vendor/shopware/core/Framework/Api/EventListener/Authentication/ApiAuthenticationListener.php line 92

Open in your IDE?
  1. <?php declare(strict_types=1);
  3. namespace Shopware\Core\Framework\Api\EventListener\Authentication;
  5. use League\OAuth2\Server\AuthorizationServer;
  6. use League\OAuth2\Server\Grant\ClientCredentialsGrant;
  7. use League\OAuth2\Server\Grant\PasswordGrant;
  8. use League\OAuth2\Server\Grant\RefreshTokenGrant;
  9. use League\OAuth2\Server\Repositories\RefreshTokenRepositoryInterface;
  10. use League\OAuth2\Server\Repositories\UserRepositoryInterface;
  11. use League\OAuth2\Server\ResourceServer;
  12. use Shopware\Core\Framework\Routing\ApiContextRouteScopeDependant;
  13. use Shopware\Core\Framework\Routing\KernelListenerPriorities;
  14. use Shopware\Core\Framework\Routing\RouteScopeCheckTrait;
  15. use Shopware\Core\Framework\Routing\RouteScopeRegistry;
  16. use Symfony\Bridge\PsrHttpMessage\Factory\PsrHttpFactory;
  17. use Symfony\Component\EventDispatcher\EventSubscriberInterface;
  18. use Symfony\Component\HttpKernel\Event\ControllerEvent;
  19. use Symfony\Component\HttpKernel\Event\RequestEvent;
  20. use Symfony\Component\HttpKernel\KernelEvents;
  22. /**
  23.  * @deprecated tag:v6.5.0 - reason:becomes-internal - EventSubscribers will become internal in v6.5.0
  24.  */
  25. class ApiAuthenticationListener implements EventSubscriberInterface
  26. {
  27.     use RouteScopeCheckTrait;
  29.     private ResourceServer $resourceServer;
  31.     private AuthorizationServer $authorizationServer;
  33.     private UserRepositoryInterface $userRepository;
  35.     private RefreshTokenRepositoryInterface $refreshTokenRepository;
  37.     private PsrHttpFactory $psrHttpFactory;
  39.     private RouteScopeRegistry $routeScopeRegistry;
  41.     /**
  42.      * @internal
  43.      */
  44.     public function __construct(
  45.         ResourceServer $resourceServer,
  46.         AuthorizationServer $authorizationServer,
  47.         UserRepositoryInterface $userRepository,
  48.         RefreshTokenRepositoryInterface $refreshTokenRepository,
  49.         PsrHttpFactory $psrHttpFactory,
  50.         RouteScopeRegistry $routeScopeRegistry
  51.     ) {
  52.         $this->resourceServer = $resourceServer;
  53.         $this->authorizationServer = $authorizationServer;
  54.         $this->userRepository = $userRepository;
  55.         $this->refreshTokenRepository = $refreshTokenRepository;
  56.         $this->psrHttpFactory = $psrHttpFactory;
  57.         $this->routeScopeRegistry = $routeScopeRegistry;
  58.     }
  60.     public static function getSubscribedEvents(): array
  61.     {
  62.         return [
  63.             KernelEvents::REQUEST => [
  64.                 ['setupOAuth', 128],
  65.             ],
  66.             KernelEvents::CONTROLLER => [
  67.                 ['validateRequest', KernelListenerPriorities::KERNEL_CONTROLLER_EVENT_PRIORITY_AUTH_VALIDATE],
  68.             ],
  69.         ];
  70.     }
  72.     public function setupOAuth(RequestEvent $event): void
  73.     {
  74.         if (!$event->isMainRequest()) {
  75.             return;
  76.         }
  78.         $tenMinuteInterval = new \DateInterval('PT10M');
  79.         $oneWeekInterval = new \DateInterval('P1W');
  81.         $passwordGrant = new PasswordGrant($this->userRepository, $this->refreshTokenRepository);
  82.         $passwordGrant->setRefreshTokenTTL($oneWeekInterval);
  84.         $refreshTokenGrant = new RefreshTokenGrant($this->refreshTokenRepository);
  85.         $refreshTokenGrant->setRefreshTokenTTL($oneWeekInterval);
  87.         $this->authorizationServer->enableGrantType($passwordGrant, $tenMinuteInterval);
  88.         $this->authorizationServer->enableGrantType($refreshTokenGrant, $tenMinuteInterval);
  89.         $this->authorizationServer->enableGrantType(new ClientCredentialsGrant(), $tenMinuteInterval);
  90.     }
  92.     public function validateRequest(ControllerEvent $event): void
  93.     {
  94.         $request = $event->getRequest();
  96.         if (!$request->attributes->get('auth_required', true)) {
  97.             return;
  98.         }
  100.         if (!$this->isRequestScoped($request, ApiContextRouteScopeDependant::class)) {
  101.             return;
  102.         }
  104.         $psr7Request = $this->psrHttpFactory->createRequest($event->getRequest());
  105.         $psr7Request = $this->resourceServer->validateAuthenticatedRequest($psr7Request);
  107.         $request->attributes->add($psr7Request->getAttributes());
  108.     }
  110.     protected function getScopeRegistry(): RouteScopeRegistry
  111.     {
  112.         return $this->routeScopeRegistry;
  113.     }
  114. }