-
Notifications
You must be signed in to change notification settings - Fork 3
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
IBX-8356: Reworked `Ibexa\Core\MVC\Symfony\Security\Authentication\Au…
…thenticatorInterface` usages to comply with Symfony-based authentication (#101) * IBX-8290: Reworked REST authentication to comply with the new Symfony authenticator mechanism under separate firewall * improved UnauthorizedException throwing, introduced dedicated exception * IBX-8290: Re-implemented REST authorization to comply with the new authenticators mechanism * IBX-8290: Reworked REST authentication to comply with the new Symfony authenticator mechanism under separate firewall * removed CsrfTokenManagerTest as it brings not much value, regenerated PHPStan * fixed test case * adjusted test cases, fixed outstanding PHPStan issues * reverted session refresh endpoint removal * part1 of unit tests reworking * part2 of unit tests reworking * fixed expected authorization error, fixed deprecation in BaseContentTest * narrowed down authentication for cases were both Accept and Content-Type headers are provided * fixed several functional test cases * made `$userId` more strict type-wise * added InteractiveLoginEvent support * changed RestAuthenticator to be triggered by route instead of headers * IBX-8290: Re-implemented REST authorization to comply with the new authenticators mechanism * IBX-8290: Reworked REST authentication to comply with the new Symfony authenticator mechanism under separate firewall * removed CsrfTokenManagerTest as it brings not much value, regenerated PHPStan * adjusted test cases, fixed outstanding PHPStan issues * reverted session refresh endpoint removal * part2 of unit tests reworking * fixed expected authorization error, fixed deprecation in BaseContentTest * narrowed down authentication for cases were both Accept and Content-Type headers are provided * IBX-8356: Reworked `Ibexa\Core\MVC\Symfony\Security\Authentication\AuthenticatorInterface` usages to comply with Symfony-based authentication * IBX-8356: Reworked `Ibexa\Core\MVC\Symfony\Security\Authentication\AuthenticatorInterface` usages to comply with Symfony-based authentication * IBX-8356: Reworked `Ibexa\Core\MVC\Symfony\Security\Authentication\AuthenticatorInterface` usages to comply with Symfony-based authentication * added old Content-Type header replacing subscriber * provided BC for REST response for JWT, documented parts that need to be dropped on the new REST API release * added listeners test coverage * restored original controller * cr remarks * documented AuthorizationHeaderRESTRequestMatcher usage * cr remark vol.2 * cr remark vol.3 * added failsafe for non-rest requests * fixes after rebase
- Loading branch information
1 parent
450c2f1
commit dedcfa0
Showing
23 changed files
with
411 additions
and
491 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
78 changes: 78 additions & 0 deletions
78
src/lib/Security/EventListener/JWT/AuthenticationSuccessSubscriber.php
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,78 @@ | ||
| <?php | ||
|
|
||
| /** | ||
| * @copyright Copyright (C) Ibexa AS. All rights reserved. | ||
| * @license For full copyright and license information view LICENSE file distributed with this source code. | ||
| */ | ||
| declare(strict_types=1); | ||
|
|
||
| namespace Ibexa\Rest\Security\EventListener\JWT; | ||
|
|
||
| use Ibexa\Contracts\Core\Repository\PermissionResolver; | ||
| use Ibexa\Core\MVC\Symfony\Security\UserInterface as IbexaUser; | ||
| use Ibexa\Rest\Server\Exceptions\BadResponseException; | ||
| use Lexik\Bundle\JWTAuthenticationBundle\Event\AuthenticationSuccessEvent; | ||
| use Lexik\Bundle\JWTAuthenticationBundle\Events; | ||
| use Symfony\Component\EventDispatcher\EventSubscriberInterface; | ||
| use Symfony\Component\HttpFoundation\RequestStack; | ||
|
|
||
| final readonly class AuthenticationSuccessSubscriber implements EventSubscriberInterface | ||
| { | ||
| public function __construct( | ||
| private PermissionResolver $permissionResolver, | ||
| private RequestStack $requestStack, | ||
| ) { | ||
| } | ||
|
|
||
| public static function getSubscribedEvents(): array | ||
| { | ||
| return [ | ||
| Events::AUTHENTICATION_SUCCESS => ['onAuthenticationSuccess', 10], | ||
| ]; | ||
| } | ||
|
|
||
| public function onAuthenticationSuccess(AuthenticationSuccessEvent $event): void | ||
| { | ||
| $request = $this->requestStack->getCurrentRequest(); | ||
| if ($request === null) { | ||
| return; | ||
| } | ||
|
|
||
| if (!$request->attributes->get('is_rest_request')) { | ||
| return; | ||
| } | ||
|
|
||
| $user = $event->getUser(); | ||
| if ($user instanceof IbexaUser) { | ||
| $this->permissionResolver->setCurrentUserReference($user->getAPIUser()); | ||
| } | ||
|
|
||
| $this->normalizeResponseToRest($event); | ||
| } | ||
|
|
||
| /* | ||
| * This method provides BC compatibility for the JWT Token REST response | ||
| * since the new Lexik/JWT json_login authenticator changes its form. | ||
| * | ||
| * @deprecated 5.0.0. Will be removed in the next REST API version. | ||
| */ | ||
| /** | ||
| * @throws \Ibexa\Rest\Server\Exceptions\BadResponseException | ||
| */ | ||
| private function normalizeResponseToRest(AuthenticationSuccessEvent $event): void | ||
| { | ||
| $eventData = $event->getData(); | ||
| if (!isset($eventData['token'])) { | ||
| throw new BadResponseException('JWT Token has not been generated.'); | ||
| } | ||
|
|
||
| $token = $eventData['token']; | ||
| $event->setData([ | ||
| 'JWT' => [ | ||
| '_media-type' => 'application/vnd.ibexa.api.JWT+json', | ||
| '_token' => $token, | ||
| 'token' => $token, | ||
| ], | ||
| ]); | ||
| } | ||
| } |
46 changes: 46 additions & 0 deletions
46
src/lib/Security/EventListener/JWT/JsonLoginHeaderReplacingSubscriber.php
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,46 @@ | ||
| <?php | ||
|
|
||
| /** | ||
| * @copyright Copyright (C) Ibexa AS. All rights reserved. | ||
| * @license For full copyright and license information view LICENSE file distributed with this source code. | ||
| */ | ||
| declare(strict_types=1); | ||
|
|
||
| namespace Ibexa\Rest\Security\EventListener\JWT; | ||
|
|
||
| use Symfony\Component\EventDispatcher\EventSubscriberInterface; | ||
| use Symfony\Component\HttpKernel\Event\RequestEvent; | ||
| use Symfony\Component\HttpKernel\KernelEvents; | ||
|
|
||
| /** | ||
| * JWT authentication since Symfony 5.4 relies on `json_login` hence `application/json` header is required. | ||
| * Therefore, there has to be a way to replace prior `application/vnd.ibexa.api.JWTInput+json` header whenever JWT authentication | ||
| * is triggered. | ||
| * | ||
| * @deprecated: Drop on releasing the new REST API version. | ||
| */ | ||
| final readonly class JsonLoginHeaderReplacingSubscriber implements EventSubscriberInterface | ||
| { | ||
| private const string CONTENT_TYPE_HEADER = 'Content-Type'; | ||
|
|
||
| public static function getSubscribedEvents(): array | ||
| { | ||
| return [ | ||
| KernelEvents::REQUEST => ['replaceJsonLoginHeader', 10], | ||
| ]; | ||
| } | ||
|
|
||
| public function replaceJsonLoginHeader(RequestEvent $event): void | ||
| { | ||
| $request = $event->getRequest(); | ||
| if (!$request->headers->has(self::CONTENT_TYPE_HEADER)) { | ||
| return; | ||
| } | ||
|
|
||
| if ($request->headers->get(self::CONTENT_TYPE_HEADER) !== 'application/vnd.ibexa.api.JWTInput+json') { | ||
| return; | ||
| } | ||
|
|
||
| $request->headers->set(self::CONTENT_TYPE_HEADER, 'application/json'); | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,15 @@ | ||
| <?php | ||
|
|
||
| /** | ||
| * @copyright Copyright (C) Ibexa AS. All rights reserved. | ||
| * @license For full copyright and license information view LICENSE file distributed with this source code. | ||
| */ | ||
| declare(strict_types=1); | ||
|
|
||
| namespace Ibexa\Rest\Server\Exceptions; | ||
|
|
||
| use RuntimeException; | ||
|
|
||
| final class BadResponseException extends RuntimeException | ||
| { | ||
| } |
This file was deleted.
Oops, something went wrong.
Oops, something went wrong.