How to reset a user's password in Laravel if they don't have an email address?

Question

Laravel

Laravel has a standard password reset system that works well. But it is strictly tied to the user's email. In the password_resets table, the token is associated with email.

On one of my projects, the customer basically abandoned the mandatory email for users, a phone number is required there (this is his business logic and it is not discussed).

It was not difficult to rewrite authorization and registration. But there are problems with password recovery:

1. When requesting a password recovery link, the application tries to write email to password_resets, but it is not there - it throws an exception.
2. But even if you send such a link via SMS, when you click on it and try to enter a new password - again an error, because. entry in password_resets not found, hence no token either.

Those. the question is essentially how to redefine the token id in the password_resets table from email to phone number or user id? It is clear that you can simply rewrite the system, but perhaps there are solutions specifically for Laravel?

I will be glad for any help!

UPD The parameters responsible for which property will be written to the password_resets table and which field are contained in the Illuminate\Auth\Passwords\DatabaseTokenRepository class, which implements Illuminate\Auth\Passwords\TokenRepositoryInterface. Those. I just need to create a new class that implements the specified interface. But how does Laravel indicate that the new class will now be used?

Answer 1

You need to completely replace the password reset mechanism with your own implementation or find a ready-made one (which actually does the same).
Here is the service responsible for the operation of this mechanism - you make your own implementation PasswordBrokerManagerwith all the accompanying classes - PasswordBrokerand TokenRepositoryInterfaceyou replace and use it.