vendor/gesdinet/jwt-refresh-token-bundle/EventListener/AttachRefreshTokenOnSuccessListener.php line 95

Open in your IDE?
  1. <?php
  3. /*
  4.  * This file is part of the GesdinetJWTRefreshTokenBundle package.
  5.  *
  6.  * (c) Gesdinet <http://www.gesdinet.com/>
  7.  *
  8.  * For the full copyright and license information, please view the LICENSE
  9.  * file that was distributed with this source code.
  10.  */
  12. namespace Gesdinet\JWTRefreshTokenBundle\EventListener;
  14. use Gesdinet\JWTRefreshTokenBundle\Generator\RefreshTokenGeneratorInterface;
  15. use Gesdinet\JWTRefreshTokenBundle\Model\RefreshTokenInterface;
  16. use Gesdinet\JWTRefreshTokenBundle\Model\RefreshTokenManagerInterface;
  17. use Gesdinet\JWTRefreshTokenBundle\Request\Extractor\ExtractorInterface;
  18. use Lexik\Bundle\JWTAuthenticationBundle\Event\AuthenticationSuccessEvent;
  19. use Symfony\Component\HttpFoundation\Cookie;
  20. use Symfony\Component\Security\Core\User\UserInterface;
  21. use Symfony\Component\HttpFoundation\RequestStack;
  23. class AttachRefreshTokenOnSuccessListener
  24. {
  25.     /**
  26.      * @var RefreshTokenManagerInterface
  27.      */
  28.     protected $refreshTokenManager;
  30.     /**
  31.      * @var int
  32.      */
  33.     protected $ttl;
  35.     /**
  36.      * @var RequestStack
  37.      */
  38.     protected $requestStack;
  40.     /**
  41.      * @var string
  42.      */
  43.     protected $tokenParameterName;
  45.     /**
  46.      * @var bool
  47.      */
  48.     protected $singleUse;
  50.     /**
  51.      * @var RefreshTokenGeneratorInterface
  52.      */
  53.     protected $refreshTokenGenerator;
  55.     /**
  56.      * @var ExtractorInterface
  57.      */
  58.     protected $extractor;
  60.     protected array $cookieSettings;
  62.     /**
  63.      * @param int    $ttl
  64.      * @param string $tokenParameterName
  65.      * @param bool   $singleUse
  66.      */
  67.     public function __construct(
  68.         RefreshTokenManagerInterface $refreshTokenManager,
  69.         $ttl,
  70.         RequestStack $requestStack,
  71.         $tokenParameterName,
  72.         $singleUse,
  73.         RefreshTokenGeneratorInterface $refreshTokenGenerator,
  74.         ExtractorInterface $extractor,
  75.         array $cookieSettings
  76.     ) {
  77.         $this->refreshTokenManager = $refreshTokenManager;
  78.         $this->ttl = $ttl;
  79.         $this->requestStack = $requestStack;
  80.         $this->tokenParameterName = $tokenParameterName;
  81.         $this->singleUse = $singleUse;
  82.         $this->refreshTokenGenerator = $refreshTokenGenerator;
  83.         $this->extractor = $extractor;
  84.         $this->cookieSettings = array_merge([
  85.             'enabled' => false,
  86.             'same_site' => 'lax',
  87.             'path' => '/',
  88.             'domain' => null,
  89.             'http_only' => true,
  90.             'secure' => true,
  91.             'remove_token_from_body' => true,
  92.         ], $cookieSettings);
  93.     }
  95.     public function attachRefreshToken(AuthenticationSuccessEvent $event): void
  96.     {
  97.         $user = $event->getUser();
  99.         if (!$user instanceof UserInterface) {
  100.             return;
  101.         }
  103.         $data = $event->getData();
  104.         $request = $this->requestStack->getCurrentRequest();
  106.         if (null === $request) {
  107.             return;
  108.         }
  110.         // Extract refreshToken from the request
  111.         $refreshTokenString = $this->extractor->getRefreshToken($request, $this->tokenParameterName);
  113.         // Remove the current refreshToken if it is single-use
  114.         if ($refreshTokenString && true === $this->singleUse) {
  115.             $refreshToken = $this->refreshTokenManager->get($refreshTokenString);
  116.             $refreshTokenString = null;
  118.             if ($refreshToken instanceof RefreshTokenInterface) {
  119.                 $this->refreshTokenManager->delete($refreshToken);
  120.             }
  121.         }
  123.         // Set or create the refreshTokenString
  124.         if ($refreshTokenString) {
  125.             $data[$this->tokenParameterName] = $refreshTokenString;
  126.         } else {
  127.             $refreshToken = $this->refreshTokenGenerator->createForUserWithTtl($user, $this->ttl);
  129.             $this->refreshTokenManager->save($refreshToken);
  130.             $refreshTokenString = $refreshToken->getRefreshToken();
  131.             $data[$this->tokenParameterName] = $refreshTokenString;
  132.         }
  134.         // Add a response cookie if enabled
  135.         if ($this->cookieSettings['enabled']) {
  136.             $event->getResponse()->headers->setCookie(
  137.                 new Cookie(
  138.                     $this->tokenParameterName,
  139.                     $refreshTokenString,
  140.                     time() + $this->ttl,
  141.                     $this->cookieSettings['path'],
  142.                     $this->cookieSettings['domain'],
  143.                     $this->cookieSettings['secure'],
  144.                     $this->cookieSettings['http_only'],
  145.                     false,
  146.                     $this->cookieSettings['same_site']
  147.                 )
  148.             );
  150.             // Remove the refreshTokenString from the response body
  151.             if (isset($this->cookieSettings['remove_token_from_body']) && $this->cookieSettings['remove_token_from_body']) {
  152.                 unset($data[$this->tokenParameterName]);
  153.             }
  154.         }
  156.         // Set response data
  157.         $event->setData($data);
  158.     }
  159. }