vendor/shopware/core/Framework/Api/EventListener/Authentication/ApiAuthenticationListener.php line 87

Open in your IDE?
  1. <?php declare(strict_types=1);
  3. namespace Shopware\Core\Framework\Api\EventListener\Authentication;
  5. use League\OAuth2\Server\AuthorizationServer;
  6. use League\OAuth2\Server\Grant\ClientCredentialsGrant;
  7. use League\OAuth2\Server\Grant\PasswordGrant;
  8. use League\OAuth2\Server\Grant\RefreshTokenGrant;
  9. use League\OAuth2\Server\Repositories\RefreshTokenRepositoryInterface;
  10. use League\OAuth2\Server\Repositories\UserRepositoryInterface;
  11. use League\OAuth2\Server\ResourceServer;
  12. use Shopware\Core\Framework\Routing\ApiContextRouteScopeDependant;
  13. use Shopware\Core\Framework\Routing\KernelListenerPriorities;
  14. use Shopware\Core\Framework\Routing\RouteScopeCheckTrait;
  15. use Shopware\Core\Framework\Routing\RouteScopeRegistry;
  16. use Symfony\Bridge\PsrHttpMessage\Factory\PsrHttpFactory;
  17. use Symfony\Component\EventDispatcher\EventSubscriberInterface;
  18. use Symfony\Component\HttpKernel\Event\ControllerEvent;
  19. use Symfony\Component\HttpKernel\Event\RequestEvent;
  20. use Symfony\Component\HttpKernel\KernelEvents;
  22. class ApiAuthenticationListener implements EventSubscriberInterface
  23. {
  24.     use RouteScopeCheckTrait;
  26.     /**
  27.      * @var ResourceServer
  28.      */
  29.     private $resourceServer;
  31.     /**
  32.      * @var AuthorizationServer
  33.      */
  34.     private $authorizationServer;
  36.     /**
  37.      * @var UserRepositoryInterface
  38.      */
  39.     private $userRepository;
  41.     /**
  42.      * @var RefreshTokenRepositoryInterface
  43.      */
  44.     private $refreshTokenRepository;
  46.     /**
  47.      * @var PsrHttpFactory
  48.      */
  49.     private $psrHttpFactory;
  51.     /**
  52.      * @var RouteScopeRegistry
  53.      */
  54.     private $routeScopeRegistry;
  56.     /**
  57.      * @internal
  58.      */
  59.     public function __construct(
  60.         ResourceServer $resourceServer,
  61.         AuthorizationServer $authorizationServer,
  62.         UserRepositoryInterface $userRepository,
  63.         RefreshTokenRepositoryInterface $refreshTokenRepository,
  64.         PsrHttpFactory $psrHttpFactory,
  65.         RouteScopeRegistry $routeScopeRegistry
  66.     ) {
  67.         $this->resourceServer = $resourceServer;
  68.         $this->authorizationServer = $authorizationServer;
  69.         $this->userRepository = $userRepository;
  70.         $this->refreshTokenRepository = $refreshTokenRepository;
  71.         $this->psrHttpFactory = $psrHttpFactory;
  72.         $this->routeScopeRegistry = $routeScopeRegistry;
  73.     }
  75.     public static function getSubscribedEvents(): array
  76.     {
  77.         return [
  78.             KernelEvents::REQUEST => [
  79.                 ['setupOAuth', 128],
  80.             ],
  81.             KernelEvents::CONTROLLER => [
  82.                 ['validateRequest', KernelListenerPriorities::KERNEL_CONTROLLER_EVENT_PRIORITY_AUTH_VALIDATE],
  83.             ],
  84.         ];
  85.     }
  87.     public function setupOAuth(RequestEvent $event): void
  88.     {
  89.         if (!$event->isMainRequest()) {
  90.             return;
  91.         }
  93.         $tenMinuteInterval = new \DateInterval('PT10M');
  94.         $oneWeekInterval = new \DateInterval('P1W');
  96.         $passwordGrant = new PasswordGrant($this->userRepository, $this->refreshTokenRepository);
  97.         $passwordGrant->setRefreshTokenTTL($oneWeekInterval);
  99.         $refreshTokenGrant = new RefreshTokenGrant($this->refreshTokenRepository);
  100.         $refreshTokenGrant->setRefreshTokenTTL($oneWeekInterval);
  102.         $this->authorizationServer->enableGrantType($passwordGrant, $tenMinuteInterval);
  103.         $this->authorizationServer->enableGrantType($refreshTokenGrant, $tenMinuteInterval);
  104.         $this->authorizationServer->enableGrantType(new ClientCredentialsGrant(), $tenMinuteInterval);
  105.     }
  107.     public function validateRequest(ControllerEvent $event): void
  108.     {
  109.         $request = $event->getRequest();
  111.         if (!$request->attributes->get('auth_required', true)) {
  112.             return;
  113.         }
  115.         if (!$this->isRequestScoped($request, ApiContextRouteScopeDependant::class)) {
  116.             return;
  117.         }
  119.         $psr7Request = $this->psrHttpFactory->createRequest($event->getRequest());
  120.         $psr7Request = $this->resourceServer->validateAuthenticatedRequest($psr7Request);
  122.         $request->attributes->add($psr7Request->getAttributes());
  123.     }
  125.     protected function getScopeRegistry(): RouteScopeRegistry
  126.     {
  127.         return $this->routeScopeRegistry;
  128.     }
  129. }