2019-12-29 21:16:07 -05:00
|
|
|
<?php
|
|
|
|
|
|
|
|
namespace BookStack\Http\Middleware;
|
|
|
|
|
2019-12-30 09:51:28 -05:00
|
|
|
use BookStack\Exceptions\ApiAuthException;
|
2019-12-29 21:16:07 -05:00
|
|
|
use BookStack\Http\Request;
|
|
|
|
use Closure;
|
|
|
|
|
|
|
|
class ApiAuthenticate
|
|
|
|
{
|
|
|
|
|
|
|
|
/**
|
|
|
|
* Handle an incoming request.
|
|
|
|
*/
|
|
|
|
public function handle(Request $request, Closure $next)
|
|
|
|
{
|
|
|
|
// Return if the user is already found to be signed in via session-based auth.
|
|
|
|
// This is to make it easy to browser the API via browser after just logging into the system.
|
|
|
|
if (signedInUser()) {
|
|
|
|
return $next($request);
|
|
|
|
}
|
|
|
|
|
2019-12-30 09:51:28 -05:00
|
|
|
// Set our api guard to be the default for this request lifecycle.
|
|
|
|
auth()->shouldUse('api');
|
2019-12-29 21:16:07 -05:00
|
|
|
|
2019-12-30 09:51:28 -05:00
|
|
|
// Validate the token and it's users API access
|
|
|
|
try {
|
|
|
|
auth()->authenticate();
|
|
|
|
} catch (ApiAuthException $exception) {
|
|
|
|
return $this->unauthorisedResponse($exception->getMessage(), $exception->getCode());
|
2019-12-29 21:16:07 -05:00
|
|
|
}
|
|
|
|
|
|
|
|
return $next($request);
|
|
|
|
}
|
|
|
|
|
|
|
|
/**
|
|
|
|
* Provide a standard API unauthorised response.
|
|
|
|
*/
|
2019-12-30 09:51:28 -05:00
|
|
|
protected function unauthorisedResponse(string $message, int $code)
|
2019-12-29 21:16:07 -05:00
|
|
|
{
|
|
|
|
return response()->json([
|
|
|
|
'error' => [
|
|
|
|
'code' => $code,
|
|
|
|
'message' => $message,
|
|
|
|
]
|
|
|
|
], 401);
|
|
|
|
}
|
|
|
|
}
|