awurth / slim-rest-base

src/Middleware/Authorization.php

<?php

namespace App\Middleware;

use App\Model\User;
use Awurth\Slim\Helper\Exception\UnauthorizedException;
use Cartalyst\Sentinel\Sentinel;
use Chadicus\Slim\OAuth2\Http\RequestBridge;
use OAuth2\Server;
use Slim\Http\Request;
use Slim\Http\Response;

class Authorization implements MiddlewareInterface
{
    /**
     * @var array
     */
    protected $scopes;

    /**
     * @var Sentinel
     */
    protected $sentinel;

    /**
     * @var Server;
     */
    protected $server;

    /**
     * Constructor.
     *
     * @param Server   $server
     * @param Sentinel $sentinel
     * @param array    $scopes
     */
    public function __construct(Server $server, Sentinel $sentinel, array $scopes = [])
    {
        $this->server = $server;
        $this->sentinel = $sentinel;
        $this->scopes = $this->formatScopes($scopes);
    }

    /**
     * {@inheritdoc}
     */
    public function __invoke(Request $request, Response $response, callable $next)
    {
        $oauth2Request = RequestBridge::toOAuth2($request);
        foreach ($this->scopes as $scope) {
            if ($this->server->verifyResourceRequest($oauth2Request, null, $scope)) {
                $token = $this->server->getResourceController()->getToken();

The method getToken() does not exist on OAuth2\Controller\ResourceControllerInterface. It seems like you code against a sub-type of OAuth2\Controller\ResourceControllerInterface such as OAuth2\Controller\ResourceController.

                $user = User::find($token['user_id']);

                $this->sentinel->stateless($user);

It seems like $user can also be of type Illuminate\Database\Eloquent\Model; however, parameter $credentials of Cartalyst\Sentinel\Sentinel::stateless() does only seem to accept Cartalyst\Sentinel\Users\UserInterface|array, maybe add an additional type check?

                return $next($request, $response);
            }
        }

        throw new UnauthorizedException($request, $response);
    }

    /**
     * Returns a callable function to be used as a authorization middleware with a specified scope.
     *
     * @param array $scopes Scopes require for authorization.
     *
     * @return Authorization
     */
    public function withRequiredScope(array $scopes)
    {
        $clone = clone $this;
        $clone->scopes = $clone->formatScopes($scopes);

        return $clone;
    }

    /**
     * Helper method to ensure given scopes are formatted properly.
     *
     * @param array $scopes Scopes required for authorization.
     *
     * @return array The formatted scopes array.
     */
    protected function formatScopes(array $scopes)
    {
        if (empty($scopes)) {
            return [null];
        }

        array_walk($scopes, function (&$scope) {
            if (is_array($scope)) {
                $scope = implode(' ', $scope);
            }
        });

        return $scopes;
    }
}