40 lines
1.1 KiB
PHP
40 lines
1.1 KiB
PHP
<?php
|
|
|
|
namespace Modules\IntegrationHub\Http\Middleware;
|
|
|
|
use Closure;
|
|
use Illuminate\Http\Request;
|
|
use Modules\IntegrationHub\Models\IhOdataToken;
|
|
|
|
class ODataTokenAuth
|
|
{
|
|
public function handle(Request $request, Closure $next)
|
|
{
|
|
$token = $request->bearerToken()
|
|
?? $request->header('X-IntegrationHub-Token')
|
|
?? $request->query('access_token');
|
|
|
|
if (empty($token)) {
|
|
return response()->json(['error' => 'Missing API token'], 401);
|
|
}
|
|
|
|
$record = IhOdataToken::where('token_hash', IhOdataToken::hashToken($token))
|
|
->valid()
|
|
->first();
|
|
|
|
if (! $record) {
|
|
return response()->json(['error' => 'Invalid or expired token'], 401);
|
|
}
|
|
|
|
$dataset = $request->route('dataset');
|
|
if ($dataset && ! $record->hasScope($dataset)) {
|
|
return response()->json(['error' => 'Token does not have access to this dataset'], 403);
|
|
}
|
|
|
|
$request->attributes->set('ih_odata_token', $record);
|
|
$request->attributes->set('ih_business_id', $record->business_id);
|
|
|
|
return $next($request);
|
|
}
|
|
}
|