From 2e2cad554c1ad3320198e6ef62f1454311e27f4e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=A9r=C3=A9my=20Munsch?= <jeremy.munsch@ldc.fr>
Date: Mon, 16 Aug 2021 18:47:31 +0200
Subject: [PATCH] Handle http auth with bearer token

---
 app/Http/Controllers/Api/V2/ApiController.php |  6 +++--
 app/Http/Middleware/ApiResponse.php           |  4 ++--
 app/Http/Middleware/Authenticate.php          |  2 +-
 app/Http/Middleware/CheckBrand.php            |  3 ++-
 app/Lib/Helper.php                            | 22 +++++++++++++++++++
 5 files changed, 31 insertions(+), 6 deletions(-)

diff --git a/app/Http/Controllers/Api/V2/ApiController.php b/app/Http/Controllers/Api/V2/ApiController.php
index 61455f5..b2b8502 100644
--- a/app/Http/Controllers/Api/V2/ApiController.php
+++ b/app/Http/Controllers/Api/V2/ApiController.php
@@ -5,6 +5,7 @@ namespace App\Http\Controllers\Api\V2;
 use App\Enums\ApiError;
 use App\Exceptions\Api\V2\ApiErrorException;
 use App\Http\Controllers\Controller;
+use App\Lib\Helper;
 use App\Models\Service;
 use Illuminate\Database\Eloquent\ModelNotFoundException;
 use Illuminate\Http\Request;
@@ -20,11 +21,12 @@ class ApiController extends Controller
     public function authenticate(Request $request)
     {
         try {
-            if (!$request->bearerToken()) {
+            $bearerToken = Helper::getBearerTokenFromRequest($request);
+            if (!$bearerToken) {
                 throw new ApiErrorException(ApiError::missingParameter());
             }
             /** @var \App\Models\Service */
-            $service = Service::getFromBearerToken($request->bearerToken());
+            $service = Service::getFromBearerToken($bearerToken);
         } catch (ModelNotFoundException $e) {
             throw new ApiErrorException(ApiError::authFailed());
         }
diff --git a/app/Http/Middleware/ApiResponse.php b/app/Http/Middleware/ApiResponse.php
index 1567436..a8fcea7 100644
--- a/app/Http/Middleware/ApiResponse.php
+++ b/app/Http/Middleware/ApiResponse.php
@@ -31,13 +31,13 @@ class ApiResponse
         try {
             if ($isApiV1Request) {
                 // Use patched v1 Auth mecanism (without bearer reimplementation)
-                $bearerToken = $request->bearerToken() ?? $request->api_token;
+                $bearerToken = Helper::getBearerTokenFromRequest($request) ?? $request->api_token;
                 $service     = Service::getFromBearerToken($bearerToken);
                 $service->incrementStat();
             }
 
             if ($isApiV2Request) {
-                $bearerToken = $request->bearerToken();
+                $bearerToken = Helper::getBearerTokenFromRequest($request);
                 if ($bearerToken) {
                     $service = Service::getFromBearerToken($bearerToken);
                 }
diff --git a/app/Http/Middleware/Authenticate.php b/app/Http/Middleware/Authenticate.php
index 340aa90..941d1bd 100644
--- a/app/Http/Middleware/Authenticate.php
+++ b/app/Http/Middleware/Authenticate.php
@@ -27,7 +27,7 @@ class Authenticate extends Middleware
         // TODO: check this works
         if (Helper::isRequestForApiV1($request)) {
             // Use patched v1 Auth mecanism (without bearer reimplementation)
-            $bearerToken = $request->bearerToken() ?? $request->api_token;
+            $bearerToken = Helper::getBearerTokenFromRequest($request) ?? $request->api_token;
             $brand       = Service::getFromBearerToken($bearerToken)->brand;
             $request->request->add(['brand_id' => $brand->id]);
             $response = $next($request);
diff --git a/app/Http/Middleware/CheckBrand.php b/app/Http/Middleware/CheckBrand.php
index a0de016..e0276f8 100644
--- a/app/Http/Middleware/CheckBrand.php
+++ b/app/Http/Middleware/CheckBrand.php
@@ -2,6 +2,7 @@
 
 namespace App\Http\Middleware;
 
+use App\Lib\Helper;
 use App\Models\Service;
 use Closure;
 use Illuminate\Database\Eloquent\ModelNotFoundException;
@@ -18,7 +19,7 @@ class CheckBrand
      */
     public function handle(Request $request, Closure $next)
     {
-        $apiToken = $request->bearerToken() ?? $request->api_token;
+        $apiToken = Helper::getBearerTokenFromRequest($request) ?? $request->api_token;
 
         if ($apiToken === null) {
             abort(401, 'Le token d\'authentification est incorrect dfd' . \json_encode($request->all()));
diff --git a/app/Lib/Helper.php b/app/Lib/Helper.php
index 889a26e..1c39be1 100644
--- a/app/Lib/Helper.php
+++ b/app/Lib/Helper.php
@@ -4,6 +4,7 @@ namespace App\Lib;
 
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Route;
+use Illuminate\Support\Str;
 
 /**
  * Helper Class
@@ -92,4 +93,25 @@ class Helper
         }
         return static::$packageInfos;
     }
+
+    /**
+     * Undocumented function
+     *
+     * @param Request $request
+     * @return string|null
+     */
+    public static function getBearerTokenFromRequest(Request $request): ?string
+    {
+        $header = $request->header('Authorization', '');
+
+        if (Str::contains($header, 'Bearer ')) {
+            $auths = \explode(',', $header);
+            foreach ($auths as $auth) {
+                if (Str::contains($auth, 'Bearer ')) {
+                    return Str::substr($auth, 7);
+                }
+            }
+        }
+        return null;
+    }
 }