src/Infrastructure/Auth/Symfony/Security/Authenticator/SiteAuthenticator.php line 20

Open in your IDE?
  1. <?php
  3. declare(strict_types=1);
  5. namespace App\Infrastructure\Auth\Symfony\Security\Authenticator;
  7. use Symfony\Component\HttpFoundation\JsonResponse;
  8. use Symfony\Component\HttpFoundation\Request;
  9. use Symfony\Component\HttpFoundation\Response;
  10. use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
  11. use Symfony\Component\Security\Core\Exception\AuthenticationException;
  12. use Symfony\Component\Security\Core\Exception\BadCredentialsException;
  13. use Symfony\Component\Security\Http\Authenticator\AbstractAuthenticator;
  14. use Symfony\Component\Security\Http\Authenticator\Passport\Badge\UserBadge;
  15. use Symfony\Component\Security\Http\Authenticator\Passport\Credentials\PasswordCredentials;
  16. use Symfony\Component\Security\Http\Authenticator\Passport\Passport;
  17. use Psr\Log\LoggerAwareInterface;
  18. use Psr\Log\LoggerAwareTrait;
  20. class SiteAuthenticator extends AbstractAuthenticator implements LoggerAwareInterface
  21. {
  22.     use LoggerAwareTrait;
  24.     /**
  25.      * Paths under the /api firewall that are PUBLIC_ACCESS (see security.yaml)
  26.      * and must never be routed through site Basic-auth, regardless of what
  27.      * Authorization header (if any) the caller happens to send.
  28.      */
  29.     private const PUBLIC_PATH_PATTERNS = [
  30.         '#^/api/docs#',
  31.         '#^/api/direct-debit#',
  32.         '#^/api/recurring-payments#',
  33.         '#^/api/finxp-callback#',
  34.     ];
  36.     public function supports(Request $request): ?bool
  37.     {
  38.         foreach (self::PUBLIC_PATH_PATTERNS as $pattern) {
  39.             if (preg_match($pattern, $request->getPathInfo()) === 1) {
  40.                 return false;
  41.             }
  42.         }
  44.         return $request->headers->has('Authorization');
  45.     }
  47.     public function authenticate(Request $request): Passport
  48.     {
  49.         $header = (string) $request->headers->get('Authorization', '');
  51.         $username = null;
  52.         $password = null;
  54.         if (str_starts_with(strtolower($header), 'basic')) {
  55.             $decoded = base64_decode(trim(substr($header, 6)), true);
  56.             $basic = $decoded !== false ? explode(':', $decoded, 2) : [];
  57.             $username = $basic[0] ?? null;
  58.             $password = $basic[1] ?? null;
  59.         }
  61.         if ($username === null || $password === null) {
  62.             throw new BadCredentialsException('Missing or malformed Authorization header.');
  63.         }
  65.         return new Passport(new UserBadge($username), new PasswordCredentials($password));
  66.     }
  68.     public function onAuthenticationSuccess(Request $request, TokenInterface $token, string $firewallName): ?Response
  69.     {
  70.         return null;
  71.     }
  73.     public function onAuthenticationFailure(Request $request, AuthenticationException $exception): ?Response
  74.     {
  75.         $this->logger->error('Merchant authentication failed: ' . $exception->getMessage());
  76.         return new JsonResponse([
  77.             'error' => 'Authorization required',
  78.             'error_code' => 401,
  79.         ], Response::HTTP_UNAUTHORIZED);
  80.     }
  81. }