|
| 1 | +<?php |
| 2 | +namespace ADmad\JwtAuth\Auth; |
| 3 | + |
| 4 | +use Cake\Auth\BaseAuthenticate; |
| 5 | +use Cake\Controller\ComponentRegistry; |
| 6 | +use Cake\Network\Request; |
| 7 | +use Cake\Network\Response; |
| 8 | +use Cake\ORM\TableRegistry; |
| 9 | +use Cake\Utility\Security; |
| 10 | +use \JWT; |
| 11 | + |
| 12 | +/** |
| 13 | + * An authentication adapter for authenticating using JSON Web Tokens. |
| 14 | + * |
| 15 | + * {{{ |
| 16 | + * $this->Auth->config('authenticate', [ |
| 17 | + * 'ADmad/JwtAuth.Jwt' => [ |
| 18 | + * 'parameter' => '_token', |
| 19 | + * 'userModel' => 'Users', |
| 20 | + * 'scope' => ['User.active' => 1] |
| 21 | + * 'fields' => [ |
| 22 | + * 'id' => 'id' |
| 23 | + * ], |
| 24 | + * ] |
| 25 | + * ]); |
| 26 | + * }}} |
| 27 | + * |
| 28 | + * @copyright 2014 A. Sarela aka ADmad |
| 29 | + * @license MIT |
| 30 | + * @see http://jwt.io |
| 31 | + * @see http://tools.ietf.org/html/draft-ietf-oauth-json-web-token |
| 32 | + */ |
| 33 | +class JwtAuthenticate extends BaseAuthenticate { |
| 34 | + |
| 35 | +/** |
| 36 | + * Constructor. |
| 37 | + * |
| 38 | + * Settings for this object. |
| 39 | + * |
| 40 | + * - `parameter` - The url parameter name of the token. Defaults to `_token`. |
| 41 | + * First $_SERVER['HTTP_AUTHORIZATION'] is checked for token value. |
| 42 | + * It's value should be of form "Bearer <token>". If empty this query string |
| 43 | + * paramater is checked. |
| 44 | + * - `userModel` - The model name of the User, defaults to `Users`. |
| 45 | + * - `fields` - Has key `id` whose value contains primary key field name. |
| 46 | + * Defaults to ['id' => 'id']. |
| 47 | + * - `scope` - Additional conditions to use when looking up and authenticating |
| 48 | + * users, i.e. `['Users.is_active' => 1].` |
| 49 | + * - `contain` - Extra models to contain. |
| 50 | + * - `unauthenticatedException` - Fully namespaced exception name. Exception to |
| 51 | + * throw if authentication fails. Set to false to do nothing. |
| 52 | + * Defaults to '\Cake\Network\Exception\UnauthorizedException'. |
| 53 | + * |
| 54 | + * @param \Cake\Controller\ComponentRegistry $registry The Component registry |
| 55 | + * used on this request. |
| 56 | + * @param array $config Array of config to use. |
| 57 | + */ |
| 58 | + public function __construct(ComponentRegistry $registry, $config) { |
| 59 | + $this->config([ |
| 60 | + 'parameter' => '_token', |
| 61 | + 'fields' => ['id' => 'id'], |
| 62 | + 'unauthenticatedException' => '\Cake\Network\Exception\UnauthorizedException' |
| 63 | + ]); |
| 64 | + |
| 65 | + parent::__construct($registry, $config); |
| 66 | + } |
| 67 | + |
| 68 | +/** |
| 69 | + * Unused, since this is a stateless authentication provider. |
| 70 | + * |
| 71 | + * @param Request $request The request object. |
| 72 | + * @param Response $response response object. |
| 73 | + * @return bool Always false. |
| 74 | + */ |
| 75 | + public function authenticate(Request $request, Response $response) { |
| 76 | + return false; |
| 77 | + } |
| 78 | + |
| 79 | +/** |
| 80 | + * Get token information from the request. |
| 81 | + * |
| 82 | + * @param \Cake\Network\Request $request Request object. |
| 83 | + * @return bool|array Either false or an array of user information |
| 84 | + */ |
| 85 | + public function getUser(Request $request) { |
| 86 | + $token = $request->env('HTTP_AUTHORIZATION'); |
| 87 | + if ($token) { |
| 88 | + $token = explode(' ', $token); |
| 89 | + if (!empty($token[1])) { |
| 90 | + return $this->_findUser($token[1]); |
| 91 | + } |
| 92 | + } |
| 93 | + |
| 94 | + if (!empty($this->_config['parameter']) && |
| 95 | + $token = $request->query($this->_config['parameter']) |
| 96 | + ) { |
| 97 | + return $this->_findUser($token); |
| 98 | + } |
| 99 | + |
| 100 | + return false; |
| 101 | + } |
| 102 | + |
| 103 | +/** |
| 104 | + * Find a user record. |
| 105 | + * |
| 106 | + * @param string $token The token identifier. |
| 107 | + * @param string $password Unused password. |
| 108 | + * @return bool|array Either false on failure, or an array of user data. |
| 109 | + */ |
| 110 | + protected function _findUser($token, $password = null) { |
| 111 | + $token = JWT::decode($token, Security::salt()); |
| 112 | + |
| 113 | + // Token has full user record. |
| 114 | + if (isset($token->record)) { |
| 115 | + // Trick to convert object of stdClass to array. Typecasting to |
| 116 | + // array doesn't convert property values which are themselves objects. |
| 117 | + return json_decode(json_encode($token->record), true); |
| 118 | + } |
| 119 | + |
| 120 | + $userModel = $this->_config['userModel']; |
| 121 | + list($plugin, $model) = pluginSplit($userModel); |
| 122 | + $fields = $this->_config['fields']; |
| 123 | + |
| 124 | + $conditions = [$model . '.' . $fields['id'] => $token->id]; |
| 125 | + if (!empty($this->_config['scope'])) { |
| 126 | + $conditions = array_merge($conditions, $this->_config['scope']); |
| 127 | + } |
| 128 | + $table = TableRegistry::get($userModel)->find('all'); |
| 129 | + if ($this->_config['contain']) { |
| 130 | + $table = $table->contain($contain); |
| 131 | + } |
| 132 | + |
| 133 | + $result = $table |
| 134 | + ->where($conditions) |
| 135 | + ->hydrate(false) |
| 136 | + ->first(); |
| 137 | + |
| 138 | + if (empty($result)) { |
| 139 | + return false; |
| 140 | + } |
| 141 | + |
| 142 | + unset($result[$fields['password']]); |
| 143 | + return $result; |
| 144 | + } |
| 145 | + |
| 146 | +/** |
| 147 | + * Handles an unauthenticated access attempt. Depending on value of config |
| 148 | + * `unauthenticatedException` either throws the specified exception or returns |
| 149 | + * null. |
| 150 | + * |
| 151 | + * @param \Cake\Network\Request $request A request object. |
| 152 | + * @param \Cake\Network\Response $response A response object. |
| 153 | + * @return void |
| 154 | + * @throws \Cake\Network\Exception\UnauthorizedException |
| 155 | + */ |
| 156 | + public function unauthenticated(Request $request, Response $response) { |
| 157 | + if (!$this->_config['unauthenticatedException']) { |
| 158 | + return; |
| 159 | + } |
| 160 | + |
| 161 | + $exception = $this->_config['unauthenticatedException']; |
| 162 | + // @codingStandardsIgnoreStart |
| 163 | + throw new $exception($this->_registry->Auth->_config['authError']); |
| 164 | + // @codingStandardsIgnoreEnd |
| 165 | + } |
| 166 | + |
| 167 | +} |
0 commit comments