vendor/ibexa/rest/src/bundle/EventListener/UserCheckRequestListener.php line 44

Open in your IDE?
  1. <?php
  3. /**
  4.  * @copyright Copyright (C) Ibexa AS. All rights reserved.
  5.  * @license For full copyright and license information view LICENSE file distributed with this source code.
  6.  */
  7. declare(strict_types=1);
  9. namespace Ibexa\Bundle\Rest\EventListener;
  11. use Ibexa\Bundle\Rest\Exception\UnexpectedUserException;
  12. use Ibexa\Contracts\Core\Repository\PermissionResolver;
  13. use Psr\Log\LoggerAwareInterface;
  14. use Psr\Log\LoggerAwareTrait;
  15. use Symfony\Component\EventDispatcher\EventSubscriberInterface;
  16. use Symfony\Component\HttpFoundation\Response;
  17. use Symfony\Component\HttpKernel\Event\RequestEvent;
  18. use Symfony\Component\HttpKernel\KernelEvents;
  19. use Symfony\Component\Security\Core\Security;
  21. final class UserCheckRequestListener implements EventSubscriberInterface, LoggerAwareInterface
  22. {
  23.     use LoggerAwareTrait;
  25.     private PermissionResolver $permissionResolver;
  27.     private Security $security;
  29.     public function __construct(PermissionResolver $permissionResolver, Security $security)
  30.     {
  31.         $this->permissionResolver = $permissionResolver;
  32.         $this->security = $security;
  33.     }
  35.     public static function getSubscribedEvents(): array
  36.     {
  37.         return [
  38.             KernelEvents::REQUEST => [
  39.                 ['checkUser'],
  40.             ],
  41.         ];
  42.     }
  44.     public function checkUser(RequestEvent $event): void
  45.     {
  46.         if (!$event->isMainRequest()) {
  47.             return;
  48.         }
  50.         if (!$event->getRequest()->attributes->get('is_rest_request')) {
  51.             return;
  52.         }
  54.         $request = $event->getRequest();
  55.         $expectedUserIdentifier = $request->headers->get('X-Expected-User');
  56.         if (empty($expectedUserIdentifier)) {
  57.             return;
  58.         }
  60.         $user = $this->security->getUser();
  61.         if ($user === null || $expectedUserIdentifier !== $user->getUsername()) {
  62.             throw new UnexpectedUserException('Expectation failed. User changed.', Response::HTTP_UNAUTHORIZED);
  63.         }
  64.     }
  65. }