Add Token Voter

config/api_platform/resources/asset.yaml

@@ -1,5 +1,6 @@
 resources:
     Pimcore\Bundle\StudioApiBundle\Dto\Asset:
+        #security: 'is_granted("API_PLATFORM")'
         operations:
             ApiPlatform\Metadata\GetCollection:
                 filters:

config/services.yaml

@@ -89,4 +89,11 @@ services:
         class: Pimcore\Bundle\StudioApiBundle\Service\TokenService
 
     Pimcore\Bundle\StudioApiBundle\Service\SecurityServiceInterface:
-        class: Pimcore\Bundle\StudioApiBundle\Service\SecurityService
+        class: Pimcore\Bundle\StudioApiBundle\Service\SecurityService
+
+
+    #Voters
+    Pimcore\Bundle\StudioApiBundle\Security\Voter\TokenVoter:
+        arguments: ['@request_stack']
+        tags:
+            - { name: security.voter }

src/Security/Voter/TokenVoter.php

@@ -0,0 +1,69 @@
+<?php
+declare(strict_types=1);
+
+/**
+ * Pimcore
+ *
+ * This source file is available under two different licenses:
+ * - GNU General Public License version 3 (GPLv3)
+ * - Pimcore Commercial License (PCL)
+ * Full copyright and license information is available in
+ * LICENSE.md which is distributed with this source code.
+ *
+ *  @copyright  Copyright (c) Pimcore GmbH (http://www.pimcore.org)
+ *  @license    http://www.pimcore.org/license     GPLv3 and PCL
+ */
+
+namespace Pimcore\Bundle\StudioApiBundle\Security\Voter;
+
+use Pimcore\Bundle\StudioApiBundle\Service\SecurityServiceInterface;
+use Symfony\Component\HttpFoundation\RequestStack;
+use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
+use Symfony\Component\Security\Core\Authorization\Voter\Voter;
+
+final class TokenVoter extends Voter
+{
+    private const BEARER_PREFIX = 'Bearer ';
+
+    private const AUTHORIZATION_HEADER = 'Authorization';
+
+    private const SUPPORTED_ATTRIBUTE = 'API_PLATFORM';
+
+    public function __construct(
+        private readonly RequestStack $requestStack,
+        private readonly SecurityServiceInterface $securityService
+
+    )
+    {
+    }
+
+    /**
+     * @inheritDoc
+     */
+    protected function supports(string $attribute, mixed $subject): bool
+    {
+        return $attribute === self::SUPPORTED_ATTRIBUTE;
+    }
+
+    /**
+     * @inheritDoc
+     */
+    protected function voteOnAttribute(string $attribute, mixed $subject, TokenInterface $token): bool
+    {
+        if($attribute !== self::SUPPORTED_ATTRIBUTE){
+            return false;
+        }
+
+        $authToken = $this->requestStack->getCurrentRequest()->headers->get(self::AUTHORIZATION_HEADER);
+        if($authToken === null){
+            return false;
+        }
+
+        return $this->securityService->isAllowed($this->removeBearerPrefix($authToken));
+    }
+
+    private function removeBearerPrefix(string $token): string
+    {
+        return str_replace( self::BEARER_PREFIX, '', $token);
+    }
+}