Added possibility to authenticate with the given API token

config/packages/api_platform.yaml

@@ -3,4 +3,11 @@ api_platform:
   title: 'Part-DB API'
   description: 'API of Part-DB'
 
-  version: '0.1.0'
+  version: '0.1.0'
+
+  swagger:
+    api_keys:
+      # overridden in OpenApiFactoryDecorator
+      access_token:
+        name: Authorization
+        type: header

config/packages/security.yaml

@@ -21,6 +21,9 @@ security:
             user_checker: App\Security\UserChecker
             entry_point: form_login
 
+            access_token:
+                token_handler: App\Security\ApiTokenHandler
+
             # Enable user impersonation
             switch_user: { role: CAN_SWITCH_USER }
 

src/ApiPlatform/OpenApiFactoryDecorator.php

@@ -0,0 +1,50 @@
+<?php
+/*
+ * This file is part of Part-DB (https://github.com/Part-DB/Part-DB-symfony).
+ *
+ *  Copyright (C) 2019 - 2023 Jan Böhmer (https://github.com/jbtronics)
+ *
+ *  This program is free software: you can redistribute it and/or modify
+ *  it under the terms of the GNU Affero General Public License as published
+ *  by the Free Software Foundation, either version 3 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU Affero General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Affero General Public License
+ *  along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+declare(strict_types=1);
+
+
+namespace App\ApiPlatform;
+
+use ApiPlatform\OpenApi\Factory\OpenApiFactoryInterface;
+use ApiPlatform\OpenApi\Model\SecurityScheme;
+use ApiPlatform\OpenApi\OpenApi;
+use Symfony\Component\DependencyInjection\Attribute\AsDecorator;
+
+#[AsDecorator('api_platform.openapi.factory')]
+class OpenApiFactoryDecorator implements OpenApiFactoryInterface
+{
+    public function __construct(private readonly OpenApiFactoryInterface $decorated)
+    {
+    }
+
+    public function __invoke(array $context = []): OpenApi
+    {
+        $openApi = $this->decorated->__invoke($context);
+        $securitySchemes = $openApi->getComponents()->getSecuritySchemes() ?: new \ArrayObject();
+        $securitySchemes['access_token'] = new SecurityScheme(
+            type: 'http',
+            description: 'Use an API token to authenticate',
+            name: 'Authorization',
+            scheme: 'bearer',
+        );
+        return $openApi;
+    }
+}

src/Repository/UserSystem/ApiTokenRepository.php

@@ -23,10 +23,11 @@ declare(strict_types=1);
 
 namespace App\Repository\UserSystem;
 
-use App\Repository\NamedDBElementRepository;
+use App\Entity\UserSystem\ApiToken;
+use Doctrine\Bundle\DoctrineBundle\Repository\ServiceEntityRepository;
 use Doctrine\ORM\EntityRepository;
+use Doctrine\Persistence\ManagerRegistry;
 
 class ApiTokenRepository extends EntityRepository
 {
-
 }

src/Security/ApiTokenHandler.php

@@ -0,0 +1,61 @@
+<?php
+/*
+ * This file is part of Part-DB (https://github.com/Part-DB/Part-DB-symfony).
+ *
+ *  Copyright (C) 2019 - 2023 Jan Böhmer (https://github.com/jbtronics)
+ *
+ *  This program is free software: you can redistribute it and/or modify
+ *  it under the terms of the GNU Affero General Public License as published
+ *  by the Free Software Foundation, either version 3 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU Affero General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Affero General Public License
+ *  along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+declare(strict_types=1);
+
+
+namespace App\Security;
+
+use App\Entity\UserSystem\ApiToken;
+use App\Repository\UserSystem\ApiTokenRepository;
+use Doctrine\ORM\EntityManagerInterface;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;
+use Symfony\Component\Security\Core\Exception\BadCredentialsException;
+use Symfony\Component\Security\Core\Exception\CustomUserMessageAuthenticationException;
+use Symfony\Component\Security\Http\AccessToken\AccessTokenHandlerInterface;
+use Symfony\Component\Security\Http\Authenticator\Passport\Badge\UserBadge;
+use Symfony\Component\Security\Http\Authenticator\Passport\Passport;
+
+class ApiTokenHandler implements AccessTokenHandlerInterface
+{
+    private readonly ApiTokenRepository $apiTokenRepository;
+
+    public function __construct(EntityManagerInterface $entityManager)
+    {
+        $this->apiTokenRepository = $entityManager->getRepository(ApiToken::class);
+    }
+
+    public function getUserBadgeFrom(#[\SensitiveParameter] string $accessToken): UserBadge
+    {
+        $token = $this->apiTokenRepository->findOneBy(['token' => $accessToken]);
+
+        if (!$token instanceof ApiToken) {
+            throw new BadCredentialsException();
+        }
+
+        if (!$token->isValid()) {
+            throw new CustomUserMessageAuthenticationException('Token expired');
+        }
+
+        return new UserBadge(
+            userIdentifier:  $token->getUser()?->getUserIdentifier() ?? throw new BadCredentialsException(),
+        );
+    }
+}