vendor/shopware/core/Framework/Api/Controller/AuthController.php line 98

Open in your IDE?
  1. <?php declare(strict_types=1);
  3. namespace Shopware\Core\Framework\Api\Controller;
  5. use League\OAuth2\Server\AuthorizationServer;
  6. use OpenApi\Annotations as OA;
  7. use Shopware\Core\Framework\Api\Controller\Exception\AuthThrottledException;
  8. use Shopware\Core\Framework\RateLimiter\Exception\RateLimitExceededException;
  9. use Shopware\Core\Framework\RateLimiter\RateLimiter;
  10. use Shopware\Core\Framework\Routing\Annotation\RouteScope;
  11. use Shopware\Core\Framework\Routing\Annotation\Since;
  12. use Symfony\Bridge\PsrHttpMessage\Factory\HttpFoundationFactory;
  13. use Symfony\Bridge\PsrHttpMessage\Factory\PsrHttpFactory;
  14. use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
  15. use Symfony\Component\HttpFoundation\Request;
  16. use Symfony\Component\HttpFoundation\Response;
  17. use Symfony\Component\Routing\Annotation\Route;
  19. /**
  20.  * @Route(defaults={"_routeScope"={"api"}})
  21.  */
  22. class AuthController extends AbstractController
  23. {
  24.     private AuthorizationServer $authorizationServer;
  26.     private PsrHttpFactory $psrHttpFactory;
  28.     private RateLimiter $rateLimiter;
  30.     /**
  31.      * @internal
  32.      */
  33.     public function __construct(
  34.         AuthorizationServer $authorizationServer,
  35.         PsrHttpFactory $psrHttpFactory,
  36.         RateLimiter $rateLimiter
  37.     ) {
  38.         $this->authorizationServer = $authorizationServer;
  39.         $this->psrHttpFactory = $psrHttpFactory;
  40.         $this->rateLimiter = $rateLimiter;
  41.     }
  43.     /**
  44.      * @Since("6.0.0.0")
  45.      * @Route("/api/oauth/authorize", name="api.oauth.authorize", defaults={"auth_required"=false}, methods={"POST"})
  46.      */
  47.     public function authorize(Request $request): void
  48.     {
  49.     }
  51.     /**
  52.      * @Since("6.0.0.0")
  53.      * @OA\Post(
  54.      *     path="/oauth/token",
  55.      *     summary="Fetch an access token",
  56.      *     description="Fetch a access token that can be used to perform authenticated requests",
  57.      *     operationId="token",
  58.      *     tags={"Admin API", "Authorization & Authentication"},
  59.      *     @OA\RequestBody(
  60.      *         required=true,
  61.      *         @OA\JsonContent(
  62.      *             required={
  63.      *                  "grant_type"
  64.      *             },
  65.      *             description="For more information take a look at the [Authentication documentation](https://shopware.stoplight.io/docs/admin-api/docs/concepts/authentication-authorisation.md).",
  66.      *             @OA\Property(
  67.      *                 property="grant_type",
  68.      *                 description="The grant type that should be used. See [OAuth 2.0 grant](https://oauth2.thephpleague.com/authorization-server/which-grant/) for more information.",
  69.      *                 type="string",
  70.      *                 enum={"password", "refresh_token", "client_credentials"}
  71.      *             )
  72.      *         )
  73.      *     ),
  74.      *     @OA\Response(
  75.      *         response="200",
  76.      *         description="Authorized successfully.",
  77.      *         @OA\JsonContent(
  78.      *               @OA\Property(
  79.      *                  property="token_type",
  80.      *                  description="Type of the token.",
  81.      *                  type="string"
  82.      *              ),
  83.      *              @OA\Property(
  84.      *                  property="expires_in",
  85.      *                  description="Token lifetime in seconds.",
  86.      *                  type="integer"
  87.      *              ),
  88.      *              @OA\Property(
  89.      *                  property="access_token",
  90.      *                  description="The access token that can be used for subsequent requests",
  91.      *                  type="string"
  92.      *              )
  93.      *         )
  94.      *     )
  95.      * )
  96.      * @Route("/api/oauth/token", name="api.oauth.token", defaults={"auth_required"=false}, methods={"POST"})
  97.      */
  98.     public function token(Request $request): Response
  99.     {
  100.         $response = new Response();
  102.         try {
  103.             $cacheKey = $request->get('username') . '-' . $request->getClientIp();
  105.             $this->rateLimiter->ensureAccepted(RateLimiter::OAUTH, $cacheKey);
  106.         } catch (RateLimitExceededException $exception) {
  107.             throw new AuthThrottledException($exception->getWaitTime(), $exception);
  108.         }
  110.         $psr7Request = $this->psrHttpFactory->createRequest($request);
  111.         $psr7Response = $this->psrHttpFactory->createResponse($response);
  113.         $response = $this->authorizationServer->respondToAccessTokenRequest($psr7Request, $psr7Response);
  115.         $this->rateLimiter->reset(RateLimiter::OAUTH, $cacheKey);
  117.         return (new HttpFoundationFactory())->createResponse($response);
  118.     }
  119. }