File modules/cms/auth/ApiAuth.class.php

Last commit: Mon Jan 6 22:48:11 2025 +0100	Jan Dankert	New: Now it is possible to remove and create new login/api token for a user; new API authorization with the authorization scheme "api".


     1 <?php
     2 
     3 namespace cms\auth;
     4 
     5 use cms\action\Action;
     6 use cms\base\Configuration;
     7 use cms\base\DB;
     8 use cms\base\Startup;
     9 use database\Database;
    10 use cms\model\User;
    11 use logger\Logger;
    12 use util\Cookie;
    13 use security\Password;
    14 use \util\exception\ObjectNotFoundException;
    15 use util\Request;
    16 use util\Session;
    17 use util\text\TextMessage;
    18 
    19 /**
    20  * Authenticate with an API-Token.
    21  *
    22  * @author dankert
    23  */
    24 class ApiAuth {
    25 	/**
    26 	 * @return null
    27 	 */
    28 	public function getUserIdFromToken( $selector,$token)
    29 	{
    30 		$stmt = DB::sql(<<<SQL
    31 			SELECT userid,{{user}}.name as username,token,token_algo FROM {{auth}}
    32 			   LEFT JOIN {{user}} ON {{auth}}.userid = {{user}}.id
    33 			WHERE selector = {selector} AND expires > {now}
    34 SQL
    35 		);
    36 		$stmt->setString('selector', $selector);
    37 		$stmt->setInt   ('now'     , Startup::getStartTime() );
    38 
    39 		$auth = $stmt->getRow();
    40 
    41 		if ($auth) {
    42 			// serial was found.
    43 			$userid   = $auth['userid'  ];
    44 
    45 			// Check the token
    46 			if (Password::check($token, $auth['token'], $auth['token_algo'])) {
    47 				return new User( $userid );
    48 			}
    49 			else {
    50 				// Token mismatch.
    51 				return null;
    52 			}
    53 		} else {
    54 			// The serial is not found, maybe expired.
    55 			// There is nothing we should do here.
    56 			return null;
    57 		}
    58 	}
    59 }



Download modules/cms/auth/ApiAuth.class.php


History
Mon, 6 Jan 2025 22:48:11 +0100	Jan Dankert	New: Now it is possible to remove and create new login/api token for a user; new API authorization with the authorization scheme "api".