Migrate to dflydev/stack-authentication and dflydev/stack-firewall

Author: simensen

composer.json

@@ -1,5 +1,20 @@
 {
     "name": "dflydev/stack-basic-authentication",
+    "description": "Basic Authentication Stack middleware",
+    "keywords": ["stack", "stack-2"],
+    "license": "MIT",
+    "authors": [
+        {
+            "name": "Dragonfly Development Inc.",
+            "email": "[email protected]",
+            "homepage": "http://dflydev.com"
+        },
+        {
+            "name": "Beau Simensen",
+            "email": "[email protected]",
+            "homepage": "http://beausimensen.com"
+        }
+    ],
     "autoload": {
         "psr-0": {
             "Dflydev\\Stack": "src"
@@ -8,12 +23,17 @@
     "repositories": [
         {
             "type": "vcs",
-            "url": "https://github.com/simensen/stack-security"
+            "url": "https://github.com/dflydev/dflydev-stack-authentication"
+        },
+        {
+            "type": "vcs",
+            "url": "https://github.com/dflydev/dflydev-stack-firewall"
         }
     ],
     "require": {
         "php": ">=5.4.0",
-        "stack/security": "1.0.*@dev",
+        "dflydev/stack-authentication": "1.0.*@dev",
+        "dflydev/stack-firewall": "1.0.*@dev",
         "symfony/http-foundation": "~2.1",
         "symfony/http-kernel": "~2.1"
     },

composer.lock

@@ -24,6 +24,10 @@ public function __construct(HttpKernelInterface $app, array $options = array())
 
     public function handle(Request $request, $type = HttpKernelInterface::MASTER_REQUEST, $catch = true)
     {
+        // The challenge callback is called if a 401 response is detected that
+        // has a "WWW-Authenticate: Stack" header. This is per the Stack
+        // Authentication and Authorization proposals. It is passed the existing
+        // response object.
         $challenge = function (Response $response) {
             $parts = ['Basic'];
             if (isset($this->container['realm'])) {
@@ -35,38 +39,55 @@ public function handle(Request $request, $type = HttpKernelInterface::MASTER_REQ
             return $response;
         };
 
-        $firewalls = isset($this->container['firewalls'])
-            ? $this->container['firewalls']
-            : [];
-
-        list ($isResponse, $value, $firewall) = \Stack\Security\authenticate(
-            $this->app,
-            $challenge,
-            $firewalls,
-            $request,
-            $type,
-            $catch
-        );
-
-        if ($isResponse) {
-            return $value;
-        }
-
-        $delegate = $value;
-
-        if (false === $username = $request->headers->get('PHP_AUTH_USER', false)) {
-            return call_user_func($delegate);
-        }
+        // The authenticate callback is called if the request has no Stack
+        // authentication token but there is an authorization header. It is
+        // passed an app we should delegate to (assuming we do not return
+        // beforehand) and a boolean value indicating whether or not anonymous
+        // requests should be allowed.
+        $authenticate = function ($app, $anonymous) use ($request, $type, $catch, $challenge) {
+            if (false === $username = $request->headers->get('PHP_AUTH_USER', false)) {
+                if ($anonymous) {
+                    // This is not a Basic Auth request but the firewall allows
+                    // anonymous requests so we should wrap the application
+                    // so that we might be able to challenge if authorization
+                    // fails.
+                    return (new WwwAuthenticateStackChallenge($app, $challenge))
+                        ->handle($request, $type, $catch);
+                }
+
+                // Anonymous requests are not allowed so we should challenge
+                // immediately.
+                return call_user_func($challenge, (new Response)->setStatusCode(401));
+            }
 
-        $token = $this->container['authenticator']($username, $request->headers->get('PHP_AUTH_PW'));
+            $token = $this->container['authenticator']($username, $request->headers->get('PHP_AUTH_PW'));
+
+            if (null === $token) {
+                if ($anonymous) {
+                    // Authentication faild but anonymous requests are allowed
+                    // so we will pass this on. If authorization fails, we have
+                    // wrapped the app in a challenge middleware that will let
+                    // us challenge for basic auth.
+                    return (new WwwAuthenticateStackChallenge($app, $challenge))
+                        ->handle($request, $type, $catch);
+                }
+
+                // We should challenge immediately if anonymous requests are not
+                // allowed.
+                return call_user_func($challenge, (new Response)->setStatusCode(401));
+            }
 
-        if (null === $token) {
-            return \Stack\Security\delegate_missing_authentication($firewall, $delegate, $challenge);
-        }
+            $request->attributes->set('stack.authn.token', $token);
 
-        $request->attributes->set('stack.authn.token', $token);
+            return $app->handle($request, $type, $catch);
+        };
 
-        return call_user_func($delegate);
+        return (new Firewall($this->app, [
+                'challenge' => $challenge,
+                'authenticate' => $authenticate,
+                'firewall' => $this->container['firewall'],
+            ]))
+            ->handle($request, $type, $catch);
     }
 
     private function setupContainer(array $options = array())
@@ -77,7 +98,9 @@ private function setupContainer(array $options = array())
             );
         }
 
-        $c = new Pimple;
+        $c = new Pimple([
+            'firewall' => [],
+        ]);
 
         foreach ($options as $name => $value) {
             if (in_array($name, ['authenticator'])) {

src/Dflydev/Stack/BasicAuthentication.php

@@ -16,7 +16,7 @@ class SilexApplicationTest extends TestCase
     /** @test */
     public function shouldNotChallengeForUnprotectedResourceNoHeader()
     {
-        $app = $this->basicify($this->createTestApp(), ['firewalls' => [
+        $app = $this->basicify($this->createTestApp(), ['firewall' => [
             ['path' => '/', 'anonymous' => true],
         ]]);
 
@@ -29,7 +29,7 @@ public function shouldNotChallengeForUnprotectedResourceNoHeader()
     /** @test */
     public function shouldChallengeForProtectedResourceNoHeader()
     {
-        $app = $this->basicify($this->createTestApp(), ['firewalls' => [
+        $app = $this->basicify($this->createTestApp(), ['firewall' => [
             ['path' => '/', 'anonymous' => true],
         ]]);