vendor/shopware/core/Framework/Api/Controller/AuthController.php line 107

Open in your IDE?
  1. <?php declare(strict_types=1);
  3. namespace Shopware\Core\Framework\Api\Controller;
  5. use League\OAuth2\Server\AuthorizationServer;
  6. use OpenApi\Annotations as OA;
  7. use Shopware\Core\Framework\Api\Controller\Exception\AuthThrottledException;
  8. use Shopware\Core\Framework\RateLimiter\Exception\RateLimitExceededException;
  9. use Shopware\Core\Framework\RateLimiter\RateLimiter;
  10. use Shopware\Core\Framework\Routing\Annotation\RouteScope;
  11. use Shopware\Core\Framework\Routing\Annotation\Since;
  12. use Symfony\Bridge\PsrHttpMessage\Factory\HttpFoundationFactory;
  13. use Symfony\Bridge\PsrHttpMessage\Factory\PsrHttpFactory;
  14. use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
  15. use Symfony\Component\HttpFoundation\Request;
  16. use Symfony\Component\HttpFoundation\Response;
  17. use Symfony\Component\Routing\Annotation\Route;
  19. /**
  20.  * @RouteScope(scopes={"api"})
  21.  */
  22. class AuthController extends AbstractController
  23. {
  24.     private AuthorizationServer $authorizationServer;
  26.     private PsrHttpFactory $psrHttpFactory;
  28.     private RateLimiter $rateLimiter;
  30.     public function __construct(
  31.         AuthorizationServer $authorizationServer,
  32.         PsrHttpFactory $psrHttpFactory,
  33.         RateLimiter $rateLimiter
  34.     ) {
  35.         $this->authorizationServer = $authorizationServer;
  36.         $this->psrHttpFactory = $psrHttpFactory;
  37.         $this->rateLimiter = $rateLimiter;
  38.     }
  40.     /**
  41.      * @Since("6.0.0.0")
  42.      * @Route("/api/oauth/authorize", name="api.oauth.authorize", defaults={"auth_required"=false}, methods={"POST"})
  43.      */
  44.     public function authorize(Request $request): void
  45.     {
  46.     }
  48.     /**
  49.      * @Since("6.0.0.0")
  50.      * @OA\Post(
  51.      *     path="/oauth/token",
  52.      *     summary="Fetch an access token",
  53.      *     description="Fetch a access token that can be used to perform authenticated requests",
  54.      *     operationId="token",
  55.      *     tags={"Admin API", "Authorization & Authentication"},
  56.      *     @OA\RequestBody(
  57.      *         required=true,
  58.      *         @OA\JsonContent(
  59.      *             required={
  60.      *                  "grant_type"
  61.      *             },
  62.      *             description="For more information take a look at the [Authentication documentation](https://shopware.stoplight.io/docs/admin-api/docs/concepts/authentication-authorisation.md).",
  63.      *             @OA\Property(
  64.      *                 property="grant_type",
  65.      *                 description="The grant type that should be used. See [OAuth 2.0 grant](https://oauth2.thephpleague.com/authorization-server/which-grant/) for more information.",
  66.      *                 type="string",
  67.      *                 enum={"password", "refresh_token", "client_credentials"}
  68.      *             )
  69.      *         )
  70.      *     ),
  71.      *     @OA\Response(
  72.      *         response="200",
  73.      *         description="Authorized successfully.",
  74.      *         @OA\JsonContent(
  75.      *               @OA\Property(
  76.      *                  property="token_type",
  77.      *                  description="Type of the token.",
  78.      *                  type="string"
  79.      *              ),
  80.      *              @OA\Property(
  81.      *                  property="expires_in",
  82.      *                  description="Token lifetime in seconds.",
  83.      *                  type="integer"
  84.      *              ),
  85.      *              @OA\Property(
  86.      *                  property="access_token",
  87.      *                  description="The access token that can be used for subsequent requests",
  88.      *                  type="string"
  89.      *              )
  90.      *         )
  91.      *     )
  92.      * )
  93.      * @Route("/api/oauth/token", name="api.oauth.token", defaults={"auth_required"=false}, methods={"POST"})
  94.      */
  95.     public function token(Request $request): Response
  96.     {
  97.         $response = new Response();
  99.         try {
  100.             $cacheKey = $request->get('username') . '-' . $request->getClientIp();
  102.             $this->rateLimiter->ensureAccepted(RateLimiter::OAUTH, $cacheKey);
  103.         } catch (RateLimitExceededException $exception) {
  104.             throw new AuthThrottledException($exception->getWaitTime(), $exception);
  105.         }
  107.         $psr7Request = $this->psrHttpFactory->createRequest($request);
  108.         $psr7Response = $this->psrHttpFactory->createResponse($response);
  110.         $response = $this->authorizationServer->respondToAccessTokenRequest($psr7Request, $psr7Response);
  112.         $this->rateLimiter->reset(RateLimiter::OAUTH, $cacheKey);
  114.         return (new HttpFoundationFactory())->createResponse($response);
  115.     }
  116. }