-
Notifications
You must be signed in to change notification settings - Fork 28
/
Authentication.php
73 lines (64 loc) · 2.28 KB
/
Authentication.php
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
<?php
declare(strict_types=1);
namespace PhpList\Core\Security;
use Doctrine\ORM\EntityNotFoundException;
use PhpList\Core\Domain\Model\Identity\Administrator;
use PhpList\Core\Domain\Repository\Identity\AdministratorTokenRepository;
use Symfony\Component\HttpFoundation\Request;
/**
* This class takes care of authenticating users and API clients.
*
* @author Oliver Klee <oliver@phplist.com>
*/
class Authentication
{
/**
* @var AdministratorTokenRepository
*/
private $tokenRepository = null;
/**
* Authentication constructor.
*
* @param AdministratorTokenRepository $tokenRepository
*/
public function __construct(AdministratorTokenRepository $tokenRepository)
{
$this->tokenRepository = $tokenRepository;
}
/**
* Tries to authenticate an administrator using the API key provided in the basic auth password contained in the
* request headers. (The basic auth user will be ignored.)
*
* @param Request $request
*
* @return Administrator|null the authenticated Administrator or null if authentication has failed
*/
public function authenticateByApiKey(Request $request)
{
$apiKey = $request->headers->get('php-auth-pw');
if (empty($apiKey)) {
return null;
}
$token = $this->tokenRepository->findOneUnexpiredByKey($apiKey);
if ($token === null) {
return null;
}
/** @var Administrator|null $administrator */
$administrator = $token->getAdministrator();
if ($administrator === null) {
return null;
}
try {
// This checks for cases where a super user created a session key and then got their super user
// privileges removed during the lifetime of the session key. Or an administrator got disabled.
// In addition, this will load the lazy-loaded model from the database,
// which will check that the model really exists in the database (i.e., it has not been deleted).
if (!$administrator->isSuperUser() || $administrator->isDisabled()) {
$administrator = null;
}
} catch (EntityNotFoundException $exception) {
$administrator = null;
}
return $administrator;
}
}