70 lines
2.5 KiB
PHP
70 lines
2.5 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace App\Middleware;
|
|
|
|
use App\Core\{Request, Response};
|
|
use App\Services\Security\JwtService;
|
|
use Exception;
|
|
|
|
final class AuthMiddleware
|
|
{
|
|
public function __construct(private readonly JwtService $jwtService) {}
|
|
|
|
public function handle(Request $request, callable $next): mixed
|
|
{
|
|
$authHeader = $request->getHeader('Authorization');
|
|
$token = null;
|
|
|
|
if ($authHeader && str_starts_with($authHeader, 'Bearer ')) {
|
|
$token = substr($authHeader, 7);
|
|
} elseif (isset($_COOKIE['access_token'])) {
|
|
$token = $_COOKIE['access_token'];
|
|
|
|
// CSRF Check for browser sessions using cookies
|
|
if (in_array($request->getMethod(), ['POST', 'PUT', 'DELETE', 'PATCH'])) {
|
|
$csrfHeader = $request->getHeader('X-CSRF-TOKEN');
|
|
$csrfCookie = $_COOKIE['csrf_token'] ?? null;
|
|
|
|
if (!$csrfHeader || !$csrfCookie || !hash_equals($csrfCookie, $csrfHeader)) {
|
|
Response::error('انتهت صلاحية الجلسة أو فشل التحقق الأمني (CSRF)', 'CSRF_FAILED', 403);
|
|
return null;
|
|
}
|
|
}
|
|
}
|
|
|
|
if (!$token) {
|
|
Response::error('يجب تسجيل الدخول للوصول إلى هذا المورد', 'UNAUTHORIZED', 401);
|
|
return null;
|
|
}
|
|
|
|
try {
|
|
$decoded = $this->jwtService->verifyToken($token);
|
|
|
|
// Check if JTI is blacklisted
|
|
$jti = $decoded['jti'] ?? null;
|
|
if ($jti) {
|
|
try {
|
|
$redis = \App\Core\Redis::getInstance();
|
|
if ($redis->exists('jwt_blacklist:' . $jti)) {
|
|
Response::error('الجلسة منتهية، يرجى تسجيل الدخول من جديد', 'TOKEN_REVOKED', 401);
|
|
return null;
|
|
}
|
|
} catch (\Throwable $e) {
|
|
// Redis down — allow (fail open, log security event)
|
|
error_log('[AUTH] JWT blacklist check failed: ' . $e->getMessage());
|
|
}
|
|
}
|
|
|
|
$request->user = (object) $decoded;
|
|
$request->tenantId = $decoded['tenant_id'] ?? null;
|
|
} catch (Exception $e) {
|
|
Response::error('جلسة العمل منتهية أو غير صالحة', 'UNAUTHORIZED', 401);
|
|
return null;
|
|
}
|
|
|
|
return $next($request);
|
|
}
|
|
}
|