/
APIAuthenticatorMiddleware.php
69 lines (54 loc) · 2.15 KB
/
APIAuthenticatorMiddleware.php
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
<?php
namespace Concrete\Core\Http\Middleware;
use Concrete\Core\Application\Application;
use Concrete\Core\Http\ResponseFactory;
use Concrete\Core\User\UserInfoRepository;
use Psr\Log\LoggerInterface;
use Symfony\Component\HttpFoundation\Request;
use Concrete\Core\Http\Request as ConcreteRequest;
use Concrete\Core\Authentication\OAuth2\Request as OAuth2Request;
class APIAuthenticatorMiddleware implements MiddlewareInterface
{
protected $app;
protected $oauth;
protected $factory;
private $repository;
protected $logger;
public function __construct(Application $app, ResponseFactory $factory, UserInfoRepository $repository, LoggerInterface $logger)
{
$this->app = $app;
$this->factory = $factory;
$this->oauth = $this->app->make('oauth2/server');
$this->repository = $repository;
$this->logger = $logger;
}
/**
* Process the request and return a response
* @param \Symfony\Component\HttpFoundation\Request $request
* @param DelegateInterface $frame
* @return mixed
*/
public function process(Request $request, DelegateInterface $frame)
{
$wrappedRequest = new OAuth2Request($request);
$scope = null;
if (!$this->oauth->verifyResourceRequest($wrappedRequest, $response = new \OAuth2\Response, $scope)) {
$body = $response->getParameters();
if (!$body && $response->getStatusCode() == 401) {
$body = [
'Not Authenticated'
];
$this->logger->warning(t('Access to API not allowed.'));
}
return $this->factory->json($body, $response->getStatusCode(),
$response->getHttpHeaders());
}
$token = $this->oauth->getAccessTokenData($wrappedRequest);
if ($id = array_get($token, 'user_id')) {
$req = ConcreteRequest::getInstance();
$req->setCustomRequestUser($this->repository->getByID($id)); // we need this for permissions.
}
$this->logger->info(t('Running API method: %s', $wrappedRequest->request->getPathInfo()));
return $frame->next($request);
}
}