switch from order as session to order as cookies, this is necessary sor that sessions are not constantly reset for guest users

Author: ildyria

app/Http/Controllers/Shop/BasketController.php

@@ -21,7 +21,7 @@
 use App\Models\User;
 use Illuminate\Routing\Controller;
 use Illuminate\Support\Facades\Auth;
-use Illuminate\Support\Facades\Session;
+use Illuminate\Support\Facades\Cookie;
 
 class BasketController extends Controller
 {
@@ -115,7 +115,7 @@ public function delete(DeleteBasketRequest $request): void
 		$this->basket_service->deleteBasket($basket);
 
 		// Remove basket ID from session
-		Session::forget(RequestAttribute::BASKET_ID_ATTRIBUTE);
+		Cookie::queue(Cookie::forget(RequestAttribute::BASKET_ID_ATTRIBUTE));
 	}
 
 	/**
@@ -130,7 +130,7 @@ public function get(GetBasketRequest $request): OrderResource
 		/** @var User|null $user */
 		$user = Auth::user();
 		$basket = $this->basket_service->getOrCreateBasket($request->basket(), $user);
-		Session::put(RequestAttribute::BASKET_ID_ATTRIBUTE, $basket->id);
+		Cookie::queue(RequestAttribute::BASKET_ID_ATTRIBUTE, $basket->id, config('session.lifetime'));
 
 		return OrderResource::fromModel($basket);
 	}

app/Http/Requests/Basket/AddAlbumToBasketRequest.php

@@ -52,7 +52,7 @@ class AddAlbumToBasketRequest extends BaseBasketRequest
 	 */
 	public function authorize(): bool
 	{
-		return true; // Anyone can add albums to the basket
+		return $this->order !== null; // Anyone can add albums to the basket
 	}
 
 	/**

app/Http/Requests/Basket/AddPhotoToBasketRequest.php

@@ -53,7 +53,7 @@ class AddPhotoToBasketRequest extends BaseBasketRequest
 	public function authorize(): bool
 	{
 		// Validate that the photo is in the specified album
-		return $this->photo->albums()->where('id', $this->album_id)->exists();
+		return $this->order !== null && $this->photo->albums()->where('id', $this->album_id)->exists();
 	}
 
 	/**

app/Http/Requests/Basket/GetBasketRequest.php

@@ -14,7 +14,7 @@
 use App\Http\Requests\BaseApiRequest;
 use App\Models\Order;
 use Illuminate\Support\Facades\Auth;
-use Illuminate\Support\Facades\Session;
+use Illuminate\Support\Facades\Cookie;
 
 class GetBasketRequest extends BaseApiRequest implements HasBasket
 {
@@ -35,15 +35,13 @@ public function authorize(): bool
 	 */
 	public function rules(): array
 	{
-		return [
-			RequestAttribute::BASKET_ID_ATTRIBUTE => ['nullable', 'integer'],
-		];
+		return [];
 	}
 
 	protected function processValidatedValues(array $values, array $files): void
 	{
-		// If there is a basket_id in the session, use it.
-		$basket_id = Session::get(RequestAttribute::BASKET_ID_ATTRIBUTE, $values[RequestAttribute::BASKET_ID_ATTRIBUTE] ?? null);
+		// If there is a basket_id in the cookie, use it.
+		$basket_id = Cookie::get(RequestAttribute::BASKET_ID_ATTRIBUTE, $values[RequestAttribute::BASKET_ID_ATTRIBUTE] ?? null);
 		if ($basket_id !== null) {
 			$this->order = Order::find($basket_id);
 		}

app/Http/Requests/Traits/HasBasketTrait.php

@@ -12,7 +12,7 @@
 use App\Enum\PaymentStatusType;
 use App\Models\Order;
 use Illuminate\Support\Facades\Auth;
-use Illuminate\Support\Facades\Session;
+use Illuminate\Support\Facades\Cookie;
 
 trait HasBasketTrait
 {
@@ -27,14 +27,14 @@ public function basket(): ?Order
 	}
 
 	/**
-	 * Resolve the basket from the session and prepare it for validation.
+	 * Resolve the basket from the cookie and prepare it for validation.
 	 *
 	 * @return void
 	 */
 	protected function prepareBasket(): void
 	{
-		// If there is a basket_id in the session, use it.
-		$basket_id = Session::get(RequestAttribute::BASKET_ID_ATTRIBUTE);
+		// If there is a basket_id in the cookie, use it.
+		$basket_id = Cookie::get(RequestAttribute::BASKET_ID_ATTRIBUTE);
 		if ($basket_id !== null) {
 			$this->order = Order::find($basket_id);
 		}
@@ -48,7 +48,7 @@ protected function prepareBasket(): void
 			$this->order->user_id !== $user_id
 		) {
 			$this->order = null;
-			Session::forget(RequestAttribute::BASKET_ID_ATTRIBUTE);
+			Cookie::queue(Cookie::forget(RequestAttribute::BASKET_ID_ATTRIBUTE));
 		}
 
 		// If user is logged in, retrieve the current pending basket.

tests/Feature_v2/Base/BaseApiTest.php

@@ -46,7 +46,7 @@ abstract class BaseApiTest extends AbstractTestCase
 	 */
 	public function getJsonWithData($uri, array $data = [], array $headers = [], $options = 0)
 	{
-		return $this->json('GET', self::API_PREFIX . ltrim($uri, '/'), $data, $headers, $options);
+		return $this->withCredentials()->json('GET', self::API_PREFIX . ltrim($uri, '/'), $data, $headers, $options);
 	}
 
 	/**
@@ -60,7 +60,7 @@ public function getJsonWithData($uri, array $data = [], array $headers = [], $op
 	 */
 	public function getJson($uri, array $headers = [], $options = 0)
 	{
-		return $this->json('GET', self::API_PREFIX . ltrim($uri, '/'), [], $headers, $options);
+		return $this->withCredentials()->json('GET', self::API_PREFIX . ltrim($uri, '/'), [], $headers, $options);
 	}
 
 	/**
@@ -75,7 +75,7 @@ public function getJson($uri, array $headers = [], $options = 0)
 	 */
 	public function postJson($uri, array $data = [], array $headers = [], $options = 0)
 	{
-		return $this->json('POST', self::API_PREFIX . ltrim($uri, '/'), $data, $headers, $options);
+		return $this->withCredentials()->json('POST', self::API_PREFIX . ltrim($uri, '/'), $data, $headers, $options);
 	}
 
 	/**
@@ -132,7 +132,7 @@ public function upload(
 	 */
 	public function patchJson($uri, array $data = [], array $headers = [], $options = 0)
 	{
-		return $this->json('PATCH', self::API_PREFIX . ltrim($uri, '/'), $data, $headers, $options);
+		return $this->withCredentials()->json('PATCH', self::API_PREFIX . ltrim($uri, '/'), $data, $headers, $options);
 	}
 
 	/**
@@ -147,7 +147,7 @@ public function patchJson($uri, array $data = [], array $headers = [], $options
 	 */
 	public function putJson($uri, array $data = [], array $headers = [], $options = 0)
 	{
-		return $this->json('PUT', self::API_PREFIX . ltrim($uri, '/'), $data, $headers, $options);
+		return $this->withCredentials()->json('PUT', self::API_PREFIX . ltrim($uri, '/'), $data, $headers, $options);
 	}
 
 	/**
@@ -162,7 +162,7 @@ public function putJson($uri, array $data = [], array $headers = [], $options =
 	 */
 	public function deleteJson($uri, array $data = [], array $headers = [], $options = 0)
 	{
-		return $this->json('DELETE', self::API_PREFIX . ltrim($uri, '/'), $data, $headers, $options);
+		return $this->withCredentials()->json('DELETE', self::API_PREFIX . ltrim($uri, '/'), $data, $headers, $options);
 	}
 
 	/**