84 lines
2.3 KiB
PHP
84 lines
2.3 KiB
PHP
<?php
|
|
|
|
namespace App\Auth;
|
|
|
|
use App\User\UserRepository;
|
|
use Psr\Http\Message\ResponseInterface;
|
|
use Psr\Http\Message\ServerRequestInterface;
|
|
use Psr\Http\Server\MiddlewareInterface;
|
|
use Psr\Http\Server\RequestHandlerInterface;
|
|
use Slim\Psr7\Response;
|
|
|
|
class AuthMiddleware implements MiddlewareInterface
|
|
{
|
|
public const COOKIE_NAME = 'auth_token';
|
|
|
|
public function __construct(
|
|
private SessionRepository $sessionRepo,
|
|
private UserRepository $userRepo,
|
|
private Clock $clock,
|
|
) {}
|
|
|
|
public function process(
|
|
ServerRequestInterface $request,
|
|
RequestHandlerInterface $handler,
|
|
): ResponseInterface {
|
|
$cookies = $request->getCookieParams();
|
|
$token = $cookies[self::COOKIE_NAME] ?? null;
|
|
|
|
if ($token === null) {
|
|
return $this->unauthorized($request);
|
|
}
|
|
|
|
$session = $this->sessionRepo->findByToken($token);
|
|
if ($session === null) {
|
|
return $this->unauthorized($request);
|
|
}
|
|
|
|
if ($session->isExpired($this->clock->now())) {
|
|
$this->sessionRepo->deleteByToken($token);
|
|
return $this->unauthorized($request);
|
|
}
|
|
|
|
$user = $this->userRepo->find($session->getUserId());
|
|
if ($user === null) {
|
|
return $this->unauthorized($request);
|
|
}
|
|
|
|
return $handler->handle(
|
|
$request->withAttribute('user', $user)
|
|
);
|
|
}
|
|
|
|
private function unauthorized(
|
|
ServerRequestInterface $request
|
|
): ResponseInterface {
|
|
if ($this->wantsJson($request)) {
|
|
$response = new Response(401);
|
|
$response->getBody()->write(
|
|
json_encode(['error' => 'unauthenticated'])
|
|
);
|
|
return $response->withHeader(
|
|
'Content-Type',
|
|
'application/json'
|
|
);
|
|
}
|
|
|
|
return new Response(302)->withHeader('Location', '/login');
|
|
}
|
|
|
|
private function wantsJson(ServerRequestInterface $request): bool
|
|
{
|
|
$path = $request->getUri()->getPath();
|
|
if (str_starts_with($path, '/api/')) {
|
|
return true;
|
|
}
|
|
|
|
$accept = $request->getHeaderLine('Accept');
|
|
if (str_contains($accept, 'application/json')) {
|
|
return true;
|
|
}
|
|
|
|
return false;
|
|
}
|
|
}
|