use Shaarli\Api\Exceptions\ApiAuthorizationException;
use Shaarli\Api\Exceptions\ApiException;
+use Shaarli\Bookmark\BookmarkFileService;
use Shaarli\Config\ConfigManager;
use Slim\Container;
use Slim\Http\Request;
$response = $e->getApiResponse();
}
- return $response;
+ return $response
+ ->withHeader('Access-Control-Allow-Origin', '*')
+ ->withHeader(
+ 'Access-Control-Allow-Headers',
+ 'X-Requested-With, Content-Type, Accept, Origin, Authorization'
+ )
+ ->withHeader('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS')
+ ;
}
/**
*/
protected function checkToken($request)
{
- if (! $request->hasHeader('Authorization') && !isset($this->container->environment['REDIRECT_HTTP_AUTHORIZATION'])) {
+ if (!$request->hasHeader('Authorization')
+ && !isset($this->container->environment['REDIRECT_HTTP_AUTHORIZATION'])
+ ) {
throw new ApiAuthorizationException('JWT token not provided');
}
}
/**
- * Instantiate a new LinkDB including private links,
+ * Instantiate a new LinkDB including private bookmarks,
* and load in the Slim container.
*
* FIXME! LinkDB could use a refactoring to avoid this trick.
*/
protected function setLinkDb($conf)
{
- $linkDb = new \Shaarli\Bookmark\LinkDB(
- $conf->get('resource.datastore'),
- true,
- $conf->get('privacy.hide_public_links')
+ $linkDb = new BookmarkFileService(
+ $conf,
+ $this->container->get('history'),
+ true
);
$this->container['db'] = $linkDb;
}
@unlink(self::$testDatastore);
}
+ /**
+ * Invoke the middleware with a valid token
+ */
+ public function testInvokeMiddlewareWithValidToken(): void
+ {
+ $next = function (Request $request, Response $response): Response {
+ return $response;
+ };
+ $mw = new ApiMiddleware($this->container);
+ $env = Environment::mock([
+ 'REQUEST_METHOD' => 'GET',
+ 'REQUEST_URI' => '/echo',
+ 'HTTP_AUTHORIZATION'=> 'Bearer ' . ApiUtilsTest::generateValidJwtToken('NapoleonWasALizard'),
+ ]);
+ $request = Request::createFromEnvironment($env);
+ $response = new Response();
+ /** @var Response $response */
+ $response = $mw($request, $response, $next);
+
+ $this->assertEquals(200, $response->getStatusCode());
+ }
+
+ /**
+ * Invoke the middleware with a valid token
+ * Using specific Apache CGI redirected authorization.
+ */
+ public function testInvokeMiddlewareWithValidTokenFromRedirectedHeader(): void
+ {
+ $next = function (Request $request, Response $response): Response {
+ return $response;
+ };
+
+ $token = 'Bearer ' . ApiUtilsTest::generateValidJwtToken('NapoleonWasALizard');
+ $this->container->environment['REDIRECT_HTTP_AUTHORIZATION'] = $token;
+ $mw = new ApiMiddleware($this->container);
+ $env = Environment::mock([
+ 'REQUEST_METHOD' => 'GET',
+ 'REQUEST_URI' => '/echo',
+ ]);
+ $request = Request::createFromEnvironment($env);
+ $response = new Response();
+ /** @var Response $response */
+ $response = $mw($request, $response, $next);
+
+ $this->assertEquals(200, $response->getStatusCode());
+ }
+
/**
* Invoke the middleware with the API disabled:
* should return a 401 error Unauthorized.