Refine Voter system

config/api_platform/resources/asset.yaml

@@ -1,6 +1,6 @@
 resources:
     Pimcore\Bundle\StudioApiBundle\Dto\Asset:
-        #security: 'is_granted("API_PLATFORM")'
+        security: 'is_granted("API_PLATFORM")'
         operations:
             ApiPlatform\Metadata\GetCollection:
                 filters:

src/Exception/NoAuthTokenFound.php

@@ -0,0 +1,24 @@
+<?php
+declare(strict_types=1);
+
+/**
+ * Pimcore
+ *
+ * This source file is available under two different licenses:
+ * - GNU General Public License version 3 (GPLv3)
+ * - Pimcore Commercial License (PCL)
+ * Full copyright and license information is available in
+ * LICENSE.md which is distributed with this source code.
+ *
+ *  @copyright  Copyright (c) Pimcore GmbH (http://www.pimcore.org)
+ *  @license    http://www.pimcore.org/license     GPLv3 and PCL
+ */
+
+namespace Pimcore\Bundle\StudioApiBundle\Exception;
+
+use RuntimeException;
+
+final class NoAuthTokenFound extends RuntimeException
+{
+
+}

src/Exception/NoRequestException.php

@@ -0,0 +1,20 @@
+<?php
+declare(strict_types=1);
+
+/**
+ * Pimcore
+ *
+ * This source file is available under following license:
+ * - Pimcore Commercial License (PCL)
+ *
+ *  @copyright  Copyright (c) Pimcore GmbH (http://www.pimcore.org)
+ *  @license    http://www.pimcore.org/license     PCL
+ */
+
+namespace Pimcore\Bundle\StudioApiBundle\Exception;
+
+use RuntimeException;
+
+final class NoRequestException extends RuntimeException
+{
+}

src/Security/Trait/RequestTrait.php

@@ -0,0 +1,53 @@
+<?php
+declare(strict_types=1);
+
+/**
+ * Pimcore
+ *
+ * This source file is available under two different licenses:
+ * - GNU General Public License version 3 (GPLv3)
+ * - Pimcore Commercial License (PCL)
+ * Full copyright and license information is available in
+ * LICENSE.md which is distributed with this source code.
+ *
+ *  @copyright  Copyright (c) Pimcore GmbH (http://www.pimcore.org)
+ *  @license    http://www.pimcore.org/license     GPLv3 and PCL
+ */
+
+namespace Pimcore\Bundle\StudioApiBundle\Security\Trait;
+
+use Pimcore\Bundle\StudioApiBundle\Exception\NoAuthTokenFound;
+use Pimcore\Bundle\StudioApiBundle\Exception\NoRequestException;
+use Symfony\Component\HttpFoundation\Request;
+
+trait RequestTrait
+{
+    private const BEARER_PREFIX = 'Bearer ';
+
+    private const AUTHORIZATION_HEADER = 'Authorization';
+
+    private function getAuthToken(Request $request): string
+    {
+        $authToken = $request->headers->get(self::AUTHORIZATION_HEADER);
+        if($authToken === null) {
+            throw new NoAuthTokenFound('Full authentication is required to access this resource.');
+        }
+
+        return $this->removeBearerPrefix($authToken);
+    }
+
+    private function getCurrentRequest(): Request
+    {
+        $request = $this->requestStack->getCurrentRequest();
+        if(!$request) {
+            throw new NoRequestException('No request found');
+        }
+
+        return $request;
+    }
+
+    private function removeBearerPrefix(string $token): string
+    {
+        return str_replace(self::BEARER_PREFIX, '', $token);
+    }
+}

src/Security/Voter/TokenVoter.php

@@ -16,16 +16,15 @@
 
 namespace Pimcore\Bundle\StudioApiBundle\Security\Voter;
 
+use Pimcore\Bundle\StudioApiBundle\Security\Trait\RequestTrait;
 use Pimcore\Bundle\StudioApiBundle\Service\SecurityServiceInterface;
 use Symfony\Component\HttpFoundation\RequestStack;
 use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
 use Symfony\Component\Security\Core\Authorization\Voter\Voter;
 
 final class TokenVoter extends Voter
 {
-    private const BEARER_PREFIX = 'Bearer ';
-
-    private const AUTHORIZATION_HEADER = 'Authorization';
+    use RequestTrait;
 
     private const SUPPORTED_ATTRIBUTE = 'API_PLATFORM';
 
@@ -53,16 +52,12 @@ protected function voteOnAttribute(string $attribute, mixed $subject, TokenInter
             return false;
         }
 
-        $authToken = $this->requestStack->getCurrentRequest()->headers->get(self::AUTHORIZATION_HEADER);
-        if($authToken === null) {
-            return false;
-        }
+        $request = $this->getCurrentRequest();
 
-        return $this->securityService->isAllowed($this->removeBearerPrefix($authToken));
-    }
+        $authToken = $this->getAuthToken($request);
 
-    private function removeBearerPrefix(string $token): string
-    {
-        return str_replace(self::BEARER_PREFIX, '', $token);
+        return $this->securityService->checkAuthToken($authToken);
     }
+
+
 }

src/Service/SecurityService.php

@@ -54,7 +54,7 @@ public function authenticateUser(Create $token): PasswordAuthenticatedUserInterf
         return $user;
     }
 
-    public function isAllowed(string $token): bool
+    public function checkAuthToken(string $token): bool
     {
         $entry = $this->tmpStoreResolver->get($token);
 

src/Service/SecurityServiceInterface.php

@@ -26,5 +26,5 @@ interface SecurityServiceInterface
 {
     public function authenticateUser(Create $token): PasswordAuthenticatedUserInterface;
 
-    public function isAllowed(string $token): bool;
+    public function checkAuthToken(string $token): bool;
 }

tests/Unit/Service/Security/SecurityServiceTest.php

@@ -71,7 +71,7 @@ public function testTokenAllowedTrue(): void
     {
         $securityService = $this->mockSecurityService(false, false);
 
-        $this->assertTrue($securityService->isAllowed('test'));
+        $this->assertTrue($securityService->checkAuthToken('test'));
     }
 
     /**
@@ -81,7 +81,7 @@ public function testTokenAllowedFalse(): void
     {
         $securityService = $this->mockSecurityService(false, false, false);
 
-        $this->assertFalse($securityService->isAllowed('test'));
+        $this->assertFalse($securityService->checkAuthToken('test'));
     }
 
     /**