vendor/shopware/core/Framework/Api/OAuth/BearerTokenValidator.php line 43

Open in your IDE?
  1. <?php declare(strict_types=1);
  3. namespace Shopware\Core\Framework\Api\OAuth;
  5. use Doctrine\DBAL\Connection;
  6. use Lcobucci\JWT\Configuration;
  7. use Lcobucci\JWT\UnencryptedToken;
  8. use League\OAuth2\Server\AuthorizationValidators\AuthorizationValidatorInterface;
  9. use League\OAuth2\Server\Exception\OAuthServerException;
  10. use Psr\Http\Message\ServerRequestInterface;
  11. use Shopware\Core\Framework\Uuid\Uuid;
  12. use Shopware\Core\PlatformRequest;
  14. /**
  15.  * @package core
  16.  */
  17. class BearerTokenValidator implements AuthorizationValidatorInterface
  18. {
  19.     private Connection $connection;
  21.     private AuthorizationValidatorInterface $decorated;
  23.     private Configuration $configuration;
  25.     /**
  26.      * @internal
  27.      */
  28.     public function __construct(
  29.         AuthorizationValidatorInterface $decorated,
  30.         Connection $connection,
  31.         Configuration $configuration
  32.     ) {
  33.         $this->decorated = $decorated;
  34.         $this->connection = $connection;
  35.         $this->configuration = $configuration;
  36.     }
  38.     /**
  39.      * @return ServerRequestInterface
  40.      */
  41.     public function validateAuthorization(ServerRequestInterface $request)
  42.     {
  43.         $request = $this->decorated->validateAuthorization($request);
  45.         $header = $request->getHeader('authorization');
  47.         $jwt = trim(preg_replace('/^(?:\s+)?Bearer\s/', '', $header[0]) ?? '');
  49.         /** @var UnencryptedToken $token */
  50.         $token = $this->configuration->parser()->parse($jwt);
  52.         if ($userId = $request->getAttribute(PlatformRequest::ATTRIBUTE_OAUTH_USER_ID)) {
  53.             $this->validateAccessTokenIssuedAt($token->claims()->get('iat', 0), $userId);
  54.         }
  56.         return $request;
  57.     }
  59.     /**
  60.      * @throws OAuthServerException
  61.      */
  62.     private function validateAccessTokenIssuedAt(\DateTimeImmutable $tokenIssuedAt, string $userId): void
  63.     {
  64.         $lastUpdatedPasswordAt = $this->connection->createQueryBuilder()
  65.             ->select(['last_updated_password_at'])
  66.             ->from('user')
  67.             ->where('id = :userId')
  68.             ->setParameter('userId', Uuid::fromHexToBytes($userId))
  69.             ->executeQuery()
  70.             ->fetchOne();
  72.         if ($lastUpdatedPasswordAt === false) {
  73.             throw OAuthServerException::accessDenied('Access token is invalid');
  74.         }
  76.         if ($lastUpdatedPasswordAt === null) {
  77.             return;
  78.         }
  80.         $lastUpdatedPasswordAt = strtotime($lastUpdatedPasswordAt);
  82.         if ($tokenIssuedAt->getTimestamp() <= $lastUpdatedPasswordAt) {
  83.             throw OAuthServerException::accessDenied('Access token is expired');
  84.         }
  85.     }
  86. }