Repository navigation
Expand file tree
/
Copy pathApiAuthenticate.php
More file actions
65 lines (54 loc) · 1.86 KB
/
Copy pathApiAuthenticate.php
File metadata and controls
65 lines (54 loc) · 1.86 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
<?php
namespace BookStack\Http\Middleware;
use BookStack\Exceptions\ApiAuthException;
use BookStack\Permissions\Permission;
use Closure;
use Illuminate\Http\Request;
class ApiAuthenticate
{
/**
* Handle an incoming request.
*
* @throws ApiAuthException
*/
public function handle(Request $request, Closure $next)
{
// Validate the token and it's users API access
$this->ensureAuthorizedBySessionOrToken($request);
return $next($request);
}
/**
* Ensure the current user can access authenticated API routes, either via existing session
* authentication or via API Token authentication.
*
* @throws ApiAuthException
*/
protected function ensureAuthorizedBySessionOrToken(Request $request): void
{
// Use the active user session already exists.
// This is to make it easy to explore API endpoints via the UI.
if (session()->isStarted()) {
// Ensure the user has API access permission
if (!$this->sessionUserHasApiAccess()) {
throw new ApiAuthException(trans('errors.api_user_no_api_permission'), 403);
}
// Only allow GET requests for cookie-based API usage
if ($request->method() !== 'GET') {
throw new ApiAuthException(trans('errors.api_cookie_auth_only_get'), 403);
}
return;
}
// Set our api guard to be the default for this request lifecycle.
auth()->shouldUse('api');
// Validate the token and its users API access
auth()->authenticate();
}
/**
* Check if the active session user has API access.
*/
protected function sessionUserHasApiAccess(): bool
{
$hasApiPermission = user()->can(Permission::AccessApi);
return $hasApiPermission && user()->hasAppAccess();
}
}