added API tokens, deprecate API passwords (#4637)

src/API/Authentication/ApiRequestMatcher.php

@@ -16,16 +16,29 @@ final class ApiRequestMatcher implements RequestMatcherInterface
 {
     public function matches(Request $request): bool
     {
-        if (str_contains($request->getRequestUri(), '/api/doc')) {
+        // we do not want to handle URLs that
+        if (!str_starts_with($request->getRequestUri(), '/api/')) {
             return false;
         }
 
-        if (str_contains($request->getRequestUri(), '/api/')) {
+        // API documentation is only available to registered users
+        if (str_starts_with($request->getRequestUri(), '/api/doc')) {
             return false;
         }
 
-        return !$request->headers->has(SessionAuthenticator::HEADER_JAVASCRIPT) &&
-                $request->headers->has(TokenAuthenticator::HEADER_USERNAME) &&
-                $request->headers->has(TokenAuthenticator::HEADER_TOKEN);
+        // let's use this firewall if a Bearer token is set in the header
+        if ($request->headers->has('Authorization')) {
+            return true;
+        }
+
+        // let's use this firewall if the deprecated username & token combination is available
+        if ($request->headers->has(TokenAuthenticator::HEADER_USERNAME) &&
+            $request->headers->has(TokenAuthenticator::HEADER_TOKEN)) {
+            return true;
+        }
+
+        // checking for a previous session allows us to skip the API firewall and token access handler
+        // we simply re-use the existing session when doing API calls from the frontend
+        return !$request->hasPreviousSession();
     }
 }