Implement auth0 guard

[Tamrael]

Changes

• new guard driver "auth0" to allow for easy authentication without custom middleware and allow for testing with actingAs
• bind Auth0UserRepository to it's contract on plugin boot to allow for customization from inside laravel apps while using the guard
• guard is inactive as long as the config values are not set to use this guard as driver in laravel auth config. See readme for example on how to set them

References

Implementation through closure request guard

Implemented to fix testing problems mentioned in #161

Testing

• This change has been tested on the latest version Laravel

Checklist

• I have read the Auth0 general contribution guidelines
• I have read the Auth0 Code of Conduct

[joshcanhelp]

@Tamrael - Really appreciate the well-thought-out PR here! A few questions for you:

• Is this primary or only for API authentication or does this handle login as well? I believe it's just the former.
• Should this replace our current guidance (web application login or API protection) on implementing this module or should it exist alongside?
• Is this compatible with Laravel 5.7? Judging by the documentation, it looks like it is but just want to make sure.

[Tamrael]

@joshcanhelp let me try and address your questions to the best of my knowledge

• the guard only replaces the Middleware as the point of authorization for requests with a jwt bearer token. Login/logout still need to be handled as well as any Userprovider changes and such
• I would suggest replacing the part about the middleware with guidance of the guard because it's a lot closer to the laravel way of doing authentication. For the sake of people that already implemented middleware I would leave it in as footnote or alternative way of handling API authentication.
• the guard helper this is using was added in 5.6 and the API never changed, only concerns is the "bearerToken" function that's not well documented. Can't find when this was added atm but I'm almost sure it's a helper that existed a long time.

[joshcanhelp]

@Tamrael - Thanks again!

Let me get this running locally and if everything looks good, we'll get this in.

[Tamrael]

@joshcanhelp just had the time to check. the bearerToken function is part of the "InteractsWithInput" trait and is available since 5.4 so everything about this guard is 5.4 and above. if you need anything else I'd be glad to help.

[joshcanhelp]

@Tamrael - Apologies for the delay here.

I appreciate all your explanation here and can see that this would be useful to add. I pulled the branch down and followed the documentation you added. Everything came together as expected but when I hit the route, I get a redirect to the Auth0 login page. If I understand how this works, it's looking for a JWT in the headers with $request->bearerToken(). Since a user would not explicitly add that to the headers that their browser sends, I assumed that this guard is used on API-type routes where a 302 to a login page would be difficult for the API caller to handle. I would have expected this to fail on the route with a 401 or similar.

Am I misunderstanding how this should be used? I followed your setup instructions with the following in routes/api.php:

Route::middleware('auth:auth0')->get('/auth0-guard', function (Request $request) {
    return $request->user();
});

[Tamrael]

@joshcanhelp sorry didn't think to mention that. the request to the api must expect json as a return or be ajax (not pjax) and accept any content type. the handling for the unauthenticated message is completely done by laravel.
see Exceptions/Handler.php#L216 for the implementation

[joshcanhelp]

@Tamrael - Thank you for the suggestion, that worked as expected.

I'm sorry to keep coming back with questions/changes but I think we should get this in. The next version, however, is a major so this should be merged into that branch. When I switch the branch here to the dev branch 7.0.0-dev, I get a few conflicts. Would you mind switching the base branch and making those changes?

Thank you once again for sticking with this! I'm glad we'll be able to get this in.

[Tamrael]

@joshcanhelp i rebased this onto 7.0. tests ran in laravel 5, 6 and 7. can't tests this further atm but I'm pretty sure this works.

I removed the tests/bootstrap.php because it's not needed when setting the ini in the phpunit.xml, hope you don't mind.
Had to fix the function declarations for the setUp of the tests because phpunit > 7 was required for laravel 7 compatibility

[joshcanhelp]

@Tamrael - We appreciate your work on this! Thanks for the great communication as well!