Jonny Barnes
24da24a677
Lets a resource server (or a client checking its own token, via
self-introspection) verify a token's active/me/client_id/scope without
needing to be tightly coupled to this token endpoint. Requires the
caller to present their own currently-active token as authorization,
per spec's requirement that the endpoint MUST require some form of
authorization. Inactive tokens get back only {"active": false}, no
detail on why, matching the privacy stance already used for
revocation.
Pulled the hash-and-lookup-active-token logic (now needed a third
time) into MicropubToken::findActive(), used by this, the revocation
endpoint, and VerifyMicropubToken.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014625MfkGZ7GVdbqKme4a8L
61 lines
1.6 KiB
PHP
61 lines
1.6 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace App\Http\Middleware;
|
|
|
|
use App\Http\Responses\MicropubResponses;
|
|
use App\Models\MicropubToken;
|
|
use Closure;
|
|
use Illuminate\Http\Request;
|
|
use Symfony\Component\HttpFoundation\Response;
|
|
|
|
class VerifyMicropubToken
|
|
{
|
|
/**
|
|
* Handle an incoming request.
|
|
*
|
|
* @param Closure(Request): (Response) $next
|
|
*/
|
|
public function handle(Request $request, Closure $next): Response
|
|
{
|
|
$rawToken = null;
|
|
|
|
if ($request->input('access_token')) {
|
|
$rawToken = $request->input('access_token');
|
|
} elseif ($request->bearerToken()) {
|
|
$rawToken = $request->bearerToken();
|
|
}
|
|
|
|
if (! $rawToken) {
|
|
return response()->json([
|
|
'response' => 'error',
|
|
'error' => 'unauthorized',
|
|
'error_description' => 'No access token was provided in the request',
|
|
], 401);
|
|
}
|
|
|
|
$token = MicropubToken::findActive($rawToken);
|
|
|
|
if (! $token) {
|
|
$micropubResponses = new MicropubResponses;
|
|
|
|
return $micropubResponses->invalidTokenResponse();
|
|
}
|
|
|
|
if ($token->scope === '') {
|
|
$micropubResponses = new MicropubResponses;
|
|
|
|
return $micropubResponses->tokenHasNoScopeResponse();
|
|
}
|
|
|
|
return $next($request->merge([
|
|
'access_token' => $rawToken,
|
|
'token_data' => [
|
|
'me' => $token->me,
|
|
'scope' => $token->scope,
|
|
'client_id' => $token->client_id,
|
|
],
|
|
]));
|
|
}
|
|
}
|