src/Security/EmpireAuthenticator.php line 54

  1. <?php
  3. namespace App\Security;
  5. use Empire\Core\User;
  6. use Doctrine\ORM\EntityManagerInterface;
  7. use Symfony\Component\HttpFoundation\JsonResponse;
  8. use Symfony\Component\HttpFoundation\Request;
  9. use Symfony\Component\HttpFoundation\Response;
  10. use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
  11. use Symfony\Component\Security\Core\Exception\AuthenticationException;
  12. use Symfony\Component\Security\Core\Exception\UserNotFoundException;
  13. use Symfony\Component\Security\Core\User\UserInterface;
  14. use Symfony\Component\Security\Core\User\UserProviderInterface;
  15. use Symfony\Component\Security\Http\Authenticator\AbstractAuthenticator;
  16. use Symfony\Component\Security\Core\Exception\CustomUserMessageAuthenticationException;
  17. use Symfony\Component\Security\Http\Authenticator\Passport\Badge\UserBadge;
  18. use Symfony\Component\Security\Http\Authenticator\Passport\Badge\PreAuthenticatedUserBadge;
  19. use Symfony\Component\Security\Http\Authenticator\Passport\Passport;
  20. use Symfony\Component\Security\Http\Authenticator\Passport\SelfValidatingPassport;
  21. use Symfony\Component\Security\Http\Authenticator\Passport\Credentials\CustomCredentials;
  22. use Symfony\Component\HttpFoundation\RedirectResponse;
  23. use Symfony\Component\HttpFoundation\RequestStack;
  24. use App\Security\UserProvider;
  25. use Empire\Core\Core;
  26. use Empire\Core\DatabaseHelper;
  28. class EmpireAuthenticator extends AbstractAuthenticator
  29. {
  30. private $entityManager;
  31. private $requestStack;
  32. private $userProvider;
  34. public function __construct(EntityManagerInterface $entityManager, RequestStack $requestStack, UserProvider $userProvider)
  35. {
  36. $this->entityManager = $entityManager;
  37. $this->requestStack = $requestStack;
  38. $this->userProvider = $userProvider;
  39. }
  41. /**
  42. * Called on every request to decide if this authenticator should be
  43. * used for the request. Returning `false` will cause this authenticator
  44. * to be skipped.
  45. */
  46. public function supports(Request $request): ?bool
  47. {
  48. $cook = false;
  49. if ($request->cookies->has('irms_token')){
  50. $tok = $request->cookies->get('irms_token');
  51. if ($tok != '' || !is_null($tok)) {
  52. $cook = true;
  53. }
  54. }
  55. return $cook || $this->requestStack->getSession()->has('member_id');
  56. }
  58. public function getCredentials(Request $request)
  59. {
  60. if ($request->cookies->has('irms_token')){
  61. list($token, $signature) = explode(":", $request->cookies->get('irms_token'), 2);
  62. if ($signature != hash_hmac('md5', $token, $_ENV['APP_SECRET'])) {
  63. throw new \Exception('Invalid cookie!');
  64. }
  65. return $token;
  66. }
  67. return "_no_cookie"; // special val, to show no cookie usage and to check session
  68. }
  70. public function getUser($credentials, UserProviderInterface $userProvider)
  71. {
  72. if (null === $credentials) {
  73. // The token header was empty, authentication fails with HTTP Status
  74. // Code 401 "Unauthorized"
  75. return null;
  76. }
  77. if ($credentials == "_no_cookie"){
  78. $membid = $this->requestStack->getSession()->get('member_id');
  79. return $userProvider->loadUserByUsername($membid);
  80. }
  81. // no session, so a remember_me
  82. return $userProvider->loadUserByIrmsToken($credentials);
  83. }
  85. public function checkCredentials($credentials, UserInterface $user)
  86. {
  87. return true;
  88. }
  92. public function authenticate(Request $request): Passport
  93. {
  94. $cookie = $request->cookies->get('irms_token');
  95. if (is_null($cookie)){
  96. $membid = $this->requestStack->getSession()->get('member_id');
  97. if(is_null($membid)){
  98. throw new CustomUserMessageAuthenticationException('No token provided');
  99. }
  100. return new SelfValidatingPassport(new UserBadge($this->userProvider->loadUserByUsername($membid)), [new PreAuthenticatedUserBadge()]);
  101. } else {
  102. list($token, $signature) = explode(":", $cookie, 2);
  103. if ($signature != hash_hmac('md5', $token, $_ENV['APP_SECRET'])) {
  104. throw new \Exception('Invalid cookie!');
  105. }
  106. Core::setDB($this->entityManager->getConnection());
  107. $sql = "SELECT MEMB_ID FROM COOKIE WHERE COOK_TOKEN = '$token';";
  108. $stmt = DatabaseHelper::prepare($sql);
  109. $id = DatabaseHelper::fetchObjectFlexible($stmt);
  110. if(is_null($id)){
  111. throw new UserNotFoundException();
  112. } else {
  113. $id = $id->MEMB_ID;
  114. }
  116. $usql = "SELECT * FROM MEMBER WHERE MEMB_ID = '$id';";
  117. $stmt = DatabaseHelper::prepare($usql);
  118. $user = DatabaseHelper::fetchObject($stmt, User::class);
  119. if (is_null($user)) {
  120. throw new UserNotFoundException();
  121. }
  123. return new SelfValidatingPassport(new UserBadge($user));
  124. }
  125. }
  127. public function onAuthenticationSuccess(Request $request, TokenInterface $token, string $firewallName): ?Response
  128. {
  129. // on success, let the request continue
  130. return null;
  131. }
  133. public function onAuthenticationFailure(Request $request, AuthenticationException $exception): ?Response
  134. {
  135. $data = [
  136. // you may want to customize or obfuscate the message first
  137. 'message' => strtr($exception->getMessageKey(), $exception->getMessageData())
  139. // or to translate this message
  140. // $this->translator->trans($exception->getMessageKey(), $exception->getMessageData())
  141. ];
  143. return new JsonResponse($data, Response::HTTP_UNAUTHORIZED);
  144. }
  146. /**
  147. * Called when authentication is needed, but it's not sent
  148. */
  149. public function start(Request $request, AuthenticationException $authException = null)
  150. {
  151. // send to login
  152. //var_dump($request->server->all());
  153. $reqUri = urlencode($request->server->get('REQUEST_URI'));
  154. return new RedirectResponse("/login?returnUrl={$reqUri}&client=Forum");
  155. }
  157. public function supportsRememberMe()
  158. {
  159. return true;
  160. }
  161. }