问使用Symfony 5.3检查JWT (Firebase)令牌

EN

security:
    # https://symfony.com/doc/current/security/authenticator_manager.html
    enable_authenticator_manager: true

    # https://symfony.com/doc/current/security.html#c-hashing-passwords
    password_hashers:
        Symfony\Component\Security\Core\User\PasswordAuthenticatedUserInterface: 'auto'

    encoders:
        App\Entity\ATblUsers:
            algorithm: bcrypt

    providers:
        users_in_memory: { memory: null }

    firewalls:
        dev:
            pattern: ^/(_(profiler|wdt)|css|images|js)/
            security: false

        main:
            # Anonymous property is no longer supported by Symfony. It is commented by now, but it will be deleted in
            # future revision:
            # anonymous: true
            guard:
                authenticators:
                    - App\Security\JwtAuthenticator
            lazy: true
            provider: users_in_memory

            # activate different ways to authenticate
            # https://symfony.com/doc/current/security.html#firewalls-authentication

            # https://symfony.com/doc/current/security/impersonating_user.html
            # switch_user: true
            stateless: true

    # Easy way to control access for large sections of your site
    # Note: Only the *first* access control that matches will be used
    access_control:
        - { path: ^/authenticate, roles: PUBLIC_ACCESS }
        - { path: ^/, roles: IS_AUTHENTICATED_FULLY }

<?php
    namespace App\Security;
    
    use App\Entity\User;
    use Doctrine\ORM\EntityManagerInterface;
    use Symfony\Component\DependencyInjection\ParameterBag\ContainerBagInterface;
    use Symfony\Component\HttpFoundation\JsonResponse;
    use Symfony\Component\HttpFoundation\Request;
    use Symfony\Component\HttpFoundation\Response;
    use Symfony\Component\Security\Core\Exception\AuthenticationException;
    use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
    use Firebase\JWT\JWT;
    use Firebase\JWT\Key;
    use Symfony\Component\Security\Http\Authenticator\AbstractAuthenticator;
    use Symfony\Component\Security\Http\Authenticator\Passport\Badge\UserBadge;
    use Symfony\Component\Security\Http\Authenticator\Passport\Passport;
    use Symfony\Component\Security\Http\Authenticator\Passport\SelfValidatingPassport;
    use Symfony\Component\Cache\Simple\FilesystemCache;
    use Kreait\Firebase;
    use Firebase\Auth\Token\Exception\InvalidToken;
    
    
    class JWTAuthenticator extends AbstractAuthenticator
    {
        private $em;
        private $params;
        private $projectDirectory;
        private $firebase;
    
        public function __construct(string $projectDirectory, EntityManagerInterface $em, ContainerBagInterface $params)
        {
            $this->projectDirectory = $projectDirectory;
            $this->em = $em;
            $this->params = $params;
            $this->firebase = (new Firebase\Factory())->withServiceAccount($this->projectDirectory.'/firebase-authentication.json');
        }
    
        public function start(Request $request, AuthenticationException $authException = null): JsonResponse
        {
            $body = [
                'message' => 'Authentication Required',
            ];
            return new JsonResponse($body, Response::HTTP_UNAUTHORIZED);
        }
    
        public function supports(Request $request): bool
        {
            return $request->headers->has('Authorization');
        }
    
        public function getCredentials(Request $request)
        {
            return $request->headers->get('Authorization');
        }
    
        public function onAuthenticationFailure(Request $request, AuthenticationException $exception): JsonResponse
        {
            return new JsonResponse([
                'message' => $exception->getMessage()
            ], Response::HTTP_UNAUTHORIZED);
        }
    
        public function onAuthenticationSuccess(Request $request, TokenInterface $token, string $providerKey): ?Response
        {
            return null;
        }
    
        public function supportsRememberMe(): bool
        {
            return false;
        }
    
        public function authenticate(Request $request): Passport
        {
            try{
                $credentials = str_replace('Bearer ', '', $this->getCredentials($request));
                $firebaseAuth = $this->firebase->createAuth();
    
                try {
                    $verifiedIdToken = $firebaseAuth->verifyIdToken($credentials);
                    $tokenClaims = $verifiedIdToken->claims();

                    $sub = $tokenClaims->get('sub');
                    $email = $tokenClaims->get('email');
                    
                    if ($verifiedIdToken->isExpired(new \DateTime())) {
                        throw new AuthenticationException("Token expired.");
                    }
                    
                } catch (Firebase\Exception\AuthException | Firebase\Exception\FirebaseException $e) {
                    throw new AuthenticationException($e->getMessage());
                }
    
            }
            catch (\Exception $exception){
                throw new AuthenticationException($exception->getMessage());
            }
    
            return new SelfValidatingPassport(new UserBadge($email));
        }
    }

security:
    enable_authenticator_manager: true
    password_hashers:
        Symfony\Component\Security\Core\User\PasswordAuthenticatedUserInterface: 'auto'
        App\Entity\User:
            algorithm: auto

    providers:
        app_user_provider:
            entity:
                class: App\Entity\User
                property: email


    firewalls:
        dev:
            pattern: ^/(_(profiler|wdt)|css|images|js)/
            security: false

        main:
            lazy: true
            stateless: true
            provider: app_user_provider
            custom_authenticator: App\Security\JWTAuthenticator

    # Easy way to control access for large sections of your site
    # Note: Only the *first* access control that matches will be used
    access_control:
        - { path: ^/api/docs, roles: PUBLIC_ACCESS }
        - { path: ^/, roles: IS_AUTHENTICATED_FULLY }