You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Commit ceb8c77
Browse filesBrowse the repository at this point in the historyBrowse files
Reflows hard-wrapped prose so each sentence occupies its own line.
Line breaks only, no wording changes.
Signed-off-by: arhimede <julian@dotkernel.com>
Copy file name to clipboardExpand all lines: docs/book/v4/core-features/authentication.md
+16-24Lines changed: 16 additions & 24 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,50 +1,43 @@
1
1
# Authentication
2
2
3
-
Authentication is the process by which an identity is presented to the application. It ensures that the entity
4
-
making the request has the proper credentials to access the API.
3
+
Authentication is the process by which an identity is presented to the application.
4
+
It ensures that the entity making the request has the proper credentials to access the API.
5
5
6
6
**Dotkernel API** identities are delivered to the application from the client through the `Authorization` request.
7
-
If it is present, the application tries to find and assign the identity to the application. If it is not presented,
8
-
Dotkernel API assigns a default `guest` identity, represented by an instance of the class
9
-
`Mezzio\Authentication\UserInterface`.
7
+
If it is present, the application tries to find and assign the identity to the application.
8
+
If it is not presented, Dotkernel API assigns a default `guest` identity, represented by an instance of the class `Mezzio\Authentication\UserInterface`.
10
9
11
10
## Configuration
12
11
13
-
Authentication in Dotkernel API is built around the `mezzio/mezzio-authentication-oauth2` component and is already
14
-
configured out of the box. But if you want to dig more, the configuration is stored in
15
-
`config/autoload/local.php` under the `authentication` key.
12
+
Authentication in Dotkernel API is built around the `mezzio/mezzio-authentication-oauth2` component and is already configured out of the box.
13
+
But if you want to dig more, the configuration is stored in `config/autoload/local.php` under the `authentication` key.
> You can check the [mezzio/mezzio-authentication-oauth2](https://docs.mezzio.dev/mezzio-authentication-oauth2/v1/intro/#configuration) configuration part for more info.
20
16
21
17
## How it works
22
18
23
-
Dotkernels API authentication system can be used for SPAs (single-page applications), mobile applications, and
24
-
simple, token-based APIs. It allows each user of your application to generate API tokens for their accounts.
19
+
Dotkernels API authentication system can be used for SPAs (single-page applications), mobile applications, and simple, token-based APIs.
20
+
It allows each user of your application to generate API tokens for their accounts.
25
21
26
22
The authentication happens through the middleware in the `Api\App\Middleware\AuthenticationMiddleware`.
27
23
28
24
## Database
29
25
30
-
When you install **Dotkernel API** for the first time, you need to run the migrations and seeders. All the tables
31
-
required for authentication are automatically created and populated.
26
+
When you install **Dotkernel API** for the first time, you need to run the migrations and seeders.
27
+
All the tables required for authentication are automatically created and populated.
32
28
33
-
In Dotkernel API, authenticated users come from either the `admin` or the `user` table. We choose to keep the admin
34
-
table separated from the users to prevent users of the application from accessing sensitive data, which only the
35
-
administrators of the application should access.
29
+
In Dotkernel API, authenticated users come from either the `admin` or the `user` table.
30
+
We choose to keep the admin table separated from the users to prevent users of the application from accessing sensitive data, which only the administrators of the application should access.
36
31
37
-
The `oauth_clients` table is pre-populated with the default `admin` and `frontend` clients with the same password as
38
-
their names (**we recommend you change the default passwords**).
32
+
The `oauth_clients` table is pre-populated with the default `admin` and `frontend` clients with the same password as their names (**we recommend you change the default passwords**).
39
33
40
34
As you guessed each client serves to authenticate `admin` or `user`.
41
35
42
36
Another table that is pre-populated is the `oauth_scopes` table, with the `api` scope.
43
37
44
38
### Issuing API Tokens
45
39
46
-
Token generation in Dotkernel API is done using the `password``grant_type` scenario, which in this case allows
47
-
authentication to an API using the user's credentials (generally a username and password).
40
+
Token generation in Dotkernel API is done using the `password``grant_type` scenario, which in this case allows authentication to an API using the user's credentials (generally a username and password).
48
41
49
42
The client sends a POST request to the `/security/generate-token` with the following parameters:
50
43
@@ -80,8 +73,7 @@ The server responds with a JSON as follows:
80
73
}
81
74
```
82
75
83
-
Next time when you make a request to the server to an authenticated endpoint, the client should use
84
-
the `Authorization` header request.
76
+
Next time when you make a request to the server to an authenticated endpoint, the client should use the `Authorization` header request.
Copy file name to clipboardExpand all lines: docs/book/v4/core-features/authorization.md
+10-16Lines changed: 10 additions & 16 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,16 +1,13 @@
1
1
# Authorization
2
2
3
-
Authorization is the process by which a system takes a validated identity and checks if that identity has access to a
4
-
given resource.
3
+
Authorization is the process by which a system takes a validated identity and checks if that identity has access to a given resource.
5
4
6
-
**Dotkernel API**'s implementation of authorization uses `Mezzio\Authorization\Rbac\LaminasRbac` as a model of
7
-
Role-Based Access Control (RBAC).
5
+
**Dotkernel API**'s implementation of authorization uses `Mezzio\Authorization\Rbac\LaminasRbac` as a model of Role-Based Access Control (RBAC).
8
6
9
7
## How it works
10
8
11
-
In Dotkernel API each authenticatable entity (admin/user) comes with their roles table where you can define
12
-
roles for each entity. RBAC comes in to ensure that each entity has the appropriate role and permission to access a
13
-
resource.
9
+
In Dotkernel API each authenticatable entity (admin/user) comes with their roles table where you can define roles for each entity.
10
+
RBAC comes in to ensure that each entity has the appropriate role and permission to access a resource.
14
11
15
12
The authorization happens through the `Api\App\Middleware\AuthorizationMiddleware` middleware.
16
13
@@ -53,13 +50,11 @@ The configuration file for the role and permission definitions is `config/autolo
53
50
],
54
51
```
55
52
56
-
> See [mezzio-authorization-rbac](https://docs.mezzio.dev/mezzio-authorization-rbac/v1/basic-usage/)
57
-
> for more information.
53
+
> See [mezzio-authorization-rbac](https://docs.mezzio.dev/mezzio-authorization-rbac/v1/basic-usage/) for more information.
58
54
59
55
## Usage
60
56
61
-
Based on the configuration file above, we have 2 admins roles (`superuser`, `admin`) and 2 users
62
-
roles (`user`, `guest`).
57
+
Based on the configuration file above, we have 2 admins roles (`superuser`, `admin`) and 2 users roles (`user`, `guest`).
63
58
64
59
Roles inherit the permissions from their parents:
65
60
@@ -68,10 +63,9 @@ Roles inherit the permissions from their parents:
68
63
-`user` has no parent
69
64
-`guest` has `user` as a parent which means `user` also has `guest` permissions
70
65
71
-
For each role we defined an array of permissions. A permission in Dotkernel API is basically a route name.
66
+
For each role we defined an array of permissions.
67
+
A permission in Dotkernel API is basically a route name.
72
68
73
-
As you can see, the `superuser` does not have its own permissions, because it gains all the permissions
74
-
from `admin`, no need to define explicit permissions.
69
+
As you can see, the `superuser` does not have its own permissions, because it gains all the permissions from `admin`, no need to define explicit permissions.
75
70
76
-
The `user` role, gains all the permission from `guest` so no need to define that `user` can access `home` route, but
77
-
`guest` cannot access user-specific routes.
71
+
The `user` role, gains all the permission from `guest` so no need to define that `user` can access `home` route, but `guest` cannot access user-specific routes.
Copy file name to clipboardExpand all lines: docs/book/v4/core-features/content-validation.md
+20-38Lines changed: 20 additions & 38 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,21 +6,15 @@
6
6
application can deliver.
7
7
- To determine the `Content-Type` of incoming data and deserialize it so the application can utilize it.
8
8
9
-
Essentially, content negotiation is the *client* telling the server what it is sending and what it wants in return, and
10
-
the server determining if it can do what the client requests.
9
+
Essentially, content negotiation is the *client* telling the server what it is sending and what it wants in return, and the server determining if it can do what the client requests.
11
10
12
-
Content negotiation validation in **Dotkernel API** happens through middleware, and it ensures that the incoming
13
-
request and the outgoing response conform to the content types specified in the config file for all routes or for a
14
-
specific route.
11
+
Content negotiation validation in **Dotkernel API** happens through middleware, and it ensures that the incoming request and the outgoing response conform to the content types specified in the config file for all routes or for a specific route.
15
12
16
-
It performs validation on the `Accept` and `Content-Type` headers of the request and response and returning appropriate
17
-
errors responses when necessary.
13
+
It performs validation on the `Accept` and `Content-Type` headers of the request and response and returning appropriate errors responses when necessary.
18
14
19
15
## Configuration
20
16
21
-
In Dotkernel API the configuration file for content negotiation is held
22
-
in `config/autoload/content-negotiation.global.php`
23
-
and the array looks like this:
17
+
In Dotkernel API the configuration file for content negotiation is held in `config/autoload/content-negotiation.global.php` and the array looks like this:
24
18
25
19
```php
26
20
return [
@@ -43,39 +37,32 @@ return [
43
37
];
44
38
```
45
39
46
-
Except the `default` key, all your keys must match the route name, for example in Dotkernel API we have the route to
47
-
list all admins, which name is `admin.list`.
40
+
Except the `default` key, all your keys must match the route name, for example in Dotkernel API we have the route to list all admins, which name is `admin.list`.
48
41
49
-
If you did not specify a route name to configure your specifications about content negotiation, the `default` one will
50
-
be in place. The `default` key is `mandatory`.
42
+
If you did not specify a route name to configure your specifications about content negotiation, the `default` one will be in place.
43
+
The `default` key is `mandatory`.
51
44
52
-
Every route configuration must come with `Accept` and `Content-Type` keys, basically this will be the keys that the
53
-
request headers will be validated against.
45
+
Every route configuration must come with `Accept` and `Content-Type` keys, basically this will be the keys that the request headers will be validated against.
54
46
55
47
## Accept Negotiation
56
48
57
-
This specifies that your server can return that representation, or at least one of the representation sent by the
58
-
client.
49
+
This specifies that your server can return that representation, or at least one of the representation sent by the client.
59
50
60
51
```shell
61
52
GET /admin HTTP/1.1
62
53
Accept: application/json
63
54
```
64
55
65
-
This request indicates the client wants `application/json` in return. Now the server, through the config file will try
66
-
to validate if that representation can be returned, basically if `application/json` is presented in the `Accept` key.
56
+
This request indicates the client wants `application/json` in return.
57
+
Now the server, through the config file will try to validate if that representation can be returned, basically if `application/json` is presented in the `Accept` key.
67
58
68
59
If the representation cannot be returned, a status code `406 - Not Acceptable` will be returned.
69
60
70
-
If the representation can be returned, the server should report the media type through `Content-Type` header of the
71
-
response.
61
+
If the representation can be returned, the server should report the media type through `Content-Type` header of the response.
72
62
73
-
> Due to how these validations are made, for a `json` media type, the server can return a more generic media type,
74
-
> for example, if the clients send `Accept: application/vnd.api+json` and you configured your `Accept` key
75
-
> as `application/json` the representation will still be returned as `json`.
63
+
> Due to how these validations are made, for a `json` media type, the server can return a more generic media type, for example, if the clients send `Accept: application/vnd.api+json` and you configured your `Accept` key as `application/json` the representation will still be returned as `json`.
76
64
77
-
> If the `Accept` header of the request contains `*/*` it means that whatever the server can return it is OK, so it can
78
-
> return anything.
65
+
> If the `Accept` header of the request contains `*/*` it means that whatever the server can return it is OK, so it can return anything.
The server will try to validate the `Content-Type` header against your configured `Content-Type` key from the config
94
-
file, and if the format is not supported, a status code `415 - Unsupported Media Type` will be returned.
80
+
The server will try to validate the `Content-Type` header against your configured `Content-Type` key from the config file, and if the format is not supported, a status code `415 - Unsupported Media Type` will be returned.
95
81
96
-
For example, if you have a route that needs a file to be uploaded , normally you will configure the `Content-Type` of
97
-
that route to be `multipart/form-data`. The above request will fail as the client send `application/json` as
98
-
`Content-Type`.
82
+
For example, if you have a route that needs a file to be uploaded , normally you will configure the `Content-Type` of that route to be `multipart/form-data`.
83
+
The above request will fail as the client send `application/json` as `Content-Type`.
99
84
100
-
> If the request does not contain "Content-Type" header, that means that the server will try to deserialize the data as
101
-
> it can.
85
+
> If the request does not contain "Content-Type" header, that means that the server will try to deserialize the data as it can.
102
86
103
87
## The `Request <-> Response` validation
104
88
105
-
In addition to the validation described above, a third one is happening and is the last one: the server will check if
106
-
the request `Accept` header can really be returned by the response.
89
+
In addition to the validation described above, a third one is happening and is the last one: the server will check if the request `Accept` header can really be returned by the response.
107
90
108
91
Through the way **Dotkernel API** is returning a response in handler, a content type is always set.
109
92
110
-
This cannot be the case in any custom response but in any case the server will check what `Content-Type` the response is
111
-
returning and will try to validate that against the `Accept` header of the request.
93
+
This cannot be the case in any custom response but in any case the server will check what `Content-Type` the response is returning and will try to validate that against the `Accept` header of the request.
112
94
If the validation fails, a status code `406 - Not Acceptable` will be returned.
Copy file name to clipboardExpand all lines: docs/book/v4/core-features/cors.md
+3-6Lines changed: 3 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -2,15 +2,13 @@
2
2
3
3
## What is CORS?
4
4
5
-
**Cross-Origin Resource Sharing** or _CORS_ is an HTTP-header based mechanism that allows a server to indicate any other
6
-
origins (domain, scheme, or port) than its own from which a browser should permit loading of resources.
5
+
**Cross-Origin Resource Sharing** or _CORS_ is an HTTP-header based mechanism that allows a server to indicate any other origins (domain, scheme, or port) than its own from which a browser should permit loading of resources.
7
6
8
7
## Why do we need CORS?
9
8
10
9
When integrating an API, most developers have encountered the following error message:
11
10
12
-
> Access to fetch at _RESOURCE_URL_ from origin _ORIGIN_URL_ has been blocked by CORS policy:
13
-
> No ‘Access-Control-Allow-Origin’ header is present on the requested resource.
11
+
> Access to fetch at _RESOURCE_URL_ from origin _ORIGIN_URL_ has been blocked by CORS policy: No ‘Access-Control-Allow-Origin’ header is present on the requested resource.
14
12
15
13
This happens because the API (_RESOURCE_URL_) is not configured to accept requests from the client (_ORIGIN_URL_).
16
14
@@ -86,7 +84,6 @@ This list explains the above configuration values:
86
84
87
85
Save and close the file.
88
86
89
-
> On the **production** environment, make sure you allow only specific origins by adding them to the `allowed_origins`
90
-
> array and removing the current value of `ConfigurationInterface::ANY_ORIGIN`.
87
+
> On the **production** environment, make sure you allow only specific origins by adding them to the `allowed_origins` array and removing the current value of `ConfigurationInterface::ANY_ORIGIN`.
91
88
92
89
For more info, see [mezzio/mezzio-cors documentation](https://docs.mezzio.dev/mezzio-cors/v1/middleware/#configuration).
Copy file name to clipboardExpand all lines: docs/book/v4/core-features/exceptions.md
+6-13Lines changed: 6 additions & 13 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -2,15 +2,12 @@
2
2
3
3
## What are exceptions?
4
4
5
-
Exceptions are a powerful mechanism for handling errors and other exceptional conditions that may occur during the
6
-
execution of a script.
7
-
They provide a way to manage errors in a structured and controlled manner, separating error-handling code from regular
8
-
code.
5
+
Exceptions are a powerful mechanism for handling errors and other exceptional conditions that may occur during the execution of a script.
6
+
They provide a way to manage errors in a structured and controlled manner, separating error-handling code from regular code.
9
7
10
8
## How we use exceptions?
11
9
12
-
When it comes to handling exceptions, **Dotkernel API** relies on the usage of easy-to-understand, problem-specific
13
-
exceptions.
10
+
When it comes to handling exceptions, **Dotkernel API** relies on the usage of easy-to-understand, problem-specific exceptions.
14
11
15
12
Out-of-the-box we provide the following custom exceptions:
16
13
@@ -53,8 +50,7 @@ Out-of-the-box we provide the following custom exceptions:
53
50
54
51
## How it works?
55
52
56
-
During a request, if there is no uncaught exception **Dotkernel API** will return a JSON response with the data provided
57
-
by the handler that handled the request.
53
+
During a request, if there is no uncaught exception **Dotkernel API** will return a JSON response with the data provided by the handler that handled the request.
58
54
59
55
Else, it will build and send a response based on the exception thrown:
60
56
@@ -69,9 +65,7 @@ Else, it will build and send a response based on the exception thrown:
69
65
70
66
## How to extend?
71
67
72
-
In this example we will create a custom exception called `CustomException`, place it next to the already existing custom
73
-
exceptions (you can use your preferred location) and finally return a custom HTTP status code when `CustomException` is
74
-
encountered.
68
+
In this example we will create a custom exception called `CustomException`, place it next to the already existing custom exceptions (you can use your preferred location) and finally return a custom HTTP status code when `CustomException` is encountered.
75
69
76
70
### Step 1: Create exception file
77
71
@@ -106,8 +100,7 @@ Save and close the file.
106
100
107
101
### Step 3: Test for failure
108
102
109
-
Access your API's home page URL and make sure it returns `500 Internal Server Error` HTTP status code and the following
110
-
content:
103
+
Access your API's home page URL and make sure it returns `500 Internal Server Error` HTTP status code and the following content:
This command will prompt you to confirm that you want to run it.
18
18
19
-
> WARNING! You are about to execute a migration in database "..." that could result in schema changes and data loss. Are you sure you wish to continue? (yes/no) [yes]:
19
+
> WARNING!
20
+
> You are about to execute a migration in database "..." that could result in schema changes and data loss.
0 commit comments