vendor/shopware/core/Framework/Api/EventListener/Authentication/ApiAuthenticationListener.php line 74

Open in your IDE?
  1. <?php declare(strict_types=1);
  3. namespace Shopware\Core\Framework\Api\EventListener\Authentication;
  5. use League\OAuth2\Server\AuthorizationServer;
  6. use League\OAuth2\Server\Grant\ClientCredentialsGrant;
  7. use League\OAuth2\Server\Grant\PasswordGrant;
  8. use League\OAuth2\Server\Grant\RefreshTokenGrant;
  9. use League\OAuth2\Server\Repositories\RefreshTokenRepositoryInterface;
  10. use League\OAuth2\Server\Repositories\UserRepositoryInterface;
  11. use League\OAuth2\Server\ResourceServer;
  12. use Shopware\Core\Framework\Log\Package;
  13. use Shopware\Core\Framework\Routing\ApiContextRouteScopeDependant;
  14. use Shopware\Core\Framework\Routing\KernelListenerPriorities;
  15. use Shopware\Core\Framework\Routing\RouteScopeCheckTrait;
  16. use Shopware\Core\Framework\Routing\RouteScopeRegistry;
  17. use Symfony\Bridge\PsrHttpMessage\Factory\PsrHttpFactory;
  18. use Symfony\Component\EventDispatcher\EventSubscriberInterface;
  19. use Symfony\Component\HttpKernel\Event\ControllerEvent;
  20. use Symfony\Component\HttpKernel\Event\RequestEvent;
  21. use Symfony\Component\HttpKernel\KernelEvents;
  23. /**
  24.  * @deprecated tag:v6.5.0 - reason:becomes-internal - EventSubscribers will become internal in v6.5.0
  25.  */
  26. #[Package('core')]
  27. class ApiAuthenticationListener implements EventSubscriberInterface
  28. {
  29.     use RouteScopeCheckTrait;
  31.     private ResourceServer $resourceServer;
  33.     private AuthorizationServer $authorizationServer;
  35.     private UserRepositoryInterface $userRepository;
  37.     private RefreshTokenRepositoryInterface $refreshTokenRepository;
  39.     private PsrHttpFactory $psrHttpFactory;
  41.     private RouteScopeRegistry $routeScopeRegistry;
  43.     /**
  44.      * @internal
  45.      */
  46.     public function __construct(
  47.         ResourceServer $resourceServer,
  48.         AuthorizationServer $authorizationServer,
  49.         UserRepositoryInterface $userRepository,
  50.         RefreshTokenRepositoryInterface $refreshTokenRepository,
  51.         PsrHttpFactory $psrHttpFactory,
  52.         RouteScopeRegistry $routeScopeRegistry
  53.     ) {
  54.         $this->resourceServer = $resourceServer;
  55.         $this->authorizationServer = $authorizationServer;
  56.         $this->userRepository = $userRepository;
  57.         $this->refreshTokenRepository = $refreshTokenRepository;
  58.         $this->psrHttpFactory = $psrHttpFactory;
  59.         $this->routeScopeRegistry = $routeScopeRegistry;
  60.     }
  62.     public static function getSubscribedEvents(): array
  63.     {
  64.         return [
  65.             KernelEvents::REQUEST => [
  66.                 ['setupOAuth', 128],
  67.             ],
  68.             KernelEvents::CONTROLLER => [
  69.                 ['validateRequest', KernelListenerPriorities::KERNEL_CONTROLLER_EVENT_PRIORITY_AUTH_VALIDATE],
  70.             ],
  71.         ];
  72.     }
  74.     public function setupOAuth(RequestEvent $event): void
  75.     {
  76.         if (!$event->isMainRequest()) {
  77.             return;
  78.         }
  80.         $tenMinuteInterval = new \DateInterval('PT10M');
  81.         $oneWeekInterval = new \DateInterval('P1W');
  83.         $passwordGrant = new PasswordGrant($this->userRepository, $this->refreshTokenRepository);
  84.         $passwordGrant->setRefreshTokenTTL($oneWeekInterval);
  86.         $refreshTokenGrant = new RefreshTokenGrant($this->refreshTokenRepository);
  87.         $refreshTokenGrant->setRefreshTokenTTL($oneWeekInterval);
  89.         $this->authorizationServer->enableGrantType($passwordGrant, $tenMinuteInterval);
  90.         $this->authorizationServer->enableGrantType($refreshTokenGrant, $tenMinuteInterval);
  91.         $this->authorizationServer->enableGrantType(new ClientCredentialsGrant(), $tenMinuteInterval);
  92.     }
  94.     public function validateRequest(ControllerEvent $event): void
  95.     {
  96.         $request = $event->getRequest();
  98.         if (!$request->attributes->get('auth_required', true)) {
  99.             return;
  100.         }
  102.         if (!$this->isRequestScoped($request, ApiContextRouteScopeDependant::class)) {
  103.             return;
  104.         }
  106.         $psr7Request = $this->psrHttpFactory->createRequest($event->getRequest());
  107.         $psr7Request = $this->resourceServer->validateAuthenticatedRequest($psr7Request);
  109.         $request->attributes->add($psr7Request->getAttributes());
  110.     }
  112.     protected function getScopeRegistry(): RouteScopeRegistry
  113.     {
  114.         return $this->routeScopeRegistry;
  115.     }
  116. }