src/Core/Framework/Api/OAuth/BearerTokenValidator.php line 28

  1. <?php declare(strict_types=1);
  3. namespace Shopware\Core\Framework\Api\OAuth;
  5. use Doctrine\DBAL\Connection;
  6. use Lcobucci\JWT\Configuration;
  7. use Lcobucci\JWT\UnencryptedToken;
  8. use League\OAuth2\Server\AuthorizationValidators\AuthorizationValidatorInterface;
  9. use League\OAuth2\Server\Exception\OAuthServerException;
  10. use Psr\Http\Message\ServerRequestInterface;
  11. use Shopware\Core\Framework\Log\Package;
  12. use Shopware\Core\Framework\Uuid\Uuid;
  13. use Shopware\Core\PlatformRequest;
  15. #[Package('core')]
  16. class BearerTokenValidator implements AuthorizationValidatorInterface
  17. {
  18.     /**
  19.      * @internal
  20.      */
  21.     public function __construct(private readonly AuthorizationValidatorInterface $decorated, private readonly Connection $connection, private readonly Configuration $configuration)
  22.     {
  23.     }
  25.     /**
  26.      * @return ServerRequestInterface
  27.      */
  28.     public function validateAuthorization(ServerRequestInterface $request)
  29.     {
  30.         $request = $this->decorated->validateAuthorization($request);
  32.         $header = $request->getHeader('authorization');
  34.         $jwt = trim(preg_replace('/^(?:\s+)?Bearer\s/', '', $header[0]) ?? '');
  36.         /** @var UnencryptedToken $token */
  37.         $token = $this->configuration->parser()->parse($jwt);
  39.         if ($userId = $request->getAttribute(PlatformRequest::ATTRIBUTE_OAUTH_USER_ID)) {
  40.             $this->validateAccessTokenIssuedAt($token->claims()->get('iat', 0), $userId);
  41.         }
  43.         return $request;
  44.     }
  46.     /**
  47.      * @throws OAuthServerException
  48.      */
  49.     private function validateAccessTokenIssuedAt(\DateTimeImmutable $tokenIssuedAt, string $userId): void
  50.     {
  51.         $lastUpdatedPasswordAt = $this->connection->createQueryBuilder()
  52.             ->select(['last_updated_password_at'])
  53.             ->from('user')
  54.             ->where('id = :userId')
  55.             ->setParameter('userId', Uuid::fromHexToBytes($userId))
  56.             ->executeQuery()
  57.             ->fetchOne();
  59.         if ($lastUpdatedPasswordAt === false) {
  60.             throw OAuthServerException::accessDenied('Access token is invalid');
  61.         }
  63.         if ($lastUpdatedPasswordAt === null) {
  64.             return;
  65.         }
  67.         $lastUpdatedPasswordAt = strtotime((string) $lastUpdatedPasswordAt);
  69.         if ($tokenIssuedAt->getTimestamp() <= $lastUpdatedPasswordAt) {
  70.             throw OAuthServerException::accessDenied('Access token is expired');
  71.         }
  72.     }
  73. }