Merge pull request #11 from yabhq/authorization-headers

chrisblackwell · web-flow · commit 6da342414b22 · 2019-04-12T11:45:41.000-04:00
Change to X-Authorization
diff --git a/config/config.php b/config/config.php
@@ -1,307 +1,48 @@
 <?php
 
 return [
-    'auth' => [
-        'enabled' => true
+    /*
+    |--------------------------------------------------------------------------
+    | FlightDeck Authorization
+    |--------------------------------------------------------------------------
+    |
+    | Enabling authorization (not to be confused with authentication), allows
+    | your API to control who can access your API without the need of
+    | using a traditional auth system with usernames and passwords
+    |
+    */
+    'authorization' => [
+        'enabled' => true,
+        'header' => 'X-Authorization',
     ],
-    'tokens' => [
-        'expire_days' => 30
-    ],
-    'cors' => [
-        'enabled' => true
-    ],
-    'jwt' => [
-
-        /*
-        |--------------------------------------------------------------------------
-        | JWT Authentication Secret
-        |--------------------------------------------------------------------------
-        |
-        | Don't forget to set this in your .env file, as it will be used to sign
-        | your tokens. A helper command is provided for this:
-        | `php artisan jwt:secret`
-        |
-        | Note: This will be used for Symmetric algorithms only (HMAC),
-        | since RSA and ECDSA use a private/public key combo (See below).
-        |
-        */
-
-        'secret' => env('JWT_SECRET'),
-
-        /*
-        |--------------------------------------------------------------------------
-        | JWT Authentication Keys
-        |--------------------------------------------------------------------------
-        |
-        | The algorithm you are using, will determine whether your tokens are
-        | signed with a random string (defined in `JWT_SECRET`) or using the
-        | following public & private keys.
-        |
-        | Symmetric Algorithms:
-        | HS256, HS384 & HS512 will use `JWT_SECRET`.
-        |
-        | Asymmetric Algorithms:
-        | RS256, RS384 & RS512 / ES256, ES384 & ES512 will use the keys below.
-        |
-        */
-
-        'keys' => [
-
-            /*
-            |--------------------------------------------------------------------------
-            | Public Key
-            |--------------------------------------------------------------------------
-            |
-            | A path or resource to your public key.
-            |
-            | E.g. 'file://path/to/public/key'
-            |
-            */
-
-            'public' => env('JWT_PUBLIC_KEY'),
-
-            /*
-            |--------------------------------------------------------------------------
-            | Private Key
-            |--------------------------------------------------------------------------
-            |
-            | A path or resource to your private key.
-            |
-            | E.g. 'file://path/to/private/key'
-            |
-            */
-
-            'private' => env('JWT_PRIVATE_KEY'),
-
-            /*
-            |--------------------------------------------------------------------------
-            | Passphrase
-            |--------------------------------------------------------------------------
-            |
-            | The passphrase for your private key. Can be null if none set.
-            |
-            */
-
-            'passphrase' => env('JWT_PASSPHRASE'),
-
-        ],
-
-        /*
-        |--------------------------------------------------------------------------
-        | JWT time to live
-        |--------------------------------------------------------------------------
-        |
-        | Specify the length of time (in minutes) that the token will be valid for.
-        | Defaults to 1 hour.
-        |
-        | You can also set this to null, to yield a never expiring token.
-        | Some people may want this behaviour for e.g. a mobile app.
-        | This is not particularly recommended, so make sure you have appropriate
-        | systems in place to revoke the token if necessary.
-        | Notice: If you set this to null you should remove 'exp' element from 'required_claims' list.
-        |
-        */
-
-        'ttl' => env('JWT_TTL', 60),
-
-        /*
-        |--------------------------------------------------------------------------
-        | Refresh time to live
-        |--------------------------------------------------------------------------
-        |
-        | Specify the length of time (in minutes) that the token can be refreshed
-        | within. I.E. The user can refresh their token within a 2 week window of
-        | the original token being created until they must re-authenticate.
-        | Defaults to 2 weeks.
-        |
-        | You can also set this to null, to yield an infinite refresh time.
-        | Some may want this instead of never expiring tokens for e.g. a mobile app.
-        | This is not particularly recommended, so make sure you have appropriate
-        | systems in place to revoke the token if necessary.
-        |
-        */
-
-        'refresh_ttl' => env('JWT_REFRESH_TTL', 20160),
-
-        /*
-        |--------------------------------------------------------------------------
-        | JWT hashing algorithm
-        |--------------------------------------------------------------------------
-        |
-        | Specify the hashing algorithm that will be used to sign the token.
-        |
-        | See here: https://github.com/namshi/jose/tree/master/src/Namshi/JOSE/Signer/OpenSSL
-        | for possible values.
-        |
-        */
-
-        'algo' => env('JWT_ALGO', 'HS256'),
-
-        /*
-        |--------------------------------------------------------------------------
-        | Required Claims
-        |--------------------------------------------------------------------------
-        |
-        | Specify the required claims that must exist in any token.
-        | A TokenInvalidException will be thrown if any of these claims are not
-        | present in the payload.
-        |
-        */
-
-        'required_claims' => [
-            'iss',
-            'iat',
-            'exp',
-            'nbf',
-            'sub',
-            'jti',
-        ],
-
-        /*
-        |--------------------------------------------------------------------------
-        | Persistent Claims
-        |--------------------------------------------------------------------------
-        |
-        | Specify the claim keys to be persisted when refreshing a token.
-        | `sub` and `iat` will automatically be persisted, in
-        | addition to the these claims.
-        |
-        | Note: If a claim does not exist then it will be ignored.
-        |
-        */
 
-        'persistent_claims' => [
-            // 'foo',
-            // 'bar',
-        ],
-
-        /*
-        |--------------------------------------------------------------------------
-        | Lock Subject
-        |--------------------------------------------------------------------------
-        |
-        | This will determine whether a `prv` claim is automatically added to
-        | the token. The purpose of this is to ensure that if you have multiple
-        | authentication models e.g. `App\User` & `App\OtherPerson`, then we
-        | should prevent one authentication request from impersonating another,
-        | if 2 tokens happen to have the same id across the 2 different models.
-        |
-        | Under specific circumstances, you may want to disable this behaviour
-        | e.g. if you only have one authentication model, then you would save
-        | a little on token size.
-        |
-        */
-
-        'lock_subject' => true,
-
-        /*
-        |--------------------------------------------------------------------------
-        | Leeway
-        |--------------------------------------------------------------------------
-        |
-        | This property gives the jwt timestamp claims some "leeway".
-        | Meaning that if you have any unavoidable slight clock skew on
-        | any of your servers then this will afford you some level of cushioning.
-        |
-        | This applies to the claims `iat`, `nbf` and `exp`.
-        |
-        | Specify in seconds - only if you know you need it.
-        |
-        */
-
-        'leeway' => env('JWT_LEEWAY', 0),
-
-        /*
-        |--------------------------------------------------------------------------
-        | Blacklist Enabled
-        |--------------------------------------------------------------------------
-        |
-        | In order to invalidate tokens, you must have the blacklist enabled.
-        | If you do not want or need this functionality, then set this to false.
-        |
-        */
-
-        'blacklist_enabled' => env('JWT_BLACKLIST_ENABLED', true),
-
-        /*
-        | -------------------------------------------------------------------------
-        | Blacklist Grace Period
-        | -------------------------------------------------------------------------
-        |
-        | When multiple concurrent requests are made with the same JWT,
-        | it is possible that some of them fail, due to token regeneration
-        | on every request.
-        |
-        | Set grace period in seconds to prevent parallel request failure.
-        |
-        */
-
-        'blacklist_grace_period' => env('JWT_BLACKLIST_GRACE_PERIOD', 0),
-
-        /*
-        |--------------------------------------------------------------------------
-        | Cookies encryption
-        |--------------------------------------------------------------------------
-        |
-        | By default Laravel encrypt cookies for security reason.
-        | If you decide to not decrypt cookies, you will have to configure Laravel
-        | to not encrypt your cookie token by adding its name into the $except
-        | array available in the middleware "EncryptCookies" provided by Laravel.
-        | see https://laravel.com/docs/master/responses#cookies-and-encryption
-        | for details.
-        |
-        | Set it to true if you want to decrypt cookies.
-        |
-        */
-
-        'decrypt_cookies' => false,
-
-        /*
-        |--------------------------------------------------------------------------
-        | Providers
-        |--------------------------------------------------------------------------
-        |
-        | Specify the various providers used throughout the package.
-        |
-        */
-
-        'providers' => [
-
-            /*
-            |--------------------------------------------------------------------------
-            | JWT Provider
-            |--------------------------------------------------------------------------
-            |
-            | Specify the provider that is used to create and decode the tokens.
-            |
-            */
-
-            'jwt' => Tymon\JWTAuth\Providers\JWT\Lcobucci::class,
-
-            /*
-            |--------------------------------------------------------------------------
-            | Authentication Provider
-            |--------------------------------------------------------------------------
-            |
-            | Specify the provider that is used to authenticate users.
-            |
-            */
-
-            'auth' => Tymon\JWTAuth\Providers\Auth\Illuminate::class,
-
-            /*
-            |--------------------------------------------------------------------------
-            | Storage Provider
-            |--------------------------------------------------------------------------
-            |
-            | Specify the provider that is used to store tokens in the blacklist.
-            |
-            */
-
-            'storage' => Tymon\JWTAuth\Providers\Storage\Illuminate::class,
-
-        ],
+    /*
+    |--------------------------------------------------------------------------
+    | FlightDeck Authentication
+    |--------------------------------------------------------------------------
+    |
+    | Enabling authentication adds routes for login, password resetting
+    | and registration. By default we use JWT
+    |
+    */
+    'authentication' => [
+        'enabled' => true,
+    ],
 
+    'tokens' => [
+        'expire_days' => 30,
     ],
 
+    /*
+    |--------------------------------------------------------------------------
+    | Cross-Origin Resource Sharing (CORS)
+    |--------------------------------------------------------------------------
+    |
+    | If you consume your API from a different domain, you will need to
+    | enable CORS to be able to access it
+    |
+    */
+    'cors' => [
+        'enabled' => true,
+    ],
 ];
diff --git a/src/FlightDeckServiceProvider.php b/src/FlightDeckServiceProvider.php
@@ -21,7 +21,7 @@ public function boot()
         $this->loadTranslationsFrom(__DIR__.'/../resources/lang', 'flightdeck');
         $this->loadMigrationsFrom(__DIR__.'/../database/migrations');
         
-        if (config('flightdeck.auth.enabled')) {
+        if (config('flightdeck.authentication.enabled')) {
             $this->loadRoutesFrom(__DIR__ . '/routes/auth.php');
         }
 
diff --git a/src/Http/Middleware/Authorization.php b/src/Http/Middleware/Authorization.php
@@ -13,13 +13,17 @@ class Authorization
      *
      * @param  \Illuminate\Http\Request  $request
      * @param  \Closure  $next
+     *
      * @return mixed
      */
     public function handle($request, Closure $next)
     {
-        if (FlightDeck::checkToken($request->token)) {
-            return $next($request);
+        if (config('flightdeck.authorization.enabled')) {
+            if (FlightDeck::checkToken($request->header(config('flightdeck.authorization.header')))) {
+                return $next($request);
+            }
+            throw new AuthorizationException('You have provided an invalid api token.');
         }
-        throw new AuthorizationException('You have provided an invalid api token.');
+        return $next($request);
     }
 }
diff --git a/tests/AuthorizationTest.php b/tests/AuthorizationTest.php
@@ -17,7 +17,9 @@ public function valid_authorization_token_allows_request()
                     ]);
         })->middleware('flightdeck');
 
-        $response = $this->json('GET', '/authorization-test', [
+        $response = $this->withHeaders([
+            'X-Authorization' => $token,
+        ])->json('GET', '/authorization-test', [
             'token' => $token,
         ]);
         $response->assertSuccessful();
@@ -44,7 +46,9 @@ public function expired_token_is_unauthorized()
     {
         $token = FlightDeck::generate('app2', now()->subDays(2)->toDateTimeString());
         Route::get('authorization-test', function () {
-            return response()->json([
+            return response()->withHeaders([
+                'X-Authorization' => $token,
+            ])->json([
                 'data' => 'this was a success',
             ]);
         })->middleware('flightdeck');

Original file line number	Diff line number	Diff line change
`@@ -21,7 +21,7 @@ public function boot()`
`21`	`21`	`$this->loadTranslationsFrom(__DIR__.'/../resources/lang', 'flightdeck');`
`22`	`22`	`$this->loadMigrationsFrom(__DIR__.'/../database/migrations');`
`23`	`23`
`24`		`- if (config('flightdeck.auth.enabled')) {`
	`24`	`+ if (config('flightdeck.authentication.enabled')) {`
`25`	`25`	`$this->loadRoutesFrom(__DIR__ . '/routes/auth.php');`
`26`	`26`	`}`
`27`	`27`
Original file line number	Diff line number	Diff line change
`@@ -13,13 +13,17 @@ class Authorization`
`13`	`13`	`*`
`14`	`14`	`* @param \Illuminate\Http\Request $request`
`15`	`15`	`* @param \Closure $next`
	`16`	`+ *`
`16`	`17`	`* @return mixed`
`17`	`18`	`*/`
`18`	`19`	`public function handle($request, Closure $next)`
`19`	`20`	`{`
`20`		`- if (FlightDeck::checkToken($request->token)) {`
`21`		`- return $next($request);`
	`21`	`+ if (config('flightdeck.authorization.enabled')) {`
	`22`	`+ if (FlightDeck::checkToken($request->header(config('flightdeck.authorization.header')))) {`
	`23`	`+ return $next($request);`
	`24`	`+ }`
	`25`	`+ throw new AuthorizationException('You have provided an invalid api token.');`
`22`	`26`	`}`
`23`		`- throw new AuthorizationException('You have provided an invalid api token.');`
	`27`	`+ return $next($request);`
`24`	`28`	`}`
`25`	`29`	`}`