110 lines
2.6 KiB
PHP
110 lines
2.6 KiB
PHP
<?php
|
|
|
|
namespace App\Http\Middleware;
|
|
|
|
use App\Models\User;
|
|
use Closure;
|
|
use Illuminate\Auth\RequestGuard;
|
|
use Illuminate\Contracts\Auth\Factory as Auth;
|
|
use Illuminate\Http\Request;
|
|
use Symfony\Component\HttpKernel\Exception\UnauthorizedHttpException;
|
|
|
|
/**
|
|
* Authenticate user with Basic Authentication, with Sanctum token on password field.
|
|
*
|
|
* Examples:
|
|
* curl -u "email@example.com:$TOKEN" -X PROPFIND https://localhost/dav/
|
|
*/
|
|
class AuthenticateWithTokenOnBasicAuth
|
|
{
|
|
/**
|
|
* Create a new middleware instance.
|
|
*
|
|
* @param \Illuminate\Contracts\Auth\Factory $auth
|
|
* @return void
|
|
*/
|
|
public function __construct(
|
|
private Auth $auth
|
|
) {
|
|
}
|
|
|
|
/**
|
|
* Handle an incoming request.
|
|
*
|
|
* @param \Illuminate\Http\Request $request
|
|
* @param \Closure $next
|
|
* @return mixed
|
|
*/
|
|
public function handle(Request $request, Closure $next)
|
|
{
|
|
if (! $this->basicAuth($request)) {
|
|
$this->failedBasicResponse();
|
|
}
|
|
|
|
return $next($request);
|
|
}
|
|
|
|
/**
|
|
* Try Bearer authentication, with token in 'password' field on basic auth.
|
|
*
|
|
* @param \Illuminate\Http\Request $request
|
|
* @return bool
|
|
*/
|
|
private function basicAuth(Request $request): bool
|
|
{
|
|
if (($user = $this->sanctumUser($request)) !== null) {
|
|
$this->auth->guard()->setUser($user);
|
|
|
|
return true;
|
|
}
|
|
|
|
return false;
|
|
}
|
|
|
|
/**
|
|
* Authenticate user.
|
|
*
|
|
* @param \Illuminate\Http\Request $request
|
|
* @return User|null
|
|
*/
|
|
private function sanctumUser(Request $request): ?User
|
|
{
|
|
/** @var ?User */
|
|
$user = $this->sanctum()->setRequest($request)->user();
|
|
|
|
// if there is no bearer token PHP_AUTH_USER header must match user email
|
|
if ($user->currentAccessToken() !== null
|
|
&& $request->bearerToken() !== null
|
|
&& $request->getUser() !== $user->email) {
|
|
return null;
|
|
}
|
|
|
|
return $user;
|
|
}
|
|
|
|
/**
|
|
* Get sanctum guard.
|
|
*
|
|
* @return \Illuminate\Auth\RequestGuard
|
|
*/
|
|
protected function sanctum(): RequestGuard
|
|
{
|
|
/** @var \Illuminate\Auth\RequestGuard */
|
|
$guard = $this->auth->guard('sanctum');
|
|
|
|
return $guard;
|
|
}
|
|
|
|
/**
|
|
* Get the response for basic authentication.
|
|
*
|
|
* @return void
|
|
*
|
|
* @throws \Symfony\Component\HttpKernel\Exception\UnauthorizedHttpException
|
|
*/
|
|
protected function failedBasicResponse(): void
|
|
{
|
|
throw new UnauthorizedHttpException('Basic', 'Invalid credentials.');
|
|
}
|
|
}
|