refactor: rename lib/ to core/ for clearer core-module separation
Rename the top-level lib/ directory to core/ so the project root immediately communicates which code is core platform and which lives in modules/. PHP namespaces (MintyPHP\*) are unchanged — only the Composer PSR-4 path mapping moves from lib/ to core/. Module-internal lib/ directories (modules/*/lib/) are untouched. Updated across the full stack: - composer.json PSR-4 mapping - bootstrap entry points (web/index.php, bin/*, tests/bootstrap.php) - tooling configs (phpstan.neon, phpunit.xml, php-cs-fixer) - 26 architecture contract tests - enforcement-policy, guard-catalog, quality-gates - all documentation (CLAUDE.md, README, 25 docs/, .agents/skills/) - bin/qa-extended.sh search paths - .claude/settings.local.json permission paths Workflow: .agents/runs/CORE-LIB-RENAME-001/ (Analyst → Planner → Executor → Code Review (4 findings fixed) → Security Review → Acceptance Test → Finalizer) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
286
core/Http/ApiAuth.php
Normal file
286
core/Http/ApiAuth.php
Normal file
@@ -0,0 +1,286 @@
|
||||
<?php
|
||||
|
||||
namespace MintyPHP\Http;
|
||||
|
||||
use MintyPHP\Repository\Access\RolePermissionRepository;
|
||||
use MintyPHP\Repository\Access\UserRoleRepository;
|
||||
use MintyPHP\Service\Access\AuthorizationService;
|
||||
use MintyPHP\Service\Auth\ApiTokenService;
|
||||
use MintyPHP\Service\Tenant\TenantScopeService;
|
||||
use MintyPHP\Service\User\UserTenantContextService;
|
||||
|
||||
// Static facade for API authentication — state is set once per request during ApiBootstrap::init().
|
||||
// Dependencies are injected as lazy resolvers so services are only instantiated when actually needed.
|
||||
class ApiAuth
|
||||
{
|
||||
/** @var (callable(): TenantScopeService)|null */
|
||||
private static $authScopeGatewayResolver = null;
|
||||
|
||||
/** @var (callable(): ApiTokenService)|null */
|
||||
private static $apiTokenServiceResolver = null;
|
||||
|
||||
/** @var (callable(): UserRoleRepository)|null */
|
||||
private static $userRoleRepositoryResolver = null;
|
||||
|
||||
/** @var (callable(): RolePermissionRepository)|null */
|
||||
private static $rolePermissionRepositoryResolver = null;
|
||||
|
||||
/** @var (callable(): UserTenantContextService)|null */
|
||||
private static $userTenantContextServiceResolver = null;
|
||||
/** @var (callable(): AuthorizationService)|null */
|
||||
private static $authorizationServiceResolver = null;
|
||||
|
||||
private static ?array $currentUser = null;
|
||||
private static ?array $currentPermissions = null;
|
||||
private static ?int $currentTenantId = null;
|
||||
private static ?int $tokenTenantId = null;
|
||||
private static ?array $currentTokenRecord = null;
|
||||
private static bool $authenticated = false;
|
||||
|
||||
public static function configure(
|
||||
callable $authScopeGatewayResolver,
|
||||
callable $apiTokenServiceResolver,
|
||||
callable $userRoleRepositoryResolver,
|
||||
callable $rolePermissionRepositoryResolver,
|
||||
callable $userTenantContextServiceResolver,
|
||||
callable $authorizationServiceResolver
|
||||
): void {
|
||||
self::$authScopeGatewayResolver = $authScopeGatewayResolver;
|
||||
self::$apiTokenServiceResolver = $apiTokenServiceResolver;
|
||||
self::$userRoleRepositoryResolver = $userRoleRepositoryResolver;
|
||||
self::$rolePermissionRepositoryResolver = $rolePermissionRepositoryResolver;
|
||||
self::$userTenantContextServiceResolver = $userTenantContextServiceResolver;
|
||||
self::$authorizationServiceResolver = $authorizationServiceResolver;
|
||||
}
|
||||
|
||||
/**
|
||||
* Extract the full Bearer token from the Authorization header.
|
||||
*/
|
||||
public static function extractBearerToken(): string
|
||||
{
|
||||
$header = trim((string) ($_SERVER['HTTP_AUTHORIZATION'] ?? ''));
|
||||
if ($header === '') {
|
||||
// Nginx with PHP-FPM may expose the header under this key instead
|
||||
$header = trim((string) ($_SERVER['REDIRECT_HTTP_AUTHORIZATION'] ?? ''));
|
||||
}
|
||||
if ($header === '' || stripos($header, 'Bearer ') !== 0) {
|
||||
return '';
|
||||
}
|
||||
|
||||
return trim(substr($header, 7));
|
||||
}
|
||||
|
||||
/**
|
||||
* Attempt to authenticate from Authorization: Bearer header.
|
||||
*/
|
||||
public static function authenticate(): bool
|
||||
{
|
||||
self::$currentUser = null;
|
||||
self::$currentPermissions = null;
|
||||
self::$currentTenantId = null;
|
||||
self::$tokenTenantId = null;
|
||||
self::$currentTokenRecord = null;
|
||||
self::$authenticated = false;
|
||||
|
||||
$bearerToken = self::extractBearerToken();
|
||||
if ($bearerToken === '') {
|
||||
return false;
|
||||
}
|
||||
|
||||
$scopeGateway = self::scopeGateway();
|
||||
$result = self::apiTokenService()->validate($bearerToken);
|
||||
if ($result === null) {
|
||||
return false;
|
||||
}
|
||||
|
||||
$user = $result['user'];
|
||||
$userId = (int) ($user['id'] ?? 0);
|
||||
$userRoleRepository = self::userRoleRepository();
|
||||
$rolePermissionRepository = self::rolePermissionRepository();
|
||||
$userTenantContextService = self::userTenantContextService();
|
||||
|
||||
// Load permissions directly (bypass session cache)
|
||||
$roleIds = $userRoleRepository->listRoleIdsByUserId($userId);
|
||||
$permissions = $rolePermissionRepository->listPermissionKeysByRoleIds($roleIds);
|
||||
|
||||
// Resolve tenant context: a token may be scoped to a specific tenant,
|
||||
// otherwise fall back to the user's active tenant context.
|
||||
$tokenTenantId = $result['tenant_id'];
|
||||
if ($tokenTenantId !== null) {
|
||||
// Verify the token's tenant is still assigned to this user
|
||||
$userTenantIds = $scopeGateway->getUserTenantIds($userId);
|
||||
if (!in_array($tokenTenantId, $userTenantIds, true)) {
|
||||
return false;
|
||||
}
|
||||
$currentTenantId = $tokenTenantId;
|
||||
self::$tokenTenantId = $tokenTenantId;
|
||||
} else {
|
||||
$currentTenantId = $userTenantContextService->getCurrentTenantId($userId);
|
||||
self::$tokenTenantId = null;
|
||||
}
|
||||
|
||||
self::$currentUser = $user;
|
||||
self::$currentPermissions = $permissions;
|
||||
self::$currentTenantId = $currentTenantId;
|
||||
self::$currentTokenRecord = $result['token_record'];
|
||||
self::$authenticated = true;
|
||||
|
||||
return true;
|
||||
}
|
||||
|
||||
public static function isAuthenticated(): bool
|
||||
{
|
||||
return self::$authenticated;
|
||||
}
|
||||
|
||||
public static function user(): ?array
|
||||
{
|
||||
return self::$currentUser;
|
||||
}
|
||||
|
||||
public static function userId(): int
|
||||
{
|
||||
return (int) (self::$currentUser['id'] ?? 0);
|
||||
}
|
||||
|
||||
public static function permissions(): array
|
||||
{
|
||||
return self::$currentPermissions ?? [];
|
||||
}
|
||||
|
||||
public static function can(string $ability, array $context = []): bool
|
||||
{
|
||||
$decision = self::authorizationService()->authorize($ability, [
|
||||
'actor_user_id' => self::userId(),
|
||||
'scoped_tenant_id' => self::scopedTenantId(),
|
||||
...$context,
|
||||
]);
|
||||
return $decision->isAllowed();
|
||||
}
|
||||
|
||||
// Effective tenant for data filtering — may come from token scope or user session.
|
||||
public static function tenantId(): ?int
|
||||
{
|
||||
return self::$currentTenantId;
|
||||
}
|
||||
|
||||
// Non-null only when the token itself was issued for a specific tenant.
|
||||
// Used to restrict access in token-scoped requests (e.g. tenant integrations).
|
||||
public static function scopedTenantId(): ?int
|
||||
{
|
||||
return self::$tokenTenantId;
|
||||
}
|
||||
|
||||
public static function tokenRecord(): ?array
|
||||
{
|
||||
return self::$currentTokenRecord;
|
||||
}
|
||||
|
||||
public static function tokenId(): ?int
|
||||
{
|
||||
$id = (int) (self::$currentTokenRecord['id'] ?? 0);
|
||||
return $id > 0 ? $id : null;
|
||||
}
|
||||
|
||||
public static function isTenantScopedToken(): bool
|
||||
{
|
||||
return (self::$tokenTenantId ?? 0) > 0;
|
||||
}
|
||||
|
||||
/**
|
||||
* Require both tenant-scope and token-tenant access for a resource.
|
||||
*/
|
||||
public static function requireResourceAccess(string $resource, int $resourceId): void
|
||||
{
|
||||
$scopeGateway = self::scopeGateway();
|
||||
if (!$scopeGateway->canAccess($resource, $resourceId, self::userId())) {
|
||||
ApiResponse::notFound();
|
||||
}
|
||||
self::requireTokenTenantAccess($resource, $resourceId);
|
||||
}
|
||||
|
||||
public static function requireTokenTenantAccess(string $resource, int $resourceId): void
|
||||
{
|
||||
if (!self::isTenantScopedToken()) {
|
||||
return;
|
||||
}
|
||||
|
||||
$tenantId = (int) (self::$tokenTenantId ?? 0);
|
||||
if ($tenantId <= 0) {
|
||||
ApiResponse::forbidden();
|
||||
}
|
||||
|
||||
$scopeGateway = self::scopeGateway();
|
||||
if (!$scopeGateway->resourceBelongsToTenant($resource, $resourceId, $tenantId)) {
|
||||
// 404 instead of 403 — don't reveal that the resource exists in another tenant
|
||||
ApiResponse::notFound();
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Check if the current user can self-manage API tokens.
|
||||
*/
|
||||
public static function canSelfManageTokens(): bool
|
||||
{
|
||||
$decision = self::authorizationService()->authorize(
|
||||
\MintyPHP\Service\Access\OperationsAuthorizationPolicy::ABILITY_API_TOKENS_SELF_MANAGE,
|
||||
[
|
||||
'actor_user_id' => self::userId(),
|
||||
'scoped_tenant_id' => self::scopedTenantId(),
|
||||
]
|
||||
);
|
||||
return $decision->isAllowed();
|
||||
}
|
||||
|
||||
public static function requireSelfManageTokens(): void
|
||||
{
|
||||
if (!self::canSelfManageTokens()) {
|
||||
ApiResponse::forbidden('api_tokens_self_manage_forbidden');
|
||||
}
|
||||
}
|
||||
|
||||
private static function scopeGateway(): TenantScopeService
|
||||
{
|
||||
return self::resolveDependency(self::$authScopeGatewayResolver, TenantScopeService::class, 'ApiAuth');
|
||||
}
|
||||
|
||||
private static function apiTokenService(): ApiTokenService
|
||||
{
|
||||
return self::resolveDependency(self::$apiTokenServiceResolver, ApiTokenService::class, 'ApiAuth');
|
||||
}
|
||||
|
||||
private static function userRoleRepository(): UserRoleRepository
|
||||
{
|
||||
return self::resolveDependency(self::$userRoleRepositoryResolver, UserRoleRepository::class, 'ApiAuth');
|
||||
}
|
||||
|
||||
private static function rolePermissionRepository(): RolePermissionRepository
|
||||
{
|
||||
return self::resolveDependency(self::$rolePermissionRepositoryResolver, RolePermissionRepository::class, 'ApiAuth');
|
||||
}
|
||||
|
||||
private static function userTenantContextService(): UserTenantContextService
|
||||
{
|
||||
return self::resolveDependency(self::$userTenantContextServiceResolver, UserTenantContextService::class, 'ApiAuth');
|
||||
}
|
||||
|
||||
private static function authorizationService(): AuthorizationService
|
||||
{
|
||||
return self::resolveDependency(self::$authorizationServiceResolver, AuthorizationService::class, 'ApiAuth');
|
||||
}
|
||||
|
||||
private static function resolveDependency(mixed $resolver, string $expectedClass, string $consumer): mixed
|
||||
{
|
||||
if (!is_callable($resolver)) {
|
||||
throw new \RuntimeException($consumer . ' is not configured for dependency: ' . $expectedClass);
|
||||
}
|
||||
|
||||
$service = $resolver();
|
||||
if (!$service instanceof $expectedClass) {
|
||||
throw new \RuntimeException($consumer . ' resolver returned invalid dependency: ' . $expectedClass);
|
||||
}
|
||||
|
||||
return $service;
|
||||
}
|
||||
|
||||
}
|
||||
Reference in New Issue
Block a user