ElfSundae\Laravel\Api\Middleware\VerifyApiToken

Complexity

Total Complexity

15

Size/Duplication

Total Lines	106
Duplicated Lines	0 %

Coupling/Cohesion

Components	1
Dependencies	3

Test Coverage

Coverage

0%

Importance

Changes	1
Bugs	0	Features	0

6 Methods

Rating	Name	Duplication	Size	Complexity
A	__construct()	0	4	1
A	handle()	0	13	3
A	inExceptArray()	0	14	4
A	verifyToken()	0	8	4
A	getKeyFromRequest()	0	4	2
A	setCurrentAppKeyForRequest()	0	4	1

<?php

namespace ElfSundae\Laravel\Api\Middleware;

use Closure;
use ElfSundae\Laravel\Api\Token;
use ElfSundae\Laravel\Api\Exceptions\InvalidApiTokenException;

class VerifyApiToken
{
    /**
     * The Token instance.
     *
     * @var \ElfSundae\Laravel\Api\Token
     */
    protected $token;

    /**
     * The URIs that should be excluded from token verification.
     *
     * @var array
     */
    protected $except = [];

    /**
     * Create the middleware.
     *
     * @param  \ElfSundae\Laravel\Api\Token  $token
     */
    public function __construct(Token $token)
    {
        $this->token = $token;
    }

    /**
     * Handle an incoming request.
     *
     * @param  \Illuminate\Http\Request  $request
     * @param  \Closure  $next
     * @return mixed
     *
     * @throws \ElfSundae\Laravel\Api\Exceptions\InvalidApiTokenException
     */
    public function handle($request, Closure $next)
    {
        if (
            $this->inExceptArray($request) ||
            $this->verifyToken($request)
        ) {
            $this->setCurrentAppKeyForRequest($request);

            return $next($request);
        }

        throw new InvalidApiTokenException;
    }

    /**
     * Determine if the request has a URI that should be passed through verification.
     *
     * @param  \Illuminate\Http\Request  $request
     * @return bool
     */
    protected function inExceptArray($request)
    {
        foreach ($this->except as $except) {
            if ($except !== '/') {
                $except = trim($except, '/');
            }

            if ($request->is($except)) {
                return true;
            }
        }

        return false;
    }

    /**
     * Verify the api token from request.
     *
     * @param  \Illuminate\Http\Request  $request
     * @return bool
     */
    protected function verifyToken($request)
    {
        $time = (int) ($request->input('_time') ?: $request->header('X-API-TIME'));
        $token = $request->input('_token') ?: $request->header('X-API-TOKEN');

        return abs(time() - $time) < (int) config('api.token_duration') &&
            $this->token->verify($token, $this->getKeyFromRequest($request), $time);

It seems like $token defined by $request->input('_token') ?: $request->header('X-API-TOKEN') on line 88 can also be of type array; however, ElfSundae\Laravel\Api\Token::verify() does only seem to accept string, maybe add an additional type check?

It seems like $this->getKeyFromRequest($request) targeting ElfSundae\Laravel\Api\Middleware\VerifyApiToken::getKeyFromRequest() can also be of type array; however, ElfSundae\Laravel\Api\Token::verify() does only seem to accept string, maybe add an additional type check?

    }

    /**
     * Get the app key from the request.
     *
     * @param  \Illuminate\Http\Request  $request
     * @return string
     */
    protected function getKeyFromRequest($request)
    {
        return $request->input('_key') ?: $request->header('X-API-KEY');
    }

    /**
     * Set current app key for the request.
     *
     * @param  \Illuminate\Http\Request  $request
     */
    protected function setCurrentAppKeyForRequest($request)
    {
        $request->attributes->set('current_app_key', $this->getKeyFromRequest($request));
    }
}