src/EventSubscriber/UserAuthenticatedSubscriber.php line 34

Open in your IDE?
  1. <?php
  3. namespace App\EventSubscriber;
  5. use App\Controller\Api\ApiMessages;
  6. use App\Controller\Api\AssessmentController;
  7. use App\Controller\UserAuthenticatedController;
  8. use App\Enum\CsrfToken as TokenNames;
  9. use App\Model\Common\ResponseModel;
  10. use App\Response\ApiResponse;
  11. use App\Service\Config\ConfigLoader;
  12. use Symfony\Component\EventDispatcher\EventSubscriberInterface;
  13. use Symfony\Component\HttpFoundation\JsonResponse;
  14. use Symfony\Component\HttpFoundation\Response;
  15. use Symfony\Component\HttpKernel\Event\ControllerEvent;
  16. use Symfony\Component\HttpKernel\KernelEvents;
  17. use Symfony\Component\Security\Core\Security;
  18. use Symfony\Component\Security\Csrf\CsrfToken;
  19. use Symfony\Component\Security\Csrf\CsrfTokenManagerInterface;
  21. class UserAuthenticatedSubscriber implements EventSubscriberInterface
  22. {
  23.     private $security;
  24.     private $csrfTokenManager;
  25.     private $configLoader;
  27.     public function __construct(Security $security, CsrfTokenManagerInterface $csrfTokenManager, ConfigLoader $configLoader)
  28.     {
  29.         $this->security = $security;
  30.         $this->csrfTokenManager = $csrfTokenManager;
  31.         $this->configLoader = $configLoader;
  32.     }
  34.     public function onKernelController(ControllerEvent $event)
  35.     {
  36.         $controllers = $event->getController();
  38.         if (!is_array($controllers) || !$controllers[0] instanceof UserAuthenticatedController) {
  39.             return;
  40.         }
  42.         if (isset($_ENV['MAINTENANCE_MODE']) && $_ENV['MAINTENANCE_MODE']) {
  43.             $event->setController(
  44.                 function () {
  45.                     $response          = new ResponseModel();
  46.                     $response->success = false;
  47.                     $response->message = ApiMessages::UNAUTHENTICATED;
  49.                     return new JsonResponse($response, Response::HTTP_UNAUTHORIZED);
  50.                 }
  51.             );
  52.         }
  54.         if (!$this->checkAuthenticated()) {
  55.             $response          = new ResponseModel();
  56.             $response->success = false;
  57.             $response->message = ApiMessages::UNAUTHENTICATED;
  59.             $event->setController(
  60.                 function () use ($response) {
  61.                     return new JsonResponse($response, Response::HTTP_UNAUTHORIZED);
  62.                 }
  63.             );
  64.         }
  66.         if (!$this->checkCsrfToken($event)) {
  67.             $event->setController(
  68.                 function () {
  69.                     return ApiResponse::error(ApiMessages::INVALID_CSRF_TOKEN, 0, Response::HTTP_FORBIDDEN);
  70.                 }
  71.             );
  72.         }
  74.         if ($controllers[0] instanceof AssessmentController) {
  75.             if (!$this->configLoader->getValue("core_feature_assessment")) {
  76.                 $event->setController(
  77.                     function () {
  78.                         return ApiResponse::error(ApiMessages::ACTION_NOT_ALLOWED, 0, Response::HTTP_FORBIDDEN);
  79.                     }
  80.                 );
  81.             }
  82.         }
  83.     }
  85.     private function checkAuthenticated(): bool
  86.     {
  87.         return $this->security->isGranted('IS_AUTHENTICATED_FULLY');
  88.     }
  90.     private function checkCsrfToken($event): bool
  91.     {
  92.         $method = $event->getRequest()->getMethod();
  93.         $stateChangingMethods = ['post', 'put', 'patch', 'delete'];
  95.         if (!in_array(strtolower($method), $stateChangingMethods)) {
  96.             return true;
  97.         }
  99.         $tokenValue = $event->getRequest()->headers->get("x-csrf-token");
  100.         $csrfToken = new CsrfToken(TokenNames::API_TOKEN, $tokenValue);
  102.         return $this->csrfTokenManager->isTokenValid($csrfToken);
  103.     }
  105.     public static function getSubscribedEvents(): array
  106.     {
  107.         return [
  108.             KernelEvents::CONTROLLER => 'onKernelController',
  109.         ];
  110.     }
  111. }