57 lines
1.9 KiB
PHP
57 lines
1.9 KiB
PHP
<?php
|
|
|
|
namespace App\Middlewares;
|
|
|
|
use App\Core\Request;
|
|
use App\Core\Response;
|
|
use App\Core\Security;
|
|
|
|
class AuthMiddleware
|
|
{
|
|
/**
|
|
* Verifies the JWT token and populates request properties.
|
|
*/
|
|
public function handle(Request $request, Response $response): void
|
|
{
|
|
$authHeader = $request->getHeader('authorization', '');
|
|
|
|
if (!$authHeader || !preg_match('/Bearer\s(\S+)/i', $authHeader, $matches)) {
|
|
$response->json(['error' => 'Unauthorized', 'message' => 'Token not provided or invalid format'], 401);
|
|
exit;
|
|
}
|
|
|
|
$token = $matches[1];
|
|
$payload = Security::verifyJWT($token);
|
|
|
|
if (!$payload) {
|
|
$response->json(['error' => 'Unauthorized', 'message' => 'Invalid or expired token'], 401);
|
|
exit;
|
|
}
|
|
|
|
// Check if session is active in Redis
|
|
try {
|
|
$redis = \App\Core\RedisClient::getInstance();
|
|
$userId = $payload['user_id'];
|
|
$sessionState = $redis->get("session:{$userId}:{$token}");
|
|
|
|
if (!$sessionState || $sessionState !== 'active') {
|
|
$response->json(['error' => 'Unauthorized', 'message' => 'Session has been revoked or expired'], 401);
|
|
exit;
|
|
}
|
|
} catch (\Exception $e) {
|
|
// If Redis is down, we fallback to just JWT verification
|
|
error_log("AuthMiddleware Redis Error: " . $e->getMessage());
|
|
}
|
|
|
|
// Validate required custom payload elements
|
|
if (!isset($payload['user_id']) || !isset($payload['role'])) {
|
|
$response->json(['error' => 'Unauthorized', 'message' => 'Malformed token payload structure'], 401);
|
|
exit;
|
|
}
|
|
|
|
// Attach user info to the Request instance dynamically so controllers can use it
|
|
$request->user_id = $payload['user_id'];
|
|
$request->role = $payload['role'];
|
|
}
|
|
}
|