Mark Gregory
2b949cb354
* Versioned REST API under /api/v1 * Published Pages API * Published Blog API * Published News API * Secure bearer API tokens * SHA-256 token storage * Token abilities * Token expiry and revocation * Token usage tracking * Webhook subscriptions * Site-specific webhooks * HMAC-SHA256 webhook signatures * Webhook delivery history * Failure tracking * OpenAPI 3.1 JSON documentation * API administration screen * Administration navigation * API permissions * Module registration * Feature tests
5 lines
848 B
PHP
5 lines
848 B
PHP
<?php
|
|
namespace Modules\Api\Http\Middleware;
|
|
use Closure; use Illuminate\Http\Request; use Modules\Api\Models\ApiToken; use Symfony\Component\HttpFoundation\Response;
|
|
final class AuthenticateApiToken {public function handle(Request $r,Closure $next,?string $ability=null): Response{$plain=$r->bearerToken();if(!$plain)return response()->json(['message'=>'Unauthenticated.'],401);$token=ApiToken::with('user')->where('token',hash('sha256',$plain))->first();if(!$token||($token->expires_at&&$token->expires_at->isPast())||!$token->user)return response()->json(['message'=>'Invalid or expired API token.'],401);if($ability&&!$token->allows($ability))return response()->json(['message'=>'Insufficient token ability.'],403);$token->update(['last_used_at'=>now()]);auth()->setUser($token->user);$r->attributes->set('apiToken',$token);return $next($r);}}
|