Jonny Barnes
d5706b5f8f
Tokens now store a hashed row in micropub_tokens instead of being self-contained signed JWTs, so a leaked or unwanted token can actually be revoked. Since revocation already requires a DB lookup on every request, JWT's stateless-verification benefit was gone anyway, so this also drops the lcobucci/jwt dependency entirely. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014625MfkGZ7GVdbqKme4a8L
63 lines
1.6 KiB
PHP
63 lines
1.6 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace App\Http\Middleware;
|
|
|
|
use App\Http\Responses\MicropubResponses;
|
|
use App\Models\MicropubToken;
|
|
use Closure;
|
|
use Illuminate\Http\Request;
|
|
use Symfony\Component\HttpFoundation\Response;
|
|
|
|
class VerifyMicropubToken
|
|
{
|
|
/**
|
|
* Handle an incoming request.
|
|
*
|
|
* @param Closure(Request): (Response) $next
|
|
*/
|
|
public function handle(Request $request, Closure $next): Response
|
|
{
|
|
$rawToken = null;
|
|
|
|
if ($request->input('access_token')) {
|
|
$rawToken = $request->input('access_token');
|
|
} elseif ($request->bearerToken()) {
|
|
$rawToken = $request->bearerToken();
|
|
}
|
|
|
|
if (! $rawToken) {
|
|
return response()->json([
|
|
'response' => 'error',
|
|
'error' => 'unauthorized',
|
|
'error_description' => 'No access token was provided in the request',
|
|
], 401);
|
|
}
|
|
|
|
$token = MicropubToken::where('token_hash', hash('sha256', $rawToken))
|
|
->whereNull('revoked_at')
|
|
->first();
|
|
|
|
if (! $token) {
|
|
$micropubResponses = new MicropubResponses;
|
|
|
|
return $micropubResponses->invalidTokenResponse();
|
|
}
|
|
|
|
if ($token->scope === '') {
|
|
$micropubResponses = new MicropubResponses;
|
|
|
|
return $micropubResponses->tokenHasNoScopeResponse();
|
|
}
|
|
|
|
return $next($request->merge([
|
|
'access_token' => $rawToken,
|
|
'token_data' => [
|
|
'me' => $token->me,
|
|
'scope' => $token->scope,
|
|
'client_id' => $token->client_id,
|
|
],
|
|
]));
|
|
}
|
|
}
|