System CLI: Updated to 126de5599c state

[bookstack] / app / Http / Middleware / ApiAuthenticate.php

diff --git a/app/Http/Middleware/ApiAuthenticate.php b/app/Http/Middleware/ApiAuthenticate.php
index c7fed405cc41e77b4176225a386b497e9793bc63..5f3ad3168a0bbd3bbd1209996f50067027ce630f 100644 (file)
--- a/app/Http/Middleware/ApiAuthenticate.php
+++ b/app/Http/Middleware/ApiAuthenticate.php
@@ -8,49 +8,51 @@ use Illuminate\Http\Request;
 
 class ApiAuthenticate
 {
 
 class ApiAuthenticate
 {

-    use ChecksForEmailConfirmation;
-

     /**
      * Handle an incoming request.
     /**
      * Handle an incoming request.

+     *
+     * @throws ApiAuthException

      */
     public function handle(Request $request, Closure $next)
      */
     public function handle(Request $request, Closure $next)

+    {
+        // Validate the token and it's users API access
+        $this->ensureAuthorizedBySessionOrToken();
+
+        return $next($request);
+    }
+
+    /**
+     * Ensure the current user can access authenticated API routes, either via existing session
+     * authentication or via API Token authentication.
+     *
+     * @throws ApiAuthException
+     */
+    protected function ensureAuthorizedBySessionOrToken(): void

     {
         // Return if the user is already found to be signed in via session-based auth.
         // This is to make it easy to browser the API via browser after just logging into the system.
     {
         // Return if the user is already found to be signed in via session-based auth.
         // This is to make it easy to browser the API via browser after just logging into the system.

-        if (signedInUser()) {
-            if ($this->awaitingEmailConfirmation()) {
-                return $this->emailConfirmationErrorResponse($request);
+        if (!user()->isGuest() || session()->isStarted()) {
+            if (!$this->sessionUserHasApiAccess()) {
+                throw new ApiAuthException(trans('errors.api_user_no_api_permission'), 403);

             }
             }

-            return $next($request);
+
+            return;

         }
 
         // Set our api guard to be the default for this request lifecycle.
         auth()->shouldUse('api');
 
         // Validate the token and it's users API access
         }
 
         // Set our api guard to be the default for this request lifecycle.
         auth()->shouldUse('api');
 
         // Validate the token and it's users API access

-        try {
-            auth()->authenticate();
-        } catch (ApiAuthException $exception) {
-            return $this->unauthorisedResponse($exception->getMessage(), $exception->getCode());
-        }
-
-        if ($this->awaitingEmailConfirmation()) {
-            return $this->emailConfirmationErrorResponse($request);
-        }
-
-        return $next($request);
+        auth()->authenticate();

     }
 
     /**
     }
 
     /**

-     * Provide a standard API unauthorised response.
+     * Check if the active session user has API access.

      */
      */

-    protected function unauthorisedResponse(string $message, int $code)
+    protected function sessionUserHasApiAccess(): bool

     {
     {

-        return response()->json([
-            'error' => [
-                'code' => $code,
-                'message' => $message,
-            ]
-        ], 401);
+        $hasApiPermission = user()->can('access-api');
+
+        return $hasApiPermission && user()->hasAppAccess();

     }
 }
     }
 }