vendor/shopware/core/Framework/Api/EventListener/Authentication/ApiAuthenticationListener.php line 91

  1. <?php declare(strict_types=1);
  3. namespace Shopware\Core\Framework\Api\EventListener\Authentication;
  5. use League\OAuth2\Server\AuthorizationServer;
  6. use League\OAuth2\Server\Grant\ClientCredentialsGrant;
  7. use League\OAuth2\Server\Grant\PasswordGrant;
  8. use League\OAuth2\Server\Grant\RefreshTokenGrant;
  9. use League\OAuth2\Server\Repositories\RefreshTokenRepositoryInterface;
  10. use League\OAuth2\Server\Repositories\UserRepositoryInterface;
  11. use League\OAuth2\Server\ResourceServer;
  12. use Shopware\Core\Framework\Log\Package;
  13. use Shopware\Core\Framework\Routing\ApiContextRouteScopeDependant;
  14. use Shopware\Core\Framework\Routing\KernelListenerPriorities;
  15. use Shopware\Core\Framework\Routing\RouteScopeCheckTrait;
  16. use Shopware\Core\Framework\Routing\RouteScopeRegistry;
  17. use Symfony\Bridge\PsrHttpMessage\Factory\PsrHttpFactory;
  18. use Symfony\Component\EventDispatcher\EventSubscriberInterface;
  19. use Symfony\Component\HttpKernel\Event\ControllerEvent;
  20. use Symfony\Component\HttpKernel\Event\RequestEvent;
  21. use Symfony\Component\HttpKernel\KernelEvents;
  23. /**
  24.  * @internal
  25.  */
  26. #[Package('core')]
  27. class ApiAuthenticationListener implements EventSubscriberInterface
  28. {
  29.     use RouteScopeCheckTrait;
  31.     /**
  32.      * @internal
  33.      */
  34.     public function __construct(
  35.         private readonly ResourceServer $resourceServer,
  36.         private readonly AuthorizationServer $authorizationServer,
  37.         private readonly UserRepositoryInterface $userRepository,
  38.         private readonly RefreshTokenRepositoryInterface $refreshTokenRepository,
  39.         private readonly PsrHttpFactory $psrHttpFactory,
  40.         private readonly RouteScopeRegistry $routeScopeRegistry,
  41.         private readonly string $accessTokenTtl = 'PT10M',
  42.         private readonly string $refreshTokenTtl = 'P1W'
  43.     ) {
  44.     }
  46.     public static function getSubscribedEvents(): array
  47.     {
  48.         return [
  49.             KernelEvents::REQUEST => [
  50.                 ['setupOAuth', 128],
  51.             ],
  52.             KernelEvents::CONTROLLER => [
  53.                 ['validateRequest', KernelListenerPriorities::KERNEL_CONTROLLER_EVENT_PRIORITY_AUTH_VALIDATE],
  54.             ],
  55.         ];
  56.     }
  58.     public function setupOAuth(RequestEvent $event): void
  59.     {
  60.         if (!$event->isMainRequest()) {
  61.             return;
  62.         }
  64.         $accessTokenInterval = new \DateInterval($this->accessTokenTtl);
  65.         $refreshTokenInterval = new \DateInterval($this->refreshTokenTtl);
  67.         $passwordGrant = new PasswordGrant($this->userRepository, $this->refreshTokenRepository);
  68.         $passwordGrant->setRefreshTokenTTL($refreshTokenInterval);
  70.         $refreshTokenGrant = new RefreshTokenGrant($this->refreshTokenRepository);
  71.         $refreshTokenGrant->setRefreshTokenTTL($refreshTokenInterval);
  73.         $this->authorizationServer->enableGrantType($passwordGrant, $accessTokenInterval);
  74.         $this->authorizationServer->enableGrantType($refreshTokenGrant, $accessTokenInterval);
  75.         $this->authorizationServer->enableGrantType(new ClientCredentialsGrant(), $accessTokenInterval);
  76.     }
  78.     public function validateRequest(ControllerEvent $event): void
  79.     {
  80.         $request = $event->getRequest();
  82.         if (!$request->attributes->get('auth_required', true)) {
  83.             return;
  84.         }
  86.         if (!$this->isRequestScoped($request, ApiContextRouteScopeDependant::class)) {
  87.             return;
  88.         }
  90.         $psr7Request = $this->psrHttpFactory->createRequest($event->getRequest());
  91.         $psr7Request = $this->resourceServer->validateAuthenticatedRequest($psr7Request);
  93.         $request->attributes->add($psr7Request->getAttributes());
  94.     }
  96.     protected function getScopeRegistry(): RouteScopeRegistry
  97.     {
  98.         return $this->routeScopeRegistry;
  99.     }
  100. }