8449eafcb6
* support parsing negative durations in JS * bump luxon dependency * make sure that 2FA is not required for session based API calls * show name of items to delete * fix permission issue for recent activity items
70 lines
2.4 KiB
PHP
70 lines
2.4 KiB
PHP
<?php
|
|
|
|
/*
|
|
* This file is part of the Kimai time-tracking app.
|
|
*
|
|
* For the full copyright and license information, please view the LICENSE
|
|
* file that was distributed with this source code.
|
|
*/
|
|
|
|
namespace App\API\Authentication;
|
|
|
|
use Scheb\TwoFactorBundle\Security\Http\Authenticator\TwoFactorAuthenticator;
|
|
use Symfony\Component\HttpFoundation\Request;
|
|
use Symfony\Component\HttpFoundation\Response;
|
|
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
|
|
use Symfony\Component\Security\Core\Exception\AuthenticationException;
|
|
use Symfony\Component\Security\Http\Authenticator\AbstractAuthenticator;
|
|
use Symfony\Component\Security\Http\Authenticator\Passport\Passport;
|
|
|
|
final class SessionAuthenticator extends AbstractAuthenticator
|
|
{
|
|
public const HEADER_JAVASCRIPT = 'X-AUTH-SESSION';
|
|
|
|
public function __construct(private TokenAuthenticator $authenticator)
|
|
{
|
|
}
|
|
|
|
public function createToken(Passport $passport, string $firewallName): TokenInterface
|
|
{
|
|
$token = parent::createToken($passport, $firewallName);
|
|
|
|
// this should not be necessary, as /api/ is excluded from 2FA process, but just to make sure this
|
|
// authenticator never triggers 2FA, we add the attribute to the token
|
|
|
|
// https://symfony.com/bundles/SchebTwoFactorBundle/6.x/custom_conditions.html
|
|
$token->setAttribute(TwoFactorAuthenticator::FLAG_2FA_COMPLETE, true);
|
|
|
|
return $token;
|
|
}
|
|
|
|
public function supports(Request $request): ?bool
|
|
{
|
|
if (str_contains($request->getRequestUri(), '/api/')) {
|
|
// API docs can only be access, when the user is logged in
|
|
if (str_contains($request->getRequestUri(), '/api/doc')) {
|
|
return false;
|
|
}
|
|
|
|
return !$request->headers->has(self::HEADER_JAVASCRIPT);
|
|
}
|
|
|
|
return false;
|
|
}
|
|
|
|
public function authenticate(Request $request): Passport
|
|
{
|
|
return $this->authenticator->authenticate($request);
|
|
}
|
|
|
|
public function onAuthenticationSuccess(Request $request, TokenInterface $token, string $firewallName): ?Response
|
|
{
|
|
return $this->authenticator->onAuthenticationSuccess($request, $token, $firewallName);
|
|
}
|
|
|
|
public function onAuthenticationFailure(Request $request, AuthenticationException $exception): ?Response
|
|
{
|
|
return $this->authenticator->onAuthenticationFailure($request, $exception);
|
|
}
|
|
}
|