angularjs - Ionic/Laravel App Client Side Auth Management -

angularjs - Ionic/Laravel App Client Side Auth Management -

i have been fumbling around different implementations , ideas work, sense not doing dry or smart be. i've been next "tutorial" angular auth

so, have functional laravel (4.2) end set resource routes protected oauth filter. using password grant , working fine there. i've got log in/out routes set , able sign in ionic app , obtain , access_token , refresh_token laravel fine. obtaining new access_tokens using refesh_token works fine well. but, having issues trying figure out how correctly handle next things in ionic:

make sure access_token hasn't expired before user hits ionic state consume resource end. handle case user's access_token & refresh token have both expired requiring them log in laravel end in order obtain new pair of access & refresh tokens. have user "log in" when need obtain new access_token & refresh token (or first registering) route, oauth/access_token, requires params {username, password}.

what tried

in article mentioned earlier, sets rootscope watcher in run module watches statechangestart event so.

$rootscope.$on('$statechangestart', function (event, next) { var authorizedroles = next.data.authorizedroles; if (!authservice.isauthorized(authorizedroles)) { event.preventdefault(); if (authservice.isauthenticated()) { // user not allowed $rootscope.$broadcast(auth_events.notauthorized); } else { // user not logged in $rootscope.$broadcast(auth_events.notauthenticated); } } });

i not using roles when implemented had this

$rootscope.$on('$statechangestart', function(event, next) { if (next.url != "/login") { authservice.isauthenticated().then(function() { console.log('you authed logged in , trying access: ' + next.url); }, function() { event.preventdefault(); console.log('you not have valid access token'); $location.path('/app/login'); }); } });

isauthenticated() hits route within oauth filter if throws error (401 example), know access_token bad. have private method within authservice service tries new access_token using users stored refresh_token

function userefreshtoken() { console.log('using refresh token new token:'); var deferred = $q.defer(); $http({ method: 'post', url: base_url.dev.url + 'oauth/access_token', data: $.param({ grant_type: 'refresh_token', client_id: api.client_id, client_secret: api.client_secret, refresh_token: $localstorage.session.refresh_token }), headers: { 'content-type': 'application/x-www-form-urlencoded' } }).success(function(data) { console.log('refresh token worked!'); $localstorage.session.access_token = data.access_token; $localstorage.session.refresh_token = data.refresh_token; deferred.resolve(); }).error(function(error) { console.log('refresh token failed'); currentuserservice.setlogged(false); console.log(json.stringify(error)); deferred.reject(error); }); homecoming deferred.promise; };

if above method returns rejected promise assume (which may thought or not??) refresh token has expired , user needs log in , retrieve new access & refresh token pair laravel oauth/access_token route.

so above methods have been working fine on own, in able check if users access_token valid , if not retrieve new access_token fine using users refresh_token.

here's isauthenticated method in case wanted see well. it's public method within of authservice service.

isauthenticated: function() { console.log('checking if token still valid.'); var deferred = $q.defer(); $http.get(base_url.dev.url + 'valid-token', { params: { access_token: $localstorage.session.access_token } }).success(function(data) { console.log('token still valid.'); currentuserservice.setlogged(true); deferred.resolve(); }).error(function(error) { console.log(json.stringify(error)); userefreshtoken().then(function() { deferred.resolve(); }, function(error) { deferred.reject(error); }); }); homecoming deferred.promise; }

the big problem running because authservice.isauthenticated() method runs async, state app changing to, photos, nail before isauthenticated returns , if have case: 1 mentioned @ origin of post, photos state seek utilize invalid access_token seek , consume resource on end before isauthenticated method able new access_token using refresh_token.

now able avoid above issue using resolve on every state handled using isauthenticated method check access_token , new 1 if need before consuming resource. felt horribly undry. apologize length of post wanted create sure guys knew going on , trying accomplish.

i appreciate feedback, criticism , instruction! guys.

angularjs laravel laravel-4 oauth-2.0 ionic-framework