ElfSundae\Laravel\Api\Middleware\VerifyApiToken

Complexity

Total Complexity

17

Size/Duplication

Total Lines	116
Duplicated Lines	0 %

Coupling/Cohesion

Components	1
Dependencies	3

Test Coverage

Coverage

0%

Importance

Changes

0

7 Methods

Rating	Name	Duplication	Size	Complexity
A	__construct()	0	4	1
A	handle()	0	10	3
A	inExceptArray()	0	14	4
A	verifyToken()	0	11	3
A	getKey()	0	4	2
A	getTime()	0	4	2
A	getToken()	0	4	2

<?php

namespace ElfSundae\Laravel\Api\Middleware;

use Closure;
use ElfSundae\Laravel\Api\Token;

class VerifyApiToken
{
    /**
     * The Token instance.
     *
     * @var \ElfSundae\Laravel\Api\Token
     */
    protected $token;

    /**
     * The URIs that should be excluded from token verification.
     *
     * @var array
     */
    protected $except = [];

    /**
     * Create the middleware.
     *
     * @param  \ElfSundae\Laravel\Api\Token  $token
     */
    public function __construct(Token $token)
    {
        $this->token = $token;
    }

    /**
     * Handle an incoming request.
     *
     * @param  \Illuminate\Http\Request  $request
     * @param  \Closure  $next
     * @return mixed
     */
    public function handle($request, Closure $next)
    {
        if ($this->inExceptArray($request) || $this->verifyToken($request)) {
            $request->attributes->set('current_app_key', $this->getKey($request));

            return $next($request);
        }

        return response('Forbidden Request', 403);
    }

    /**
     * Determine if the request has a URI that should be passed through verification.
     *
     * @param  \Illuminate\Http\Request  $request
     * @return bool
     */
    protected function inExceptArray($request)
    {
        foreach ($this->except as $except) {
            if ($except !== '/') {
                $except = trim($except, '/');
            }

            if ($request->is($except)) {
                return true;
            }
        }

        return false;
    }

    /**
     * Verify the api token from request.
     *
     * @param  \Illuminate\Http\Request  $request
     * @return bool
     */
    protected function verifyToken($request)
    {
        if ($time = $this->getTime($request)) {
            $verifyTime = abs(time() - $time) < (int) config('api.token_duration');
            $verifyToken = $this->token->verify($this->getToken($request), $this->getKey($request), $time);

It seems like $this->getToken($request) targeting ElfSundae\Laravel\Api\Middleware\VerifyApiToken::getToken() can also be of type array; however, ElfSundae\Laravel\Api\Token::verify() does only seem to accept string, maybe add an additional type check?

It seems like $this->getKey($request) targeting ElfSundae\Laravel\Api\Middleware\VerifyApiToken::getKey() can also be of type array; however, ElfSundae\Laravel\Api\Token::verify() does only seem to accept string, maybe add an additional type check?

            return $verifyTime && $verifyToken;
        }

        return false;
    }

    /**
     * Get the app key.
     *
     * @param  \Illuminate\Http\Request  $request
     * @return string
     */
    protected function getKey($request)
    {
        return $request->input('_key') ?: $request->header('X-API-KEY');
    }

    /**
     * Get the time.
     *
     * @param  \Illuminate\Http\Request  $request
     * @return int
     */
    protected function getTime($request)
    {
        return (int) ($request->input('_time') ?: $request->header('X-API-TIME'));
    }

    /**
     * Get the api token.
     *
     * @param  \Illuminate\Http\Request  $request
     * @return string
     */
    protected function getToken($request)
    {
        return $request->input('_token') ?: $request->header('X-API-TOKEN');
    }
}