Jérémy Munsch
81aabdab72
This removes api authentification with token in favor of signature method. Refactorize code and clean up. It add more unit test plus code coverage in test/converage. - Added config.api.timestampTimeout - Added Helper::signRequest This calculates the request signature - Added more unit tests and extend code coverage. - Added rate limiter for web routes - Added RemoveSpaces Sanitizer on api requests - Added stress test suite - Changed AuthServiceProvider api-token to api-hmac - Changed CustomerSeeder to have at least of customer activated (for unit tests) - Changed used transation for saveing multiple models - Changed, in ServiceController generateApiToken to generateServicePassword - Changed, timestamp has to be send in request with a DateTime format, it also has to a UTC value - Composer added brianium/paratest - Composer update - Fixed case where removing single optin could be the wrong one (not for the good service) - Fixed customer delete - Fixed customer would not be resolved by brand. - Fixed Really check that request is json checking body content, preventing sending malformed requests - Remove ApiError::needAuth - Removed api_token - Removed ApiController::authenticate - Removed config.api.tokenTimeout - Removed Header check or usage because of HAProxy doing weird stuff - Removed lock files from gitignore - Removed memcached dependency - Removed unused questions resources api routes - Removed workspace file Migrations - Added unique index on services.bearer_token - Changed customer_id on customer_answer is nullable - Changed services.bearer_pwd length to 312 (the size of the token) - Dropped services.api_token and service.api_token_date
76 lines
2.2 KiB
PHP
76 lines
2.2 KiB
PHP
<?php
|
|
|
|
namespace App\Providers;
|
|
|
|
use App\Lib\Helper;
|
|
use App\Models\Service;
|
|
use Illuminate\Database\Eloquent\ModelNotFoundException;
|
|
use Illuminate\Foundation\Support\Providers\AuthServiceProvider as ServiceProvider;
|
|
use Illuminate\Http\Request;
|
|
use Illuminate\Support\Facades\Auth;
|
|
|
|
class AuthServiceProvider extends ServiceProvider
|
|
{
|
|
/**
|
|
* The policy mappings for the application.
|
|
*
|
|
* @var array
|
|
*/
|
|
protected $policies = [];
|
|
|
|
/**
|
|
* Register any authentication / authorization services.
|
|
*
|
|
* @return void
|
|
*/
|
|
public function boot()
|
|
{
|
|
$this->registerPolicies();
|
|
|
|
Auth::viaRequest('api-hmac', function (Request $request) {
|
|
|
|
/**
|
|
* Un token devrais être fourni pour chaque requete
|
|
*/
|
|
if (is_null($request->bearer_token)) {
|
|
return null;
|
|
}
|
|
|
|
// * Si la route actuelle n'as pas de nom alors on refuse de la traiter.
|
|
if (!(Helper::getRoute($request))) {
|
|
// @codeCoverageIgnoreStart
|
|
return null;
|
|
// @codeCoverageIgnoreEnd
|
|
}
|
|
|
|
$service = null;
|
|
|
|
try {
|
|
// * On récupère le service actuel correspondant au token fourni.
|
|
$service = Service::getFromBearerToken($request->bearer_token ?? '');
|
|
} catch (ModelNotFoundException $e) {
|
|
return null;
|
|
}
|
|
|
|
// * Preload the brand as we will access it often later.
|
|
$service = $service->load('brand');
|
|
|
|
/**
|
|
** All ApiV2 routes must pass Brand model to controller action since a Brand owns
|
|
** a service token, otherwise the api cannot be called.
|
|
** This hack is a custom binder instead of passing
|
|
** this to route as a parameter
|
|
*/
|
|
app()->bind(Service::class, function () use ($service) {
|
|
return $service;
|
|
});
|
|
|
|
// * On authenticate la request en vérifiant sa signature.
|
|
if ($service->authenticateApi($request)) {
|
|
return $service;
|
|
}
|
|
|
|
return null;
|
|
});
|
|
}
|
|
}
|