irfaardy / lockout-account

src/Middleware/ApiLockAccount.php

<?php

namespace Irfa\Lockout\Middleware;

use Closure;
use Route;
use URL;
use Lang;
use Illuminate\Support\Facades\File;
use Irfa\Lockout\Func\Core;

class ApiLockAccount extends Core
{
    /**
     * Handle an incoming request.
     *
     * @param  \Illuminate\Http\Request  $request
     * @param  \Closure  $next
     * @return mixed
     */
    public function handle($request, Closure $next)
    {
        if($this->exceptAccount()){
             return $next($request);
        }
        
        if ($request->method() == "POST") {
            if (in_array($request->path(), config('irfa.lockout.protected_action_path'))) {
                if ($this->lockLogin()) {
                    $this->eventFailedLogin();
                    $this->logging("API");
                    $message['code'] = 403;

$message was never initialized. Although not strictly required by PHP, it is generally a good practice to add $message = array(); before regardless.

                    $message[config('irfa.lockout.message_name')] = Lang::get('lockoutMessage.locked');
                    return response()->json($message);
                }
            }
        }
            return $next($request);
    }
}