119 lines
5.7 KiB
PHP
119 lines
5.7 KiB
PHP
<?php
|
||
|
||
namespace App\Http\Middleware;
|
||
|
||
use App\Enums\EarnApiTokenStatus;
|
||
use App\Models\EarnApiToken;
|
||
use App\Models\EarnMember;
|
||
use App\Services\EarnApiAccessLogger;
|
||
use App\Services\EarnDeviceIdentity;
|
||
use Closure;
|
||
use Illuminate\Http\JsonResponse;
|
||
use Illuminate\Http\Request;
|
||
use Illuminate\Support\Facades\RateLimiter;
|
||
use Symfony\Component\HttpFoundation\Response;
|
||
|
||
class AuthenticateEarnApiToken
|
||
{
|
||
public function __construct(private EarnDeviceIdentity $devices, private EarnApiAccessLogger $logs) {}
|
||
|
||
/**
|
||
* Earn token yaşam döngüsünü, yeteneğini, cihaz bağını ve moda özel hız sınırını doğrular.
|
||
*
|
||
* @author Gökhan Engin - İletişim : https://bit.ly/YazılımUzmanı
|
||
*/
|
||
public function handle(Request $request, Closure $next, string $ability, string $mode = 'tasks'): Response
|
||
{
|
||
$plain = $request->bearerToken();
|
||
if (! is_string($plain) || $plain === '') {
|
||
return $this->deny($request, 'TOKEN_MISSING', 401);
|
||
}
|
||
$token = EarnApiToken::findToken($plain);
|
||
if (! $token instanceof EarnApiToken || ! $token->tokenable instanceof EarnMember) {
|
||
return $this->deny($request, 'TOKEN_INVALID', 401);
|
||
}
|
||
$request->attributes->set('earn_api_token', $token);
|
||
$code = match ($token->status()) {
|
||
EarnApiTokenStatus::Inactive => 'TOKEN_INACTIVE', EarnApiTokenStatus::Expired => 'TOKEN_EXPIRED',
|
||
EarnApiTokenStatus::Revoked => 'TOKEN_REVOKED', default => null,
|
||
};
|
||
if ($code) {
|
||
return $this->deny($request, $code, 401, 'token_'.strtolower(substr($code, 6)));
|
||
}
|
||
$member = $token->tokenable;
|
||
if ($member->trashed() || $member->status->value !== 'active') {
|
||
return $this->deny($request, 'MEMBER_INACTIVE', 403, 'member_inactive');
|
||
}
|
||
if (! $member->hasVerifiedEmail()) {
|
||
return $this->deny($request, 'EMAIL_NOT_VERIFIED', 403);
|
||
}
|
||
if (! $token->can($ability)) {
|
||
return $this->deny($request, 'TOKEN_INVALID', 401);
|
||
}
|
||
$deviceId = $request->header('X-Device-ID');
|
||
if (! is_string($deviceId)) {
|
||
return $this->deny($request, 'DEVICE_ID_MISSING', 422);
|
||
}
|
||
$deviceId = $this->devices->normalize($deviceId);
|
||
if (! $this->devices->valid($deviceId)) {
|
||
return $this->deny($request, 'DEVICE_ID_INVALID', 422);
|
||
}
|
||
$hash = $this->devices->hash($deviceId);
|
||
$preview = $this->devices->preview($deviceId);
|
||
$request->attributes->set('earn_device_hash', $hash);
|
||
$request->attributes->set('earn_device_preview', $preview);
|
||
$limit = (int) config(match ($mode) {
|
||
'bind' => 'earn.api.bind_per_minute',
|
||
'results' => 'earn.api.task_results_per_minute',
|
||
default => 'earn.api.tasks_per_minute',
|
||
});
|
||
$rateKey = 'earn-api:'.$mode.':'.hash('sha256', $token->id.'|'.$hash.'|'.$request->ip());
|
||
if (RateLimiter::tooManyAttempts($rateKey, $limit)) {
|
||
$this->logs->record($request, $mode === 'results' ? 'task_result_rate_limited' : 'rate_limited', 429, 'RATE_LIMITED', $token, $hash, $preview);
|
||
|
||
return $this->error('RATE_LIMITED', 429)->header('Retry-After', (string) RateLimiter::availableIn($rateKey));
|
||
}
|
||
RateLimiter::hit($rateKey, 60);
|
||
if (in_array($mode, ['tasks', 'results'], true) && $token->device_id_hash === null) {
|
||
return $this->deny($request, 'DEVICE_NOT_BOUND', 409, 'device_not_bound', $hash, $preview);
|
||
}
|
||
if (in_array($mode, ['tasks', 'results'], true) && ! hash_equals($token->device_id_hash, $hash)) {
|
||
$failedKey = 'earn-api:failed-device:'.hash('sha256', $token->id.'|'.$request->ip());
|
||
$failedLimit = (int) config('earn.api.failed_device_per_minute');
|
||
if (RateLimiter::tooManyAttempts($failedKey, $failedLimit)) {
|
||
$this->logs->record($request, 'rate_limited', 429, 'RATE_LIMITED', $token, $hash, $preview);
|
||
|
||
return $this->error('RATE_LIMITED', 429)->header('Retry-After', (string) RateLimiter::availableIn($failedKey));
|
||
}
|
||
RateLimiter::hit($failedKey, 60);
|
||
$token->forceFill(['device_mismatch_seen' => true])->saveQuietly();
|
||
|
||
return $this->deny($request, 'DEVICE_MISMATCH', 409, 'device_mismatch', $hash, $preview);
|
||
}
|
||
$member->withAccessToken($token);
|
||
$request->setUserResolver(fn () => $member);
|
||
$response = $next($request);
|
||
if (in_array($mode, ['tasks', 'results'], true) && $response->isSuccessful()) {
|
||
if ($token->last_ip !== null && $token->last_ip !== $request->ip()) {
|
||
$this->logs->record($request, 'ip_changed', $response->getStatusCode(), null, $token, $hash, $preview);
|
||
}
|
||
$token->forceFill(['last_used_at' => now(), 'last_seen_at' => now(), 'last_ip' => $request->ip()])->saveQuietly();
|
||
$this->logs->record($request, $mode === 'results' ? 'task_results_access_granted' : 'tasks_access_granted', $response->getStatusCode(), null, $token, $hash, $preview);
|
||
}
|
||
|
||
return $response;
|
||
}
|
||
|
||
private function deny(Request $request, string $code, int $status, string $event = 'tasks_access_denied', ?string $hash = null, ?string $preview = null): JsonResponse
|
||
{
|
||
$this->logs->record($request, $event, $status, $code, null, $hash, $preview);
|
||
|
||
return $this->error($code, $status);
|
||
}
|
||
|
||
private function error(string $code, int $status): JsonResponse
|
||
{
|
||
return response()->json(['success' => false, 'error' => ['code' => $code, 'message' => __('earn_api.'.$code)]], $status)->header('Cache-Control', 'no-store');
|
||
}
|
||
}
|