Added API key on users

Author: rimi-itk

CHANGELOG.md

@@ -7,6 +7,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+- [#88](https://github.com/itk-dev/devops_itksites/pull/88)
+  - Let users use the API
 - [#80](https://github.com/itk-dev/devops_itksites/pull/80) 5566: Service agreements
   - Add security contract entity with crud controller
   - Add Abstract full crud controller and extend on it in some cases

README.md

@@ -45,6 +45,24 @@ The system is build so that all analyzed data can be truncated safely and rebuil
 by "replaying" the DetectionResults. This means that care must be taken when
 manually maintained data and auto updated data must have cross references.
 
+## API
+
+Authenticated users can access a simple read-only API – see the API documentation on `/api/docs` for details.
+
+### API keys
+
+Run the `app:user:set-api-key` console command to set the API for a user:
+
+``` shell
+docker compose exec phpfpm php bin/console app:user:set-api-key <user-id>
+```
+
+Use the API key to make an authenticated request, e.g.
+
+``` shell
+curl --header 'accept: application/json' --header 'authorization: Apikey <the API key>' https://itksites.local.itkdev.dk/api/sites
+```
+
 ## Development
 
 ```sh

config/packages/security.yaml

@@ -12,6 +12,11 @@ security:
             entity:
                 class: App\Entity\User
                 property: email
+
+        app_api_users:
+            chain:
+                providers: [app_server_provider, app_user_provider]
+
     firewalls:
         dev:
             pattern: ^/(_(profiler|wdt)|css|images|js)/
@@ -20,7 +25,7 @@ security:
             pattern: ^/api
             custom_authenticators:
                 - App\Security\ApiKeyAuthenticator
-            provider: app_server_provider
+            provider: app_api_users
 
         main:
             custom_authenticators:
@@ -41,7 +46,7 @@ security:
     # Note: Only the *first* access control that matches will be used
     access_control:
         - { path: ^/api/docs, roles: PUBLIC_ACCESS }
-        - { path: ^/api, roles: ROLE_SERVER }
+        - { path: ^/api, roles: [ROLE_SERVER, ROLE_USER] }
         - { path: ^/admin, roles: ROLE_ADMIN }
         # - { path: ^/profile, roles: ROLE_USER }
 

migrations/Version20260702123347.php

@@ -0,0 +1,33 @@
+<?php
+
+declare(strict_types=1);
+
+namespace DoctrineMigrations;
+
+use Doctrine\DBAL\Schema\Schema;
+use Doctrine\Migrations\AbstractMigration;
+
+/**
+ * Auto-generated Migration: Please modify to your needs!
+ */
+final class Version20260702123347 extends AbstractMigration
+{
+    public function getDescription(): string
+    {
+        return '';
+    }
+
+    public function up(Schema $schema): void
+    {
+        // this up() migration is auto-generated, please modify it to your needs
+        $this->addSql('ALTER TABLE user ADD api_key VARCHAR(255) NOT NULL');
+        $this->addSql('CREATE UNIQUE INDEX UNIQ_8D93D649C912ED9D ON user (api_key)');
+    }
+
+    public function down(Schema $schema): void
+    {
+        // this down() migration is auto-generated, please modify it to your needs
+        $this->addSql('DROP INDEX UNIQ_8D93D649C912ED9D ON user');
+        $this->addSql('ALTER TABLE user DROP api_key');
+    }
+}

src/Command/UserSetApiKeyCommand.php

@@ -0,0 +1,52 @@
+<?php
+
+namespace App\Command;
+
+use App\Repository\UserRepository;
+use Doctrine\ORM\EntityManagerInterface;
+use Symfony\Component\Console\Attribute\Argument;
+use Symfony\Component\Console\Attribute\AsCommand;
+use Symfony\Component\Console\Command\Command;
+use Symfony\Component\Console\Exception\InvalidArgumentException;
+use Symfony\Component\Console\Style\SymfonyStyle;
+
+#[AsCommand(
+    name: 'app:user:set-api-key',
+    description: 'Set API key for a user',
+)]
+readonly class UserSetApiKeyCommand
+{
+    public function __construct(
+        private UserRepository $userRepository,
+        private EntityManagerInterface $entityManager,
+    ) {
+    }
+
+    public function __invoke(
+        SymfonyStyle $io,
+        #[Argument]
+        string $userId,
+    ): int {
+        $user = $this->userRepository->findOneBy(['email' => $userId])
+            ?? $this->userRepository->findOneBy(['name' => $userId]);
+
+        if (null === $user) {
+            throw new InvalidArgumentException(sprintf('Cannot load user with id %s', $userId));
+        }
+
+        $question = sprintf('Really set API key on user %s', $user->getUserIdentifier());
+        if (!$io->confirm($question)) {
+            return Command::SUCCESS;
+        }
+
+        $user->setApiKey($user->generateApiKey());
+        $this->entityManager->flush();
+
+        $io->success([
+            sprintf('API key for user %s set to', $user->getUserIdentifier()),
+            $user->getApiKey(),
+        ]);
+
+        return Command::SUCCESS;
+    }
+}

src/Entity/Server.php

@@ -5,6 +5,7 @@
 namespace App\Entity;
 
 use App\Repository\ServerRepository;
+use App\Trait\ApiKeyEntityTrait;
 use Doctrine\Common\Collections\ArrayCollection;
 use Doctrine\Common\Collections\Collection;
 use Doctrine\ORM\Mapping as ORM;
@@ -16,16 +17,9 @@
 #[ORM\Entity(repositoryClass: ServerRepository::class)]
 class Server extends AbstractBaseEntity implements UserInterface, \Stringable
 {
-    private const array ROLES = ['ROLE_USER', 'ROLE_SERVER'];
+    use ApiKeyEntityTrait;
 
-    #[ORM\Column(type: 'string', length: 255, unique: true)]
-    #[Assert\Length(
-        min: 40,
-        max: 255,
-        minMessage: 'Api key must be at least {{ limit }} characters long',
-        maxMessage: 'Api key cannot be longer than {{ limit }} characters',
-    )]
-    private string $apiKey;
+    private const array ROLES = ['ROLE_USER', 'ROLE_SERVER'];
 
     #[ORM\Column(type: 'string', length: 255, unique: true)]
     #[Groups(['export'])]
@@ -93,8 +87,8 @@ class Server extends AbstractBaseEntity implements UserInterface, \Stringable
      */
     public function __construct()
     {
+        $this->setApiKey($this->generateApiKey());
         $this->detectionResults = new ArrayCollection();
-        $this->apiKey = sha1(\random_bytes(40));
         $this->installations = new ArrayCollection();
     }
 
@@ -258,18 +252,6 @@ public function setUsedFor(?string $usedFor): self
         return $this;
     }
 
-    public function getApiKey(): string
-    {
-        return $this->apiKey;
-    }
-
-    public function setApiKey(string $apiKey): self
-    {
-        $this->apiKey = $apiKey;
-
-        return $this;
-    }
-
     /**
      * @return Collection<int, DetectionResult>
      */

src/Entity/User.php

@@ -5,12 +5,15 @@
 namespace App\Entity;
 
 use App\Repository\UserRepository;
+use App\Trait\ApiKeyEntityTrait;
 use Doctrine\ORM\Mapping as ORM;
 use Symfony\Component\Security\Core\User\UserInterface;
 
 #[ORM\Entity(repositoryClass: UserRepository::class)]
 class User extends AbstractBaseEntity implements UserInterface
 {
+    use ApiKeyEntityTrait;
+
     public function __construct(
         #[ORM\Column(length: 255)]
         private string $name,
@@ -19,6 +22,7 @@ public function __construct(
         #[ORM\Column(type: 'json')]
         private array $roles = [],
     ) {
+        $this->setApiKey($this->generateApiKey());
     }
 
     #[\Override]

src/Security/ApiKeyAuthenticator.php

@@ -4,11 +4,14 @@
 
 namespace App\Security;
 
+use App\Repository\ServerRepository;
+use App\Repository\UserRepository;
 use Symfony\Component\HttpFoundation\JsonResponse;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
 use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
 use Symfony\Component\Security\Core\Exception\AuthenticationException;
+use Symfony\Component\Security\Core\Exception\BadCredentialsException;
 use Symfony\Component\Security\Core\Exception\CustomUserMessageAuthenticationException;
 use Symfony\Component\Security\Http\Authenticator\AbstractAuthenticator;
 use Symfony\Component\Security\Http\Authenticator\Passport\Badge\UserBadge;
@@ -20,6 +23,12 @@ class ApiKeyAuthenticator extends AbstractAuthenticator
     public const string AUTH_HEADER = 'Authorization';
     public const string AUTH_HEADER_PREFIX = 'Apikey ';
 
+    public function __construct(
+        private readonly ServerRepository $serverRepository,
+        private readonly UserRepository $userRepository,
+    ) {
+    }
+
     /**
      * Called on every request to decide if this authenticator should be used for the request.
      *
@@ -40,7 +49,14 @@ public function authenticate(Request $request): Passport
             throw new CustomUserMessageAuthenticationException('No API token provided');
         }
 
-        return new SelfValidatingPassport(new UserBadge($apiKey));
+        // Users and servers can authenticate to use the API.
+        $apiUser = $this->serverRepository->findOneBy(['apiKey' => $apiKey])
+            ?? $this->userRepository->findOneBy(['apiKey' => $apiKey]);
+        if (null !== $apiUser) {
+            return new SelfValidatingPassport(new UserBadge($apiUser->getUserIdentifier()));
+        }
+
+        throw new BadCredentialsException('Invalid credentials.');
     }
 
     public function onAuthenticationSuccess(Request $request, TokenInterface $token, string $firewallName): ?Response

src/Trait/ApiKeyEntityTrait.php

@@ -0,0 +1,35 @@
+<?php
+
+namespace App\Trait;
+
+use Doctrine\ORM\Mapping as ORM;
+use Symfony\Component\Validator\Constraints as Assert;
+
+trait ApiKeyEntityTrait
+{
+    #[ORM\Column(type: 'string', length: 255, unique: true)]
+    #[Assert\Length(
+        min: 40,
+        max: 255,
+        minMessage: 'Api key must be at least {{ limit }} characters long',
+        maxMessage: 'Api key cannot be longer than {{ limit }} characters',
+    )]
+    private string $apiKey;
+
+    public function getApiKey(): string
+    {
+        return $this->apiKey;
+    }
+
+    public function setApiKey(string $apiKey): static
+    {
+        $this->apiKey = $apiKey;
+
+        return $this;
+    }
+
+    public function generateApiKey(): string
+    {
+        return sha1(\random_bytes(40));
+    }
+}