ApiBundle\Security\Firewall\JWTAuthListener::handle()

Complexity

Conditions	6
Paths	6

Size

Total Lines	59
Code Lines	30

Duplication

Lines	0
Ratio	0 %

Importance

Changes	1
Bugs	0	Features	1

<?php
    public function handle(GetResponseEvent $event)
    {
        $request = $event->getRequest();
        if (!$request->isMethod('POST')) {
            throw new HttpException(405, "Only POST method is allowed for JWT authentication");
        }

        $username = $request->request->get('username', null);
        $password = $request->request->get('password', null);

        try {
            $token = $this->authenticationManager->authenticate(new UsernamePasswordToken($username, $password, $this->providerKey));
        } catch (\InvalidArgumentException $e) {
            // most probably failed to find user by these credentials
            // let other unexpected exceptions pass through
            throw new HttpException(JsonResponse::HTTP_UNAUTHORIZED, "Username or password is not valid.", $e);
        }

        $user = $token->getUser();

        $header = [];

        // jwt token data
        $payload = [
            'username' => $user->getUsername(),
            'exp' => (new \DateTime('+1 day'))->format('U'),
            'iat' => (new \DateTime('now'))->format('U'),
        ];

        // build jwt data to sign
        $toSign = implode('.', array_map('base64_encode', array_map('json_encode', [$header, $payload])));

        // init openssl private key resource
        $key = openssl_pkey_get_private($this->privkey, $this->passphrase);
        if (!is_resource($key)) {
            throw new HttpException(500, "not valid private key, {$this->privkey}");
        }

        // ensure key is valid RSA private key
        if (openssl_pkey_get_details($key)['type'] !== JWTUserToken::KEY_TYPE) {
            throw new HttpException(500, "Only RSA keys are supported.");
        }

        // create signature
        $signature = null;
        if (!openssl_sign($toSign, $signature, $key, JWTUserToken::ALGO)) {
            throw new HttpException(500, "could not sign JWT.");
        }

        // create jwt token
        $jwt = implode('.', [$toSign, base64_encode($signature)]);

        // finally create response
        $event->setResponse(new JsonResponse([
            'token' => $jwt,
            'id' => $user->getId(),
            'roles' => $user->getRoles(),
        ]));
    }
}