BookStack/app/Http/Middleware/ApiAuthenticate.php
Dan Brown b90033a730
Guest control: Cleaned methods involved in fetching/handling
- Moves guest user caching from User class to app container for
  simplicity.
- Updates test to use simpler $this->users->guest() method for
  consistency.
- Streamlined helpers to avoid function overlap for simplicity.
- Extracted user profile dropdown while doing changes.
2023-09-16 13:18:35 +01:00

58 lines
1.6 KiB
PHP

<?php
namespace BookStack\Http\Middleware;
use BookStack\Exceptions\ApiAuthException;
use Closure;
use Illuminate\Http\Request;
class ApiAuthenticate
{
/**
* Handle an incoming request.
*
* @throws ApiAuthException
*/
public function handle(Request $request, Closure $next)
{
// Validate the token and it's users API access
$this->ensureAuthorizedBySessionOrToken();
return $next($request);
}
/**
* Ensure the current user can access authenticated API routes, either via existing session
* authentication or via API Token authentication.
*
* @throws ApiAuthException
*/
protected function ensureAuthorizedBySessionOrToken(): void
{
// Return if the user is already found to be signed in via session-based auth.
// This is to make it easy to browser the API via browser after just logging into the system.
if (!user()->isGuest() || session()->isStarted()) {
if (!$this->sessionUserHasApiAccess()) {
throw new ApiAuthException(trans('errors.api_user_no_api_permission'), 403);
}
return;
}
// Set our api guard to be the default for this request lifecycle.
auth()->shouldUse('api');
// Validate the token and it's users API access
auth()->authenticate();
}
/**
* Check if the active session user has API access.
*/
protected function sessionUserHasApiAccess(): bool
{
$hasApiPermission = user()->can('access-api');
return $hasApiPermission && user()->hasAppAccess();
}
}