How to add additional condition to Laravel 6 Auth attempt() method? - laravel

Question

I'm using Larvel 6
I want to add this feature to my app:
The app receives User's mobile number, then generates a mobile_number_verification_code like 145787 and updates user's table! then the generated code will be sent as SMS for user! and he/she enters the code to login!
Notice: the code can be used just 2 minutes after the generation time
this will be the User model
Schema::create('users', function (Blueprint $table) {
$table->bigIncrements('id');
$table->string('name');
$table->string('email')->unique();
$table->string('username')->unique()->nullable();
$table->string('mobile_number')->unique()->nullable();
$table->string('mobile_number_verification_code')->nullable();
$table->string('mobile_number_verification_code_expires_at')->nullable();
$table->bigInteger('mobile_number_verified_at')->nullable();
$table->timestamp('email_verified_at')->nullable();
$table->string('password');
$table->rememberToken();
$table->timestamps();
});
I want to use the Laravel default auth way, so I can use this code for attempt to login:
/**
* Attempt to log the user into the application.
*
* #param \Illuminate\Http\Request $request
* #return bool
*/
protected function attemptLogin(Request $request)
{
return $this->guard('users')->attempt(
[
'mobile_number' => '9128889966', // the mobile number
'mobile_number_verification_code' => '145787' // the code which user has received
]
, $request->filled('remember')
);
}
everything seems alright but one important point is missed:
the code can be used just 2 minutes after the generation time
How can I check the code is expired or not?
I know that I can check it after user login, then if the code is expired, use Auth::logout(); to logout him/her! but is it the best way?
It is not better to edit the attempt() method?

Answer 1

You can check expiration datetime on attemptLogin method of your LoginController like this:
namespace App\Http\Controllers\Auth;
use App\Http\Controllers\Controller;
use Illuminate\Foundation\Auth\AuthenticatesUsers;
use Illuminate\Http\Request;
class LoginController extends Controller
{
//...
/**
* Attempt to log the user into the application.
*
* #param \Illuminate\Http\Request $request
* #return bool
*/
protected function attemptLogin(Request $request)
{
return \App\User::where('mobile_number', $request->mobile_number)
->whereDate('mobile_number_verification_code_expires_at', '>=', now())
->exists()
&& $this->guard()->attempt([
'mobile_number' => $request->mobile_number
'mobile_number_verification_code' => $request->mobile_number_verification_code
], $request->filled('remember')
);
}
Another way is to define a custom UserProvider that implements Illuminate\Contracts\Auth\UserProvider interface or extends Illuminate\Auth\EloquentUserProvider and override validateCredentials and/or retrieveByCredentials methods. Then register your customized UserProvider and set it as custom driver on config/auth.php file. See Laravel docs form more info about this.