51 lines
2.1 KiB
PHP
51 lines
2.1 KiB
PHP
<?php
|
|
|
|
/*
|
|
* This file is part of the Kimai time-tracking app.
|
|
*
|
|
* For the full copyright and license information, please view the LICENSE
|
|
* file that was distributed with this source code.
|
|
*/
|
|
|
|
namespace App\API\Authentication;
|
|
|
|
use Symfony\Component\HttpFoundation\Request;
|
|
use Symfony\Component\HttpFoundation\RequestMatcherInterface;
|
|
|
|
final class ApiRequestMatcher implements RequestMatcherInterface
|
|
{
|
|
public function matches(Request $request): bool
|
|
{
|
|
// we do not want to handle URLs that are not in the API scope
|
|
if (!str_starts_with($request->getRequestUri(), '/api/')) {
|
|
return false;
|
|
}
|
|
|
|
// API documentation is only available to registered and logged-in users
|
|
if (str_starts_with($request->getRequestUri(), '/api/doc')) {
|
|
return false;
|
|
}
|
|
|
|
// ------------------------------------------------------------------------------------
|
|
// the next two checks are primarily here to make sure to return proper error messages
|
|
|
|
// let's use this firewall if a Bearer token is set in the header
|
|
// other cases like "bearer" are rejected earlier
|
|
if (($auth = $request->headers->get('Authorization')) !== null && str_starts_with($auth, 'Bearer ')) {
|
|
return true;
|
|
}
|
|
|
|
// let's use this firewall if the deprecated username & token combination is available
|
|
if ($request->headers->has(TokenAuthenticator::HEADER_USERNAME) && // @phpstan-ignore classConstant.deprecatedClass
|
|
$request->headers->has(TokenAuthenticator::HEADER_TOKEN)) { // @phpstan-ignore classConstant.deprecatedClass
|
|
return true;
|
|
}
|
|
// ------------------------------------------------------------------------------------
|
|
|
|
// checking for a previous session allows us to skip the API firewall and token access handler
|
|
// we simply re-use the existing session when doing API calls from the frontend.
|
|
// it is not necessary to check headers. if there is no valid session, we should always use this firewall
|
|
return !$request->hasPreviousSession();
|
|
}
|
|
}
|