MC-32830: Do not store admin and customer tokens in DB

Author: ogorkun

app/code/Magento/Integration/Model/Oauth/Token.php

@@ -6,8 +6,11 @@
 namespace Magento\Integration\Model\Oauth;
 
 use Magento\Authorization\Model\UserContextInterface;
+use Magento\Framework\App\ObjectManager;
 use Magento\Framework\Oauth\Exception as OauthException;
 use Magento\Framework\Oauth\Helper\Oauth as OauthHelper;
+use Magento\Integration\Api\Exception\UserTokenException;
+use Magento\Integration\Api\UserTokenReaderInterface;
 use Magento\Integration\Model\ResourceModel\Oauth\Token\Collection as TokenCollection;
 
 /**
@@ -76,6 +79,11 @@ class Token extends \Magento\Framework\Model\AbstractModel
      */
     protected $_keyLengthFactory;
 
+    /**
+     * @var UserTokenReaderInterface
+     */
+    private $reader;
+
     /**
      * Initialize dependencies.
      *
@@ -89,6 +97,7 @@ class Token extends \Magento\Framework\Model\AbstractModel
      * @param \Magento\Framework\Model\ResourceModel\AbstractResource $resource
      * @param \Magento\Framework\Data\Collection\AbstractDb $resourceCollection
      * @param array $data
+     * @param UserTokenReaderInterface|null $reader
      * @SuppressWarnings(PHPMD.ExcessiveParameterList)
      */
     public function __construct(
@@ -101,14 +110,16 @@ public function __construct(
         OauthHelper $oauthHelper,
         \Magento\Framework\Model\ResourceModel\AbstractResource $resource = null,
         \Magento\Framework\Data\Collection\AbstractDb $resourceCollection = null,
-        array $data = []
+        array $data = [],
+        ?UserTokenReaderInterface $reader = null
     ) {
         parent::__construct($context, $registry, $resource, $resourceCollection, $data);
         $this->_keyLengthFactory = $keyLengthFactory;
         $this->_urlValidator = $urlValidator;
         $this->_consumerFactory = $consumerFactory;
         $this->_oauthData = $oauthData;
         $this->_oauthHelper = $oauthHelper;
+        $this->reader = ObjectManager::getInstance()->get(UserTokenReaderInterface::class);
     }
 
     /**
@@ -352,9 +363,30 @@ public function loadByCustomerId($customerId)
      *
      * @param string $token
      * @return $this
+     * @deprecated Proper SPI for managing tokens was introduced.
+     * @see UserTokenReaderInterface
      */
     public function loadByToken($token)
     {
-        return $this->load($token, 'token');
+        $data = $this->load($token, 'token');
+        if ($data->getId()) {
+            return $data;
+        }
+        try {
+            $data = $this->reader->read($token);
+        } catch (UserTokenException $exception) {
+            //Token is not valid, keeping this model's data empty
+            return $this;
+        }
+
+        $this->setUserType($data->getUserContext()->getUserType());
+        if ($data->getUserContext()->getUserType() === UserContextInterface::USER_TYPE_CUSTOMER) {
+            $this->setCustomerId($data->getUserContext()->getUserId());
+        } else {
+            $this->setAdminId($data->getUserContext()->getUserId());
+        }
+        $this->setId(PHP_INT_MAX);
+
+        return $this;
     }
 }