Owner: Dev Team | Last Updated: 2026-02-21 | Status: Current
Authentication and authorization mechanisms in Booking.
Booking uses Laravel Sanctum for authentication. Sanctum provides:
Dashboard uses session-based authentication via Inertia.js.
1. User → POST /login (email, password)
2. Server validates credentials
3. Session created, CSRF token issued
4. Redirect to Dashboard
5. Subsequent requests include session cookie + CSRF token
| Method | Endpoint | Description |
|---|---|---|
| GET | /register |
Registration form |
| POST | /register |
Create account |
| GET | /login |
Login form |
| POST | /login |
Authenticate |
| POST | /logout |
Logout |
| GET | /forgot-password |
Password reset form |
| POST | /forgot-password |
Send reset link |
| POST | /reset-password |
Reset password |
| GET | /verify-email |
Email verification prompt |
| POST | /email/verification-notification |
Resend verification |
| GET | /verify-email/{id}/{hash} |
Verify email |
| GET | /confirm-password |
Password confirmation form |
| POST | /confirm-password |
Confirm password |
| PUT | /password |
Update password |
POST /api/v1/sign-in
Request Body:
{
"email": "user@example.com",
"password": "password"
}
Response (200):
{
"token": "1|abc123...",
"user": {
"id": 1,
"name": "John",
"email": "user@example.com",
"role": "admin"
}
}
Include the token in the header of each request:
Authorization: Bearer 1|abc123...
POST /api/v1/sign-out
Authorization: Bearer 1|abc123...
Channel Manager uses HTTP Basic Authentication:
Authorization: Basic base64(BOKUN_API_USER:BOKUN_API_PASS)
Credentials are configured in .env:
BOKUN_API_USER=your_user
BOKUN_API_PASS=your_password
Middleware: BokunBasicAuthMiddleware
| Role | Code | Access Level |
|---|---|---|
| Super Admin | s_admin |
All companies, all features |
| Admin | admin |
Own company, all features |
| Manager | manager |
Leads, bookings, customers |
| Cashier | cashier |
POS, bookings |
| Content Manager | content_manager |
Content, media |
| Cruise Employee | cruise_employee |
Check-in, manifests |
| Customer | customer |
Client-side interface only |
// routes/web.php
Route::middleware(['auth', 'role:admin,manager'])->group(function () {
// Only admin and manager can access
});
Implementation: app/Http/Middleware/RoleMiddleware.php
Additional middleware checks account activity:
CheckUserStatus -- deactivated users are automatically logged out| Header | Value | Purpose |
|---|---|---|
X-CSRF-TOKEN |
Token from meta tag | CSRF protection (SPA) |
X-Requested-With |
XMLHttpRequest |
XHR identification |
Accept |
application/json |
API response format |
| API | Limit | Middleware |
|---|---|---|
| Public API | Configurable throttle | throttle:api |
| Channel Manager | Custom throttle | Custom throttle |
| Auth endpoints | Configurable | throttle:login |
| File | Purpose |
|---|---|
app/Http/Controllers/Auth/ |
Auth controllers (9 files) |
app/Http/Controllers/Api/SignInController.php |
API sign-in |
app/Http/Controllers/Api/SignOutController.php |
API sign-out |
app/Http/Middleware/RoleMiddleware.php |
Role checking |
app/Http/Middleware/CheckUserStatus.php |
User status |
app/Http/Middleware/BokunBasicAuthMiddleware.php |
Bokun auth |
app/Enums/UserRole.php |
Role definitions |
config/sanctum.php |
Sanctum configuration |
| Date | Author | Change |
|---|---|---|
| 2026-02-21 | Documentation Team | Initial creation |
Prev: API Reference | Next: Public API | Up: API Reference