Laravel多角色登录异常求助：cliente/cajero角色会话失效

1. 确认Guard与Provider配置正确性 #

先检查config/auth.php的配置，确保cliente和cajero的守卫（Guard）与用户提供者（Provider）正确绑定到对应模型：

'guards' => [
    'web' => [
        'driver' => 'session',
        'provider' => 'users',
    ],
    'cliente' => [
        'driver' => 'session',
        'provider' => 'clientes',
    ],
    'cajero' => [
        'driver' => 'session',
        'provider' => 'cajeros',
    ],
],

'providers' => [
    'users' => [
        'driver' => 'eloquent',
        'model' => App\Models\User::class,
    ],
    'clientes' => [
        'driver' => 'eloquent',
        'model' => App\Models\Cliente::class,
    ],
    'cajeros' => [
        'driver' => 'eloquent',
        'model' => App\Models\Cajero::class,
    ],
],

2. 修复登录逻辑：指定Guard并记录会话标识 #

修改登录控制器（LoginController），根据用户角色匹配对应Guard，并将当前Guard存入会话，确保后续请求能识别登录状态：

public function login(Request $request)
{
    $this->validate($request, [
        'email' => 'required|email',
        'password' => 'required',
        'role' => 'required|in:admin,empresa,cliente,cajero'
    ]);

    // 匹配对应Guard：admin/empresa用web，其他用角色名作为Guard
    $guard = in_array($request->role, ['admin', 'empresa']) ? 'web' : $request->role;
    $credentials = $request->only('email', 'password');

    if (Auth::guard($guard)->attempt($credentials, $request->filled('remember'))) {
        // 记录当前Guard到会话
        session(['current_guard' => $guard]);
        return redirect()->intended($this->getRedirectPath($request->role));
    }

    return back()->withErrors(['email' => '账号密码或角色匹配失败']);
}

protected function getRedirectPath($role)
{
    return match($role) {
        'admin' => route('admin.dashboard'),
        'empresa' => route('empresa.dashboard'),
        'cliente' => route('cliente.dashboard'),
        'cajero' => route('cajero.dashboard'),
        default => '/'
    };
}

如果登录表单没有角色选择项，需要提前通过邮箱查询用户所属角色（关联roles表），再匹配对应Guard

3. 自定义通用身份验证中间件 #

创建一个能兼容所有角色的中间件，替代默认的auth+role组合，自动读取会话中的Guard验证登录状态与角色权限：

1. 生成中间件：

php artisan make:middleware CheckAuthRole

2. 修改app/Http/Middleware/CheckAuthRole.php：

namespace App\Http\Middleware;

use Closure;
use Illuminate\Support\Facades\Auth;

class CheckAuthRole
{
    public function handle($request, Closure $next, ...$allowedRoles)
    {
        // 从会话取当前Guard，默认用web
        $guard = session('current_guard', 'web');
        
        // 验证对应Guard下的登录状态
        if (!Auth::guard($guard)->check()) {
            return redirect()->route('login');
        }

        $user = Auth::guard($guard)->user();
        // 通过关联的role表获取角色名称
        $userRole = $user->role->name;

        // 检查用户角色是否在允许列表内
        if (!in_array($userRole, $allowedRoles)) {
            abort(403, '无权限访问');
        }

        return $next($request);
    }
}

3. 在app/Http/Kernel.php的$routeMiddleware中注册中间件：

protected $routeMiddleware = [
    // ...其他中间件
    'auth.role' => \App\Http\Middleware\CheckAuthRole::class,
];

4. 统一路由中间件使用方式 #

所有角色的路由都使用这个自定义中间件，无需区分Guard：

// Admin路由组
Route::group(['middleware' => ['auth.role:admin']], function () {
    Route::get('/admin/dashboard', [AdminController::class, 'dashboard'])->name('admin.dashboard');
});

// Empresa路由组
Route::group(['middleware' => ['auth.role:empresa']], function () {
    Route::get('/empresa/dashboard', [EmpresaController::class, 'dashboard'])->name('empresa.dashboard');
});

// Cliente路由组
Route::group(['middleware' => ['auth.role:cliente']], function () {
    Route::get('/cliente/dashboard', [ClienteController::class, 'dashboard'])->name('cliente.dashboard');
});

// Cajero路由组
Route::group(['middleware' => ['auth.role:cajero']], function () {
    Route::get('/cajero/dashboard', [CajeroController::class, 'dashboard'])->name('cajero.dashboard');
});

5. 修复退出登录逻辑 #

确保退出时清除会话Guard标识，并使用对应Guard注销：

public function logout(Request $request)
{
    $guard = session('current_guard', 'web');
    Auth::guard($guard)->logout();

    $request->session()->invalidate();
    $request->session()->regenerateToken();

    return redirect('/');
}

问题核心原因 #

• 默认auth中间件使用配置中默认的web Guard，而cliente/cajero用户不在users表，导致验证失败，路由切换时被判定为未登录。
• 未在会话中记录当前使用的Guard，每次请求默认用web Guard验证，无法识别跨表用户的登录状态。

内容的提问来源于stack exchange，提问作者Isaac Mrs