解决 Laravel Livewire 密码更新后会话失效的问题

use Illuminate\Support\Facades\Auth;
use Illuminate\Http\Request;

<?php

namespace App\Http\Livewire\Auth;

use App\Models\User;
use Carbon\Carbon;
use Livewire\Component;
use Illuminate\Support\Facades\Hash;
use Illuminate\Validation\Rules\Password;
use Illuminate\Support\Facades\Auth; // 引入 Auth Facade
use Illuminate\Http\Request; // 引入 Request 类

class ChangeUserPassword extends Component
{
    public $oldPassword;
    public $newPassword;
    public $confirmPassword;

    public function render()
    {
        return view('livewire.auth.change-user-password');
    }

    /**
     * 处理用户密码修改请求。
     *
     * @param Request $request 用于访问会话和重定向的请求实例。
     */
    public function changePassword(Request $request)
    {
        // 1. 验证用户输入
        $this->validate([
            'oldPassword' => 'required',
            'newPassword' => ['required', Password::min(8)
                ->letters()
                ->mixedCase()
                ->numbers()
                ->symbols()
            ],
            'confirmPassword' => 'required|min:8|same:newPassword'
        ]);

        // 2. 获取当前认证的用户实例
        $user = User::find(auth()->user()->id);

        if (!$user) {
            $this->emit('showAlertError', ['msg' => '用户不存在或未登录。']);
            return;
        }

        // 3. 验证旧密码是否匹配
        if (Hash::check($this->oldPassword, $user->password)) {
            // 4. 更新用户密码
            $user->update([
                'password' => Hash::make($this->newPassword),
                'updated_at' => Carbon::now()->toDateTimeString()
            ]);

            // 5. 重新认证用户并保持会话
            // 使用新密码尝试重新认证，确保会话与新凭据关联
            if (Auth::attempt(['email' => $user->email, 'password' => $this->newPassword])) {
                $request->session()->regenerate(); // 重新生成会话 ID，防止会话固定攻击
                $this->emit('showAlert', ['msg' => '您的密码已成功更改。']);
                // 重定向到用户原先尝试访问的页面，或默认到密码修改页面
                return redirect()->intended(route('user.changepassword'));
            } else {
                // 如果重新认证失败，这通常不应该发生，但作为回退机制
                Auth::logout(); // 强制登出用户
                $request->session()->invalidate(); // 使当前会话失效
                $request->session()->regenerateToken(); // 重新生成 CSRF token
                $this->emit('showAlertError', ['msg' => '密码更新成功，但会话认证失败，请重新登录。']);
                return redirect()->route('login'); // 重定向到登录页
            }

        } else {
            // 6. 旧密码不匹配的错误处理
            $this->emit('showAlertError', ['msg' => '旧密码不匹配。']);
        }
    }
}

<div class="col-md-12">
    <div class="card">
        <div class="card-body">
            <h4 class="card-title ml-2">Change Password</h4>
            <form wire:submit.prevent="changePassword" role="form">
                @csrf
                <div class="row">
                    <div class="form-group col-md-4">
                        <label for="oldPassword" class="form-label">Old Password<span style="color: red"> *</span></label>
                        <input class="form-control @error('oldPassword') is-invalid @enderror" wire:model="oldPassword" name="oldPassword" id="oldPassword" type="password" />
                        @error('oldPassword')
                            <small id="helpId" class="text-danger">{{ $message }}</small>
                        @enderror
                    </div>
                    <div class="form-group col-md-4">
                        <label for="newPassword" class="form-label">New Password<span style="color: red"> *</span></label>
                        <input class="form-control @error('newPassword') is-invalid @enderror" wire:model="newPassword" name="newPassword" id="newPassword" type="password" />
                        @error('newPassword')
                            <small id="helpId" class="text-danger">{{ $message }}</small>
                        @enderror
                    </div>
                    <div class="form-group col-md-4">
                        <label for="confirmPassword" class="form-label">Confirm Password<span style="color: red"> *</span></label>
                        <input class="form-control @error('confirmPassword') is-invalid @enderror" wire:model="confirmPassword" name="confirmPassword" id="confirmPassword" type="password" />
                        @error('confirmPassword')
                            <small id="helpId" class="text-danger">{{ $message }}</small>
                        @enderror
                    </div>
                    <div class="form-group">
                        <button type="submit" class="btn btn-primary pull-right" 
                            wire:loading.attr="disabled">Save</button>
                    </div>
                </div>
            </form>
        </div>
    </div>
</div>