advanced-learning / silverstripe-oauth2-server

src/Middleware/AuthenticationMiddleware.php

<?php

namespace AdvancedLearning\Oauth2Server\Middleware;

use AdvancedLearning\Oauth2Server\Exceptions\AuthenticationException;
use AdvancedLearning\Oauth2Server\Services\Authenticator;
use SilverStripe\Control\HTTPRequest;
use SilverStripe\Control\HTTPResponse;
use SilverStripe\Control\Middleware\HTTPMiddleware;
use SilverStripe\Core\Application;
use SilverStripe\Core\Injector\Injector;
use SilverStripe\ORM\Connect\DatabaseException;
use SilverStripe\ORM\DB;
use SilverStripe\Security\Member;
use SilverStripe\Security\Security;

/**
 * Class ResourceServerMiddleware.
 *
 * Replacement for @see \League\OAuth2\Server\Middleware\ResourceServerMiddleware
 * to make it compatible with SilverStripe.
 *
 * @package AdvancedLearning\Oauth2Server\Middleware
 */
class AuthenticationMiddleware implements HTTPMiddleware
{
    /**
     * @var Application
     */
    protected $application = null;

    /**
     * @var Authenticator
     */
    protected $authenticator;

    /**
     * Build error control chain for an application
     *
     * @param Application    $application The SilverStripe Application.
     */
    public function __construct()
    {
        $this->authenticator = Injector::inst()->get(Authenticator::class);
    }

    /**
     * Process the middleware.
     *
     * @param HTTPRequest $request The incoming request.
     * @param callable    $next    The next middleware.
     *
     * @return HTTPResponse
     */
    public function process(HTTPRequest $request, callable $next)
    {
        try {
            $request = $this->authenticator->authenticate($request);

            // set the current user
            if ($userID = $request->getHeader('oauth_user_id')) {
                Security::setCurrentUser(Member::get()->byID($userID));

It seems like \SilverStripe\Security\Member::get()->byID($userID) targeting SilverStripe\ORM\DataList::byID() can also be of type object<SilverStripe\ORM\DataObject>; however, SilverStripe\Security\Security::setCurrentUser() does only seem to accept null|object<SilverStripe\Security\Member>, maybe add an additional type check?

            }
        } catch (AuthenticationException $exception) {
            // for middleware do nothing
        } catch (DatabaseException $exception) {
            // db not ready, ignore
        }

        // Pass the request on to the next responder in the chain
        return $next($request);
    }
}