SlayerBirden\DataFlowServer\Authentication\Middleware\TokenMiddleware

Complexity

Total Complexity

11

Size/Duplication

Total Lines	69
Duplicated Lines	0 %

Coupling/Cohesion

Components	1
Dependencies	7

Test Coverage

Coverage

100%

Importance

Changes

0

3 Methods

Rating	Name	Duplication	Size	Complexity
A	__construct()	0	4	1
B	process()	0	37	8
A	getToken()	0	14	2

<?php
declare(strict_types=1);

namespace SlayerBirden\DataFlowServer\Authentication\Middleware;

use Doctrine\Common\Collections\Criteria;
use Doctrine\ORM\EntityManager;
use Psr\Http\Message\ResponseInterface;
use Psr\Http\Message\ServerRequestInterface;
use Psr\Http\Server\MiddlewareInterface;
use Psr\Http\Server\RequestHandlerInterface;
use SlayerBirden\DataFlowServer\Authentication\Entities\Token;
use SlayerBirden\DataFlowServer\Notification\DangerMessage;
use Zend\Diactoros\Response\JsonResponse;
use Zend\Expressive\Router\RouteResult;

class TokenMiddleware implements MiddlewareInterface
{
    const USER_PARAM = 'currentUser';
    /**
     * @var EntityManager
     */
    private $entityManager;

    public function __construct(EntityManager $entityManager)

You have injected the EntityManager via parameter $entityManager. This is generally not recommended as it might get closed and become unusable. Instead, it is recommended to inject the ManagerRegistry and retrieve the EntityManager via getManager() each time you need it.

    {
        $this->entityManager = $entityManager;
    }

    /**
     * @inheritdoc
     */
    public function process(ServerRequestInterface $request, RequestHandlerInterface $handler): ResponseInterface
    {
        $authorization = $request->getHeader('Authorization');
        if (empty($authorization)) {
            return new JsonResponse([
                'data' => [],
                'success' => false,
                'msg' => new DangerMessage('Empty Authorization header. Access denied.'),
            ], 401);
        }
        $token = $this->getToken(reset($authorization));

It seems like reset($authorization) targeting reset() can also be of type false; however, SlayerBirden\DataFlowServer\Authentication\Middleware\TokenMiddleware::getToken() does only seem to accept string, did you maybe forget to handle an error condition?

        if (!$token || !$token->isActive() || ($token->getDue() < new \DateTime())) {
            return new JsonResponse([
                'data' => [],
                'success' => false,
                'msg' => new DangerMessage('Token is absent or invalid. Access denied.'),
            ], 401);
        }
        // check ACL
        $routeResult = $request->getAttribute(RouteResult::class, false);
        if (false === $routeResult) {
            // Can not perform ACL check
            return $handler->handle($request);
        }
        $routeName = $routeResult->getMatchedRouteName();
        foreach ($token->getGrants() as $grant) {
            if ($grant->getResource() === $routeName) {
                return $handler->handle($request->withAttribute(self::USER_PARAM, $token->getOwner()));
            }
        }

        return new JsonResponse([
            'data' => [],
            'success' => false,
            'msg' => new DangerMessage('The permission to resource is not granted.'),
        ], 403);
    }

    private function getToken(string $authorization): ?Token
    {
        $token = str_replace('Bearer ', '', $authorization);
        $tokens = $this->entityManager
            ->getRepository(Token::class)
            ->matching(
                Criteria::create()->where(Criteria::expr()->eq('token', $token))
            );
        if ($tokens->count()) {
            return $tokens->first();
        }

        return null;
    }
}