Merge pull request #3694 from devansh-webkul/api_current_user_issue

Fixed auth user can see all users info by id #3657

packages/Webkul/API/Http/Controllers/Shop/CustomerController.php

@@ -2,12 +2,20 @@
 
 namespace Webkul\API\Http\Controllers\Shop;
 
+use Illuminate\Support\Facades\Auth;
 use Illuminate\Support\Facades\Event;
 use Webkul\Customer\Repositories\CustomerRepository;
 use Webkul\Customer\Repositories\CustomerGroupRepository;
 
 class CustomerController extends Controller
 {
+    /**
+     * Contains current guard
+     *
+     * @var array
+     */
+    protected $guard;
+
     /**
      * Contains route related configuration
      *
@@ -40,8 +48,17 @@ class CustomerController extends Controller
         CustomerRepository $customerRepository,
         CustomerGroupRepository $customerGroupRepository
     )   {
+        $this->guard = request()->has('token') ? 'api' : 'customer';
+
         $this->_config = request('_config');
 
+        if (isset($this->_config['authorization_required']) && $this->_config['authorization_required']) {
+
+            auth()->setDefaultDriver($this->guard);
+
+            $this->middleware('auth:' . $this->guard);
+        }
+
         $this->customerRepository = $customerRepository;
 
         $this->customerGroupRepository = $customerGroupRepository;
@@ -81,4 +98,23 @@ class CustomerController extends Controller
             'message' => 'Your account has been created successfully.',
         ]);
     }
+
+    /**
+     * Returns a current user data.
+     *
+     * @param  int  $id
+     * @return \Illuminate\Http\Response
+     */
+    public function get($id)
+    {
+        if (Auth::user($this->guard)->id === (int) $id) {
+            return new $this->_config['resource'](
+                $this->customerRepository->findOrFail($id)
+            );
+        }
+
+        return response()->json([
+            'message' => 'Invalid Request.',
+        ], 403);
+    }
 }

packages/Webkul/API/Http/routes.php

@@ -154,7 +154,7 @@ Route::group(['prefix' => 'api'], function ($router) {
 
         Route::post('customer/register', 'CustomerController@create');
 
-        Route::get('customers/{id}', 'ResourceController@get')->defaults('_config', [
+        Route::get('customers/{id}', 'CustomerController@get')->defaults('_config', [
             'repository' => 'Webkul\Customer\Repositories\CustomerRepository',
             'resource' => 'Webkul\API\Http\Resources\Customer\Customer',
             'authorization_required' => true