Request for help using the Logical Theme system to enable logging in via url parameters about bookstack

[ssddanbrown]

Good to hear you're liking BookStack!

But I've run into a lack of knowledge on how to login the user from that point on.

Here's an example:

<?php

use BookStack\Theming\ThemeEvents;
use BookStack\Facades\Theme;
use BookStack\Users\Models\User;
use Illuminate\Http\Request;

Theme::listen(ThemeEvents::WEB_MIDDLEWARE_BEFORE, function (Request $request) {
    $userEmailParam = $request->query('as_user_email');

    // Ignore if no email parameter or if already logged in
    if (!$userEmailParam || auth()->check()) {
        return;
    }

    // Log user in if user matching email is found
    $user = User::query()->where('email', $userEmailParam)->first();
    if ($user) {
        // Silent direct login:
        auth()->login($user);

        // Login via app process which includes MFA, email confirmations, logging etc...
        // See https://github.com/BookStackApp/BookStack/blob/f32cfb4292f7e3b723b5f99aab17d0f3989c93b7/app/Access/LoginService.php#L26-L54
        // Uncomment two lines below, and comment auth line above, to activate:
        //$loginService = app()->make(\BookStack\Access\LoginService::class);
        //$loginService->login($user, 'custom_query_auth');
    }
});

Note: The above is a significant insecure addition so please don't add to your instance unless you understand the risk and how that applies to your usage context of BookStack. Also, this customization uses BookStack internal code which could break upon future update.

There's a couple of options in there depending on what you need. Users will remain logged in from that point onward for the email user for the duration of their session. Let me know if you need any part/detail explained further.

[cepm-nate]

Thanks so much for the sample code and help! That points me in the right direction! and I can see how it'd be rather insecure (someone guessing the admin e-mail).

I'll work on adding a couple extra unknowns to make it a little trickier for this particular use case. :-)

Thanks again!