Deprecated Controller extending removed. Moved to Guard component from deprecated SimplePreAuthenticatorInterface. Small crutch added to the new ApiTokenAuthenticator to handle 'api-token' header retrieval.

This commit is contained in:
Alexey Skobkin 2019-01-18 20:27:38 +03:00
parent 2d68505581
commit 718445ceb6
10 changed files with 94 additions and 107 deletions

View file

@ -6,8 +6,6 @@ security:
class: App\Entity\User class: App\Entity\User
property: username property: username
manager_name: default manager_name: default
api_token_provider:
id: App\Security\ApiTokenUserProvider
encoders: encoders:
App\Entity\User: App\Entity\User:
algorithm: 'argon2i' algorithm: 'argon2i'
@ -22,9 +20,9 @@ security:
pattern: ^/api/ pattern: ^/api/
anonymous: ~ anonymous: ~
stateless: true stateless: true
simple_preauth: guard:
authenticator: App\Security\ApiTokenAuthenticator authenticators:
provider: api_token_provider - App\Security\ApiTokenAuthenticator
main: main:
pattern: ^/ pattern: ^/
anonymous: ~ anonymous: ~

View file

@ -3,10 +3,10 @@
namespace App\Api\V1\Controller; namespace App\Api\V1\Controller;
use App\Api\V1\DTO\ApiResponse; use App\Api\V1\DTO\ApiResponse;
use Symfony\Bundle\FrameworkBundle\Controller\Controller; use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
use Symfony\Component\HttpFoundation\{JsonResponse, Response}; use Symfony\Component\HttpFoundation\{JsonResponse, Response};
abstract class AbstractApiController extends Controller abstract class AbstractApiController extends AbstractController
{ {
protected const DEFAULT_SERIALIZER_GROUPS = ['api']; protected const DEFAULT_SERIALIZER_GROUPS = ['api'];

View file

@ -45,16 +45,19 @@ class SecurityController extends AbstractApiController
public function logout(TokenStorageInterface $tokenStorage, ApiTokenRepository $apiTokenRepo, EntityManagerInterface $em): JsonResponse public function logout(TokenStorageInterface $tokenStorage, ApiTokenRepository $apiTokenRepo, EntityManagerInterface $em): JsonResponse
{ {
$token = $tokenStorage->getToken(); if (null === $token = $tokenStorage->getToken()) {
return $this->createJsonResponse(null,[],JsonResponse::HTTP_INTERNAL_SERVER_ERROR, 'Can\'t retrieve user token.');
}
if (!$token instanceof AuthenticatedApiToken) { if (!$token instanceof AuthenticatedApiToken) {
return $this->createJsonResponse(null, [], JsonResponse::HTTP_INTERNAL_SERVER_ERROR, 'Invalid session token type retrieved.'); return $this->createJsonResponse(null, [], JsonResponse::HTTP_INTERNAL_SERVER_ERROR, 'Invalid session token type retrieved.');
} }
if (null === $apiTokenKey = $token->getTokenKey()) {
return $this->createJsonResponse(null,[],JsonResponse::HTTP_INTERNAL_SERVER_ERROR, 'Can\'t retrieve token key from session.'); if (null === $tokenKey = $token->getTokenKey()) {
return $this->createJsonResponse(null,[],JsonResponse::HTTP_INTERNAL_SERVER_ERROR, 'Can\'t retrieve token key from the session.');
} }
if (null === $apiToken = $apiTokenRepo->findOneBy(['key' => $apiTokenKey])) { if (null === $apiToken = $apiTokenRepo->findOneBy(['key' => $tokenKey])) {
return $this->createJsonResponse(null,[],JsonResponse::HTTP_INTERNAL_SERVER_ERROR, 'API token with such key not found in the database.'); return $this->createJsonResponse(null,[],JsonResponse::HTTP_INTERNAL_SERVER_ERROR, 'API token with such key not found in the database.');
} }

View file

@ -4,10 +4,10 @@ namespace App\Controller;
use App\Entity\User; use App\Entity\User;
use App\Repository\InviteRepository; use App\Repository\InviteRepository;
use Symfony\Bundle\FrameworkBundle\Controller\Controller; use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
use Symfony\Component\HttpFoundation\Response; use Symfony\Component\HttpFoundation\Response;
class AccountController extends Controller class AccountController extends AbstractController
{ {
public function invites(InviteRepository $inviteRepo): Response public function invites(InviteRepository $inviteRepo): Response
{ {

View file

@ -3,12 +3,12 @@
namespace App\Controller; namespace App\Controller;
use App\Form\LoginType; use App\Form\LoginType;
use Symfony\Bundle\FrameworkBundle\Controller\Controller; use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
use Symfony\Component\Form\Extension\Core\Type\SubmitType; use Symfony\Component\Form\Extension\Core\Type\SubmitType;
use Symfony\Component\Form\FormInterface; use Symfony\Component\Form\FormInterface;
use Symfony\Component\HttpFoundation\Response; use Symfony\Component\HttpFoundation\Response;
class MainController extends Controller class MainController extends AbstractController
{ {
public function index(): Response public function index(): Response
{ {

View file

@ -3,13 +3,13 @@
namespace App\Controller; namespace App\Controller;
use App\Form\LoginType; use App\Form\LoginType;
use Symfony\Bundle\FrameworkBundle\Controller\Controller; use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
use Symfony\Component\Form\Extension\Core\Type\SubmitType; use Symfony\Component\Form\Extension\Core\Type\SubmitType;
use Symfony\Component\Form\{FormError, FormInterface}; use Symfony\Component\Form\{FormError, FormInterface};
use Symfony\Component\HttpFoundation\{Request, Response}; use Symfony\Component\HttpFoundation\{Request, Response};
use Symfony\Component\Security\Http\Authentication\AuthenticationUtils; use Symfony\Component\Security\Http\Authentication\AuthenticationUtils;
class SecurityController extends Controller class SecurityController extends AbstractController
{ {
public function login(Request $request, AuthenticationUtils $authenticationUtils): Response public function login(Request $request, AuthenticationUtils $authenticationUtils): Response
{ {

View file

@ -6,10 +6,10 @@ use App\Magnetico\Entity\Torrent;
use App\Search\TorrentSearcher; use App\Search\TorrentSearcher;
use Pagerfanta\Adapter\DoctrineORMAdapter; use Pagerfanta\Adapter\DoctrineORMAdapter;
use Pagerfanta\Pagerfanta; use Pagerfanta\Pagerfanta;
use Symfony\Bundle\FrameworkBundle\Controller\Controller; use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
use Symfony\Component\HttpFoundation\{Request, Response}; use Symfony\Component\HttpFoundation\{Request, Response};
class TorrentController extends Controller class TorrentController extends AbstractController
{ {
private const PER_PAGE = 20; private const PER_PAGE = 20;

View file

@ -7,12 +7,12 @@ use App\FormRequest\CreateUserRequest;
use App\Repository\InviteRepository; use App\Repository\InviteRepository;
use App\User\{InviteManager, UserManager}; use App\User\{InviteManager, UserManager};
use Doctrine\ORM\EntityManagerInterface; use Doctrine\ORM\EntityManagerInterface;
use Symfony\Bundle\FrameworkBundle\Controller\Controller; use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
use Symfony\Component\Form\Extension\Core\Type\SubmitType; use Symfony\Component\Form\Extension\Core\Type\SubmitType;
use Symfony\Component\Form\FormInterface; use Symfony\Component\Form\FormInterface;
use Symfony\Component\HttpFoundation\{Request, Response}; use Symfony\Component\HttpFoundation\{Request, Response};
class UserController extends Controller class UserController extends AbstractController
{ {
public function register( public function register(
string $inviteCode, string $inviteCode,

View file

@ -3,86 +3,111 @@
namespace App\Security; namespace App\Security;
use App\Api\V1\DTO\ApiResponse; use App\Api\V1\DTO\ApiResponse;
use App\Entity\User;
use App\Repository\ApiTokenRepository;
use App\Security\Token\AuthenticatedApiToken; use App\Security\Token\AuthenticatedApiToken;
use Symfony\Component\HttpFoundation\{JsonResponse, Request}; use Symfony\Component\HttpFoundation\{JsonResponse, Request, RequestStack, Response};
use Symfony\Component\Security\Core\Authentication\Token\{PreAuthenticatedToken, TokenInterface}; use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
use Symfony\Component\Security\Core\Exception\{AuthenticationException, BadCredentialsException, CustomUserMessageAuthenticationException}; use Symfony\Component\Security\Core\Exception\AuthenticationException;
use Symfony\Component\Security\Core\User\UserProviderInterface; use Symfony\Component\Security\Core\User\{UserInterface, UserProviderInterface};
use Symfony\Component\Security\Http\Authentication\{AuthenticationFailureHandlerInterface, SimplePreAuthenticatorInterface}; use Symfony\Component\Security\Guard\AbstractGuardAuthenticator;
use Symfony\Component\Serializer\SerializerInterface; use Symfony\Component\Serializer\SerializerInterface;
class ApiTokenAuthenticator implements SimplePreAuthenticatorInterface, AuthenticationFailureHandlerInterface class ApiTokenAuthenticator extends AbstractGuardAuthenticator
{ {
public const TOKEN_HEADER = 'api-token'; public const TOKEN_HEADER = 'api-token';
/** @var ApiTokenRepository */
private $tokenRepo;
/** @var SerializerInterface */ /** @var SerializerInterface */
private $serializer; private $serializer;
public function __construct(SerializerInterface $serializer) /** @var RequestStack */
private $requestStack;
public function __construct(SerializerInterface $serializer, ApiTokenRepository $tokenRepo, RequestStack $requestStack)
{ {
$this->serializer = $serializer; $this->serializer = $serializer;
$this->tokenRepo = $tokenRepo;
// Crutch for Guard simplified auth to retrieve 'api-token' header in the createAuthenticatedToken()
$this->requestStack = $requestStack;
} }
/** Takes request data and creates token which will be ready to auth check */ public function supports(Request $request): bool
public function createToken(Request $request, $providerKey)
{ {
if (!($tokenKey = $request->headers->get(self::TOKEN_HEADER))) { return $request->headers->has(self::TOKEN_HEADER);
// Throwing exception here will break anonymous authentication for login method }
//throw new BadCredentialsException(sprintf('\'%s\' is invalid or not defined', self::TOKEN_HEADER));
public function getCredentials(Request $request)
{
return [
'token' => $request->headers->get(self::TOKEN_HEADER),
];
}
public function getUser($credentials, UserProviderInterface $userProvider): ?User
{
if (null === $token = $credentials['token']) {
return null; return null;
} }
return new PreAuthenticatedToken( return $this->tokenRepo->findUserByTokenKey($token);
'anon.',
$tokenKey,
$providerKey
);
} }
public function authenticateToken(TokenInterface $token, UserProviderInterface $userProvider, $providerKey) public function start(Request $request, AuthenticationException $authException = null)
{ {
if (!$userProvider instanceof ApiTokenUserProvider) { $message = sprintf('You need to use \'%s\' in your request: %s', self::TOKEN_HEADER, $authException ? $authException->getMessage() : '');
throw new \InvalidArgumentException(sprintf(
'The user provider for providerKey = \'%s\' must be an instance of %s, %s given.',
$providerKey,
ApiTokenUserProvider::class,
get_class($userProvider)
));
}
$apiTokenKey = $token->getCredentials(); $json = $this->serializer->serialize(
new ApiResponse(null, JsonResponse::HTTP_UNAUTHORIZED, $message),
$user = $userProvider->loadUserByUsername($apiTokenKey); 'json',
['groups' => ['api']]
if (!$user) {
throw new CustomUserMessageAuthenticationException(sprintf(
'API token \'%s\' does not exist.', $apiTokenKey
));
}
return new AuthenticatedApiToken(
$user,
$apiTokenKey,
$providerKey,
$user->getRoles()
); );
return new JsonResponse($json, Response::HTTP_UNAUTHORIZED,[], true);
} }
public function checkCredentials($credentials, UserInterface $user)
{
// No credentials check needed in case of token auth
return true;
}
public function onAuthenticationSuccess(Request $request, TokenInterface $token, $providerKey)
{
// No response object needed in token auth
return null;
}
public function supportsRememberMe()
{
// Remember me functionality don't needed in token auth
return false;
}
public function onAuthenticationFailure(Request $request, AuthenticationException $exception): JsonResponse public function onAuthenticationFailure(Request $request, AuthenticationException $exception): JsonResponse
{ {
// @todo Decouple with App\Api\V1\DTO // @todo Decouple with App\Api\V1\DTO
$json = $this->serializer->serialize( $json = $this->serializer->serialize(
new ApiResponse(null, JsonResponse::HTTP_UNAUTHORIZED, $exception->getMessage()), new ApiResponse(null, JsonResponse::HTTP_UNAUTHORIZED, $exception->getMessage()),
'json', 'json',
['groups' => ['api_v1']] ['groups' => ['api']]
); );
return new JsonResponse($json, JsonResponse::HTTP_UNAUTHORIZED,[], true); return new JsonResponse($json, JsonResponse::HTTP_UNAUTHORIZED,[], true);
} }
public function createAuthenticatedToken(UserInterface $user, $providerKey)
public function supportsToken(TokenInterface $token, $providerKey)
{ {
return $token instanceof PreAuthenticatedToken && $token->getProviderKey() === $providerKey; $tokenKey = $this->requestStack->getCurrentRequest()->headers->get(self::TOKEN_HEADER);
return new AuthenticatedApiToken(
$user,
$tokenKey,
$providerKey,
$user->getRoles()
);
} }
} }

View file

@ -1,39 +0,0 @@
<?php
namespace App\Security;
use App\Entity\User;
use App\Repository\ApiTokenRepository;
use Symfony\Component\Security\Core\Exception\{UnsupportedUserException, UsernameNotFoundException};
use Symfony\Component\Security\Core\User\{UserInterface, UserProviderInterface};
class ApiTokenUserProvider implements UserProviderInterface
{
/** @var ApiTokenRepository */
private $userRepo;
public function __construct(ApiTokenRepository $userRepo)
{
$this->userRepo = $userRepo;
}
public function loadUserByUsername($username): User
{
if (null === $user = $this->userRepo->findUserByTokenKey($username)) {
throw new UsernameNotFoundException(sprintf('Token \'%s\' is not found.', $username));
}
return $user;
}
public function refreshUser(UserInterface $user)
{
throw new UnsupportedUserException();
}
public function supportsClass($class): bool
{
return User::class === $class;
}
}