------------------------------------------------------
/database/migrations/2019_12_02_141717_create_password_history_table.php:
--------------------------------------------------------------------------------
1 | bigIncrements('id');
20 | $table->unsignedBigInteger('user_id');
21 | } elseif ($primaryIdType === 'uuid') {
22 | $table->uuid('id');
23 | $table->uuid('user_id');
24 | }
25 |
26 | $table->string('password');
27 | $table->timestamps();
28 | });
29 | }
30 |
31 | /**
32 | * Reverse the migrations.
33 | *
34 | * @return void
35 | */
36 | public function down()
37 | {
38 | Schema::dropIfExists(config('password-history.table'));
39 | }
40 | }
41 |
--------------------------------------------------------------------------------
/phpunit.xml:
--------------------------------------------------------------------------------
1 |
2 |
12 |
13 |
14 | tests
15 |
16 |
17 |
18 |
19 | src/
20 |
21 |
22 |
23 |
24 |
25 |
26 |
27 |
28 |
29 |
30 |
--------------------------------------------------------------------------------
/src/Console/ClearOldPasswordHistory.php:
--------------------------------------------------------------------------------
1 | info('Getting Users...');
41 | $model = config('password-history.observe.model');
42 | if (class_exists($model)) {
43 | $model::chunk(100, function ($users) {
44 | $users->each->deletePasswordHistory();
45 | });
46 | }
47 | $this->info('Old Password Cleared...');
48 | }
49 | }
50 |
--------------------------------------------------------------------------------
/src/LaravelPasswordHistoryValidationServiceProvider.php:
--------------------------------------------------------------------------------
1 | app->runningInConsole()) {
17 | $this->publishes([
18 | __DIR__.'/../config/passwordHistory.php' => config_path('password-history.php'),
19 | ], 'password-config');
20 |
21 | $this->publishes([
22 | __DIR__.'/../database/migrations/2019_12_02_141717_create_password_history_table.php' => database_path('migrations/'.date('Y_m_d_His').'_create_password_history_table.php'),
23 | ], 'password-migrations');
24 |
25 | // Registering package commands.
26 | $this->commands([
27 | ClearOldPasswordHistory::class,
28 | ]);
29 | }
30 |
31 | $publishedMigration = glob(database_path('migrations/*_create_password_history_table.php'));
32 | if (empty($publishedMigration)) {
33 | // Automatically load migrations only if they have not been published
34 | $this->loadMigrationsFrom(__DIR__.'/../database/migrations');
35 | }
36 |
37 | $model = config('password-history.observe.model');
38 | class_exists($model) ? $model::observe(UserObserver::class) : null;
39 | }
40 |
41 | /**
42 | * Register the application services.
43 | */
44 | public function register()
45 | {
46 | // Automatically apply the package configuration
47 | $this->mergeConfigFrom(__DIR__.'/../config/passwordHistory.php', 'password-history');
48 | }
49 | }
50 |
--------------------------------------------------------------------------------
/src/Models/PasswordHistory.php:
--------------------------------------------------------------------------------
1 | table = config('password-history.table');
17 | parent::__construct($attributes);
18 | }
19 |
20 | protected $fillable = ['user_id', 'password'];
21 | }
22 |
--------------------------------------------------------------------------------
/src/Models/PasswordHistoryRepo.php:
--------------------------------------------------------------------------------
1 | id)->latest()->take($checkPrevious)->get();
24 | }
25 | }
26 |
--------------------------------------------------------------------------------
/src/Observers/UserObserver.php:
--------------------------------------------------------------------------------
1 | getChanges(), $configPasswordColumn)) {
14 | PasswordHistoryRepo::storeCurrentPasswordInHistory($password, $user->id);
15 | }
16 | }
17 |
18 | public function created($user)
19 | {
20 | $password = config('password-history.observe.column') ?? 'password';
21 | PasswordHistoryRepo::storeCurrentPasswordInHistory($user->{$password}, $user->id);
22 | }
23 | }
24 |
--------------------------------------------------------------------------------
/src/Rules/NotFromPasswordHistory.php:
--------------------------------------------------------------------------------
1 | user = $user;
22 | $this->checkPrevious = config('password-history.keep');
23 | }
24 |
25 | /**
26 | * {@inheritdoc}
27 | */
28 | public function passes($attribute, $value)
29 | {
30 | $passwordHistories = PasswordHistoryRepo::fetchUser($this->user, $this->checkPrevious);
31 | foreach ($passwordHistories as $passwordHistory) {
32 | if (Hash::check($value, $passwordHistory->password)) {
33 | return false;
34 | }
35 | }
36 |
37 | return true;
38 | }
39 |
40 | /**
41 | * {@inheritdoc}
42 | */
43 | public function message()
44 | {
45 | return __('auth.password_history') == 'auth.password_history' ? 'The Password Has Been Used' : __('auth.password_history');
46 | }
47 | }
48 |
--------------------------------------------------------------------------------
/src/Traits/PasswordHistoryTrait.php:
--------------------------------------------------------------------------------
1 | hasMany(PasswordHistory::class)
15 | ->latest();
16 | }
17 |
18 | public function deletePasswordHistory()
19 | {
20 | $keep = config('password-history.keep');
21 | $ids = $this->passwordHistory()
22 | ->pluck('id')
23 | ->sort()
24 | ->reverse();
25 |
26 | if ($ids->count() < $keep) {
27 | return;
28 | }
29 |
30 | $delete = $ids->splice($keep);
31 |
32 | $this->passwordHistory()
33 | ->whereIn('id', $delete)
34 | ->delete();
35 | }
36 | }
37 |
--------------------------------------------------------------------------------