added API tokens, deprecate API passwords (#4637)

config/packages/nelmio_api_doc.yaml

@@ -48,19 +48,13 @@ nelmio_api_doc:
             title: Kimai - API Docs
             description: |
                 JSON API for the Kimai time-tracking software: [API documentation](https://www.kimai.org/documentation/rest-api.html), [Swagger definition file](doc.json)
-            version: '0.7'
+            version: '1.0'
         components:
             securitySchemes:
-                apiUser:
-                    type: apiKey
-                    description: 'Value: {Username}'
-                    name: X-AUTH-USER
-                    in: header
-                apiToken:
-                    type: apiKey
-                    description: 'Value: {API Token}'
-                    name: X-AUTH-TOKEN
-                    in: header
+                bearer:
+                    type: http
+                    scheme: bearer
+                    bearerFormat: KIMAI
+                    description: API Token
         security:
-            - X-AUTH-USER: []
-              X-AUTH-TOKEN: []
+            - bearer: []

config/packages/security.yaml

@@ -18,6 +18,8 @@ security:
             security: false
 
         api:
+            access_token:
+                token_handler: App\API\Authentication\AccessTokenHandler
             request_matcher: App\API\Authentication\ApiRequestMatcher
             user_checker: App\Security\UserChecker
             stateless: true
@@ -35,7 +37,6 @@ security:
             entry_point: form_login
 
             custom_authenticators:
-                - App\API\Authentication\SessionAuthenticator
                 - App\Saml\SamlAuthenticator
 
             remember_me:

config/services.yaml

@@ -197,6 +197,11 @@ services:
         factory:   ['@doctrine.orm.entity_manager', getRepository]
         arguments: ['App\Entity\WorkingTime']
 
+    App\Repository\AccessTokenRepository:
+        class:     App\Repository\AccessTokenRepository
+        factory:   ['@doctrine.orm.entity_manager', getRepository]
+        arguments: ['App\Entity\AccessToken']
+
     monolog.formatter.kimai:
         class: Monolog\Formatter\LineFormatter
         arguments: