148 lines
4.9 KiB
PHP
148 lines
4.9 KiB
PHP
<?php
|
|
|
|
class AUTHORIZATION
|
|
{
|
|
public static function validateTimestamp()
|
|
{
|
|
$CI =& get_instance();
|
|
$headersData = getallheaders();
|
|
|
|
if (!array_key_exists("Token",$headersData))
|
|
{
|
|
set_status_header(REST_CONTROLLER::HTTP_OK,"OK");
|
|
$response['status']=false;
|
|
$response['error']="Token required!";
|
|
echo json_encode($response);
|
|
exit;
|
|
}
|
|
else{
|
|
$token = self::validateToken($headersData['Token']);
|
|
if($token != false && (now() - $token->exp < ($CI->config->item('token_timeout') * 60))){
|
|
set_status_header(200,"OK");
|
|
return true;
|
|
}
|
|
else if($token == false){
|
|
set_status_header(REST_CONTROLLER::HTTP_UNAUTHORIZED,"Unauthorized");
|
|
$response['status']=false;
|
|
$response['error']="Invalid token!";
|
|
log_message('error','Invalid token!');
|
|
echo json_encode($response);
|
|
exit;
|
|
}
|
|
|
|
else{
|
|
set_status_header(REST_CONTROLLER::HTTP_UNAUTHORIZED,"Unauthorized");
|
|
$response['status'] = false;
|
|
$response['message'] = 'Token Experied';
|
|
log_message('error','Token Experied');
|
|
echo json_encode($response);
|
|
exit;
|
|
|
|
}
|
|
}
|
|
}
|
|
|
|
public static function validateToken($token)
|
|
{
|
|
|
|
return JWT::decode($token);
|
|
}
|
|
|
|
public static function generateToken($data)
|
|
{
|
|
$CI =& get_instance();
|
|
return JWT::encode($data, $CI->config->item('jwt_key'));
|
|
}
|
|
|
|
//check authorization user or not
|
|
|
|
public static function checkAuthorizationUser($routingName){
|
|
$CI =& get_instance();
|
|
$headersData = getallheaders();
|
|
//print_r($headersData);
|
|
|
|
$role_permission_array = array();
|
|
if(array_key_exists($CI->uri->uri_string, $CI->config->item('api_user_auth_info')))
|
|
{
|
|
$role_permission_array = $CI->config->item('api_user_auth_info')[$CI->uri->uri_string];
|
|
}
|
|
// print_r($role_permission_array);
|
|
// die();
|
|
|
|
if( $routingName == ROUTE_LOGIN_X || $routingName == ROUTE_LOGIN_Y)
|
|
{
|
|
return true;
|
|
}
|
|
if (!array_key_exists("Authorization",$headersData) OR $headersData['Authorization']!=$CI->config->item('authorization_key'))
|
|
{
|
|
set_status_header(REST_CONTROLLER::HTTP_UNAUTHORIZED,"Unauthorized");
|
|
$response['status']=false;
|
|
$response['error']="Access denied!";
|
|
$custom_log_info = 'Access denied! '.' Authorization key does not exist or not match' ;
|
|
log_message('error',$custom_log_info);
|
|
echo json_encode($response);
|
|
exit;
|
|
}
|
|
else if(isset($headersData['mode']))
|
|
{
|
|
if($headersData['mode'] == '0777')
|
|
{
|
|
return true;
|
|
}
|
|
else
|
|
{
|
|
$validateToken = self::validateTimestamp();
|
|
return $validateToken;
|
|
}
|
|
}
|
|
//For all route name except contant route
|
|
else if($routingName!=ROUTE_LOGIN){
|
|
$validateToken = self::validateTimestamp();
|
|
|
|
// Check role base arry for current user have permission to access requested API
|
|
if(count($role_permission_array))
|
|
{
|
|
if(array_key_exists("Token",$headersData))
|
|
{
|
|
$token_payload = json_decode(json_encode(JWT::decode($headersData['Token'])), true);
|
|
// print_r($token_payload);die();
|
|
|
|
//check role info existing in token paylod
|
|
if(array_key_exists('custom:role_id',$token_payload))
|
|
{
|
|
if(in_array($token_payload['custom:role_id'],$role_permission_array)){ return $validateToken; }
|
|
else {
|
|
set_status_header(REST_CONTROLLER::HTTP_UNAUTHORIZED,"Unauthorized");
|
|
$response['status']=false;
|
|
$response['error']="Unauthorized Role Access";
|
|
$custom_log_info = 'Unauthorized Role Access - '. $token_payload['custom:role_id'] . ' Email - '.$token_payload['email'].' API - '.$routingName;
|
|
log_message('error',$custom_log_info);
|
|
echo json_encode($response);
|
|
exit;
|
|
}
|
|
}
|
|
else
|
|
{
|
|
set_status_header(REST_CONTROLLER::HTTP_UNAUTHORIZED,"Unauthorized");
|
|
$response['status']=false;
|
|
$response['error']="Could not Identify Role!";
|
|
log_message('error','Could not Identify Role');
|
|
echo json_encode($response);
|
|
exit;
|
|
}
|
|
}
|
|
|
|
} // end of role based authorization logic
|
|
|
|
|
|
return $validateToken;
|
|
}
|
|
else{
|
|
return true;
|
|
}
|
|
|
|
|
|
|
|
}
|
|
|
|
} |