-
Notifications
You must be signed in to change notification settings - Fork 0
/
AuthenticationMiddleware.php
70 lines (60 loc) · 3.25 KB
/
AuthenticationMiddleware.php
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
<?php
declare(strict_types=1);
/*
* The MIT License (MIT)
*
* Copyright (c) 2014-2019 Spomky-Labs
*
* This software may be modified and distributed under the terms
* of the MIT license. See the LICENSE file for details.
*/
namespace OAuth2Framework\Component\ResourceServerAuthentication;
use Assert\Assertion;
use OAuth2Framework\Component\Core\Message\OAuth2Error;
use OAuth2Framework\Component\Core\ResourceServer\ResourceServer;
use OAuth2Framework\Component\Core\ResourceServer\ResourceServerRepository;
use Psr\Http\Message\ResponseInterface;
use Psr\Http\Message\ServerRequestInterface;
use Psr\Http\Server\MiddlewareInterface;
use Psr\Http\Server\RequestHandlerInterface;
final class AuthenticationMiddleware implements MiddlewareInterface
{
private AuthenticationMethodManager $authenticationMethodManager;
private ResourceServerRepository $resourceServerRepository;
public function __construct(ResourceServerRepository $resourceServerRepository, AuthenticationMethodManager $authenticationMethodManager)
{
$this->resourceServerRepository = $resourceServerRepository;
$this->authenticationMethodManager = $authenticationMethodManager;
}
public function process(ServerRequestInterface $request, RequestHandlerInterface $handler): ResponseInterface
{
try {
$authentication_method = null;
$resourceServer_credentials = null;
$resourceServerId = $this->authenticationMethodManager->findResourceServerIdAndCredentials($request, $authentication_method, $resourceServer_credentials);
if (null !== $resourceServerId && $authentication_method instanceof AuthenticationMethod) {
$resourceServer = $this->resourceServerRepository->find($resourceServerId);
Assertion::notNull($resourceServer, 'Unknown resource server or resource server not authenticated.');
$this->checkAuthenticationMethod($request, $resourceServer, $authentication_method, $resourceServer_credentials);
$request = $request->withAttribute('resource_server', $resourceServer);
$request = $request->withAttribute('resource_server_authentication_method', $authentication_method);
$request = $request->withAttribute('resource_server_credentials', $resourceServer_credentials);
}
} catch (\Throwable $e) {
throw new OAuth2Error(401, OAuth2Error::ERROR_INVALID_RESOURCE_SERVER, $e->getMessage(), [], $e);
}
return $handler->handle($request);
}
/**
* @param mixed $resourceServerCredentials
*/
private function checkAuthenticationMethod(ServerRequestInterface $request, ResourceServer $resourceServer, AuthenticationMethod $authenticationMethod, $resourceServerCredentials): void
{
if (!\in_array($resourceServer->getAuthenticationMethod(), $authenticationMethod->getSupportedMethods(), true)) {
throw new \InvalidArgumentException('Unknown resource server or resource server not authenticated.');
}
if (!$authenticationMethod->isResourceServerAuthenticated($resourceServer, $resourceServerCredentials, $request)) {
throw new \InvalidArgumentException('Unknown resource server or resource server not authenticated.');
}
}
}