Skip to content

Commit b17aa51

Browse files
AngelFQCAngelFQC
committed
Implement login token authentication to use access URL chooser - refs BT#22639
1 parent 2440f95 commit b17aa51

File tree

7 files changed

+209
-38
lines changed

7 files changed

+209
-38
lines changed

‎assets/vue/components/accessurl/AccessUrlChooser.vue‎

Lines changed: 5 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -1,40 +1,16 @@
11
<script setup>
2-
import { ref } from "vue"
32
import { useI18n } from "vue-i18n"
43
import Dialog from "primevue/dialog"
5-
import { findUserActivePortals } from "../../services/accessurlService"
6-
import { useSecurityStore } from "../../store/securityStore"
7-
import { useNotification } from "../../composables/notification"
8-
import BaseAppLink from "../basecomponents/BaseAppLink.vue"
4+
import { useAccessUrlChooser } from "../../composables/accessurl/accessUrlChooser"
95
10-
const securityStore = useSecurityStore()
116
const { t } = useI18n()
12-
const { showErrorNotification } = useNotification()
137
14-
const isLoading = ref(true)
15-
const accessUrls = ref([])
16-
17-
if (securityStore.showAccessUrlChooser) {
18-
findUserActivePortals(securityStore.user["@id"])
19-
.then((items) => {
20-
accessUrls.value = items
21-
22-
if (1 === items.length) {
23-
window.location.href = items[0].url
24-
}
25-
})
26-
.catch((error) => showErrorNotification(error))
27-
.finally(() => {
28-
if (1 !== accessUrls.value.length) {
29-
isLoading.value = false
30-
}
31-
})
32-
}
8+
const { visible, isLoading, accessUrls, doRedirectToPortal } = useAccessUrlChooser()
339
</script>
3410

3511
<template>
3612
<Dialog
37-
v-model:visible="securityStore.showAccessUrlChooser"
13+
v-model:visible="visible"
3814
:modal="true"
3915
:closable="false"
4016
:header="t('Access URL')"
@@ -52,8 +28,9 @@ if (securityStore.showAccessUrlChooser) {
5228
v-for="accessUrl in accessUrls"
5329
:key="accessUrl.id"
5430
class="text-center"
31+
@click="doRedirectToPortal(accessUrl.url)"
5532
>
56-
<BaseAppLink :url="accessUrl.url">{{ accessUrl.url }}</BaseAppLink>
33+
{{ accessUrl.url }}
5734
<p
5835
v-if="accessUrl.description"
5936
v-text="accessUrl.description"

‎assets/vue/composables/accessurl/accessUrlChooser.js‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
import { findUserActivePortals } from "../../services/accessurlService"
2+
import { useSecurityStore } from "../../store/securityStore"
3+
import { computed, ref } from "vue"
4+
import { useNotification } from "../notification"
5+
import securityService from "../../services/securityService"
6+
7+
export function useAccessUrlChooser() {
8+
const securityStore = useSecurityStore()
9+
10+
const { showErrorNotification } = useNotification()
11+
12+
const visible = computed(() => securityStore.showAccessUrlChooser)
13+
const isLoading = ref(true)
14+
const accessUrls = ref([])
15+
16+
async function init() {
17+
if (!securityStore.showAccessUrlChooser) {
18+
return
19+
}
20+
21+
try {
22+
const items = await findUserActivePortals(securityStore.user["@id"])
23+
24+
accessUrls.value = items
25+
26+
if (1 === items.length) {
27+
await doRedirectToPortal(items[0].url)
28+
}
29+
} catch (error) {
30+
showErrorNotification(error)
31+
} finally {
32+
if (1 !== accessUrls.value.length) {
33+
isLoading.value = false
34+
}
35+
}
36+
}
37+
38+
async function doRedirectToPortal(url) {
39+
try {
40+
await securityService.loginTokenCheck(url, await securityService.loginTokenRequest())
41+
42+
window.location.href = url
43+
} catch (error) {
44+
showErrorNotification(error)
45+
}
46+
}
47+
48+
init().then(() => {})
49+
50+
return {
51+
visible,
52+
isLoading,
53+
accessUrls,
54+
doRedirectToPortal,
55+
}
56+
}

‎assets/vue/services/baseService.js‎

Lines changed: 9 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -43,18 +43,17 @@ export default {
4343
* @param {string} endpoint
4444
* @param {Object} [params={}]
4545
* @param {boolean} [addContentType=false]
46+
* @param {Object} [additionalHeaders={}]
4647
* @returns {Promise<Object>}
4748
*/
48-
async post(endpoint, params = {}, addContentType = false) {
49-
const config = addContentType
50-
? {
51-
headers: {
52-
"Content-Type": "application/json",
53-
},
54-
}
55-
: {}
56-
57-
const { data } = await api.post(endpoint, params, config)
49+
async post(endpoint, params = {}, addContentType = false, additionalHeaders = {}) {
50+
const headers = {}
51+
52+
if (addContentType) {
53+
headers["Content-Type"] = "application/json"
54+
}
55+
56+
const { data } = await api.post(endpoint, params, { headers: { ...headers, ...additionalHeaders } })
5857

5958
return data
6059
},

‎assets/vue/services/securityService.js‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,29 @@ async function checkSession() {
2828
return await baseService.get("/check-session")
2929
}
3030

31+
/**
32+
* @returns {Promise<string>}
33+
*/
34+
async function loginTokenRequest() {
35+
const { token } = await baseService.get(`/login/token/request`)
36+
37+
return token
38+
}
39+
40+
/**
41+
* @param {string} portalUrl
42+
* @param {string} token
43+
* @returns {Promise<void>}
44+
*/
45+
async function loginTokenCheck(portalUrl, token) {
46+
portalUrl = portalUrl.endsWith("/") ? portalUrl.slice(0, -1) : portalUrl
47+
48+
await baseService.post(`${portalUrl}/login/token/check`, {}, false, { Authorization: `Bearer ${token}` })
49+
}
50+
3151
export default {
3252
login,
3353
checkSession,
54+
loginTokenRequest,
55+
loginTokenCheck,
3456
}

‎config/packages/security.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -115,6 +115,7 @@ security:
115115
# password_path: security.credentials.password
116116

117117
custom_authenticators:
118+
- Chamilo\CoreBundle\Security\Authenticator\LoginTokenAuthenticator
118119
- Chamilo\CoreBundle\Security\Authenticator\OAuth2\GenericAuthenticator
119120
- Chamilo\CoreBundle\Security\Authenticator\OAuth2\FacebookAuthenticator
120121
- Chamilo\CoreBundle\Security\Authenticator\OAuth2\KeycloakAuthenticator

‎src/CoreBundle/Controller/SecurityController.php‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,11 +18,13 @@
1818
use Chamilo\CoreBundle\Repository\Node\AccessUrlRepository;
1919
use Chamilo\CoreBundle\Repository\Node\CourseRepository;
2020
use Chamilo\CoreBundle\Repository\TrackELoginRecordRepository;
21+
use Chamilo\CoreBundle\Security\Authenticator\LoginTokenAuthenticator;
2122
use Chamilo\CoreBundle\Settings\SettingsManager;
2223
use DateTime;
2324
use DateTimeImmutable;
2425
use Doctrine\ORM\EntityManagerInterface;
2526
use Exception;
27+
use Lexik\Bundle\JWTAuthenticationBundle\Services\JWTTokenManagerInterface;
2628
use OTPHP\TOTP;
2729
use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
2830
use Symfony\Component\HttpFoundation\JsonResponse;
@@ -32,6 +34,8 @@
3234
use Symfony\Component\Routing\RouterInterface;
3335
use Symfony\Component\Security\Core\Authentication\Token\Storage\TokenStorageInterface;
3436
use Symfony\Component\Security\Core\Authorization\AuthorizationCheckerInterface;
37+
use Symfony\Component\Security\Core\User\UserProviderInterface;
38+
use Symfony\Component\Security\Http\Authentication\UserAuthenticatorInterface;
3539
use Symfony\Component\Serializer\SerializerInterface;
3640
use Symfony\Contracts\Translation\TranslatorInterface;
3741

@@ -187,6 +191,26 @@ public function checkSession(): JsonResponse
187191
throw $this->createAccessDeniedException();
188192
}
189193

194+
#[Route('/login/token/request', name: 'login_token_request', methods: ['GET'])]
195+
public function loginTokenRequest(JWTTokenManagerInterface $jwtManager): JsonResponse
196+
{
197+
$user = $this->userHelper->getCurrent();
198+
199+
if (!$user) {
200+
throw $this->createAccessDeniedException();
201+
}
202+
203+
return new JsonResponse([
204+
'token' => $jwtManager->create($user),
205+
]);
206+
}
207+
208+
#[Route('/login/token/check', name: 'login_token_check', methods: ['POST'])]
209+
public function loginTokenCheck(): void
210+
{
211+
// This route is handled by the LoginTokenAuthenticator, which processes the JWT token
212+
}
213+
190214
/**
191215
* Validates the provided TOTP code for the given user.
192216
*

‎src/CoreBundle/Security/Authenticator/LoginTokenAuthenticator.php‎

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
<?php
2+
3+
/* For licensing terms, see /license.txt */
4+
5+
declare(strict_types=1);
6+
7+
namespace Chamilo\CoreBundle\Security\Authenticator;
8+
9+
use Lexik\Bundle\JWTAuthenticationBundle\Services\JWTTokenManagerInterface;
10+
use Symfony\Component\HttpFoundation\RedirectResponse;
11+
use Symfony\Component\HttpFoundation\Request;
12+
use Symfony\Component\HttpFoundation\Response;
13+
use Symfony\Component\Routing\RouterInterface;
14+
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
15+
use Symfony\Component\Security\Core\Exception\AuthenticationException;
16+
use Symfony\Component\Security\Core\User\UserProviderInterface;
17+
use Symfony\Component\Security\Http\Authenticator\AbstractAuthenticator;
18+
use Symfony\Component\Security\Http\Authenticator\Passport\Badge\UserBadge;
19+
use Symfony\Component\Security\Http\Authenticator\Passport\Passport;
20+
use Symfony\Component\Security\Http\Authenticator\Passport\SelfValidatingPassport;
21+
22+
class LoginTokenAuthenticator extends AbstractAuthenticator
23+
{
24+
public function __construct(
25+
protected readonly UserProviderInterface $userProvider,
26+
protected readonly RouterInterface $router,
27+
protected readonly JWTTokenManagerInterface $jwtManager
28+
) {}
29+
30+
/**
31+
* @inheritDoc
32+
*/
33+
public function supports(Request $request): ?bool
34+
{
35+
return $request->attributes->get('_route') === 'login_token_check'
36+
&& $request->headers->has('Authorization')
37+
;
38+
}
39+
40+
/**
41+
* @inheritDoc
42+
*/
43+
public function authenticate(Request $request): Passport
44+
{
45+
$authHeader = $request->headers->get('Authorization');
46+
47+
if (!$authHeader || !str_starts_with($authHeader, 'Bearer ')) {
48+
throw new AuthenticationException('Missing token.');
49+
}
50+
51+
$jwt = substr($authHeader, 7);
52+
53+
try {
54+
$payload = $this->jwtManager->parse($jwt);
55+
$username = $payload['username'] ?? $payload['sub'] ?? null;
56+
57+
if (!$username) {
58+
throw new AuthenticationException('Token does not contain a username.');
59+
}
60+
61+
} catch (\Exception $e) {
62+
throw new AuthenticationException('Invalid JWT token: '.$e->getMessage());
63+
}
64+
65+
return new SelfValidatingPassport(
66+
new UserBadge(
67+
$username,
68+
fn(string $username) => $this->userProvider->loadUserByIdentifier($username)
69+
)
70+
);
71+
}
72+
73+
/**
74+
* @inheritDoc
75+
*/
76+
public function onAuthenticationSuccess(Request $request, TokenInterface $token, string $firewallName): ?Response
77+
{
78+
$targetUrl = $this->router->generate('index');
79+
80+
return new RedirectResponse($targetUrl);
81+
}
82+
83+
/**
84+
* @inheritDoc
85+
*/
86+
public function onAuthenticationFailure(Request $request, AuthenticationException $exception): ?Response
87+
{
88+
$message = strtr($exception->getMessage(), $exception->getMessageData());
89+
90+
return new Response($message, Response::HTTP_FORBIDDEN);
91+
}
92+
}

0 commit comments

Comments
 (0)