| 1 |
<?php |
| 2 |
|
| 3 |
// phpcs:disable Yoast.NamingConventions.NamespaceName.TooLong -- Needed in the folder structure. |
| 4 |
|
| 5 |
namespace Yoast\WP\SEO\AI\Authentication\Application; |
| 6 |
|
| 7 |
use WP_User; |
| 8 |
use Yoast\WP\SEO\AI\Authorization\Application\Token_Manager; |
| 9 |
use Yoast\WP\SEO\AI\HTTP_Request\Application\Request_Handler; |
| 10 |
use Yoast\WP\SEO\AI\HTTP_Request\Domain\Exceptions\Unauthorized_Exception; |
| 11 |
use Yoast\WP\SEO\AI\HTTP_Request\Domain\Request; |
| 12 |
use Yoast\WP\SEO\AI\HTTP_Request\Domain\Response; |
| 13 |
use YoastSEO_Vendor\Psr\Log\LoggerAwareInterface; |
| 14 |
use YoastSEO_Vendor\Psr\Log\LoggerAwareTrait; |
| 15 |
use YoastSEO_Vendor\Psr\Log\NullLogger; |
| 16 |
|
| 17 |
/** |
| 18 |
* Authenticates AI requests via the legacy `access_jwt` flow. |
| 19 |
* |
| 20 |
* Pulls the per-user JWT from Token_Manager, attaches it as `Authorization: Bearer …`, and dispatches |
| 21 |
* through the standard AI Request_Handler. On a 401 the stored access + refresh JWTs are dropped and |
| 22 |
* the call is retried once with freshly fetched tokens; a second 401 propagates. |
| 23 |
*/ |
| 24 |
class Token_Auth_Strategy implements Auth_Strategy_Interface, LoggerAwareInterface { |
| 25 |
|
| 26 |
use LoggerAwareTrait; |
| 27 |
|
| 28 |
/** |
| 29 |
* The token manager. |
| 30 |
* |
| 31 |
* @var Token_Manager |
| 32 |
*/ |
| 33 |
private $token_manager; |
| 34 |
|
| 35 |
/** |
| 36 |
* The AI request handler. |
| 37 |
* |
| 38 |
* @var Request_Handler |
| 39 |
*/ |
| 40 |
private $request_handler; |
| 41 |
|
| 42 |
/** |
| 43 |
* Constructor. |
| 44 |
* |
| 45 |
* @param Token_Manager $token_manager The token manager. |
| 46 |
* @param Request_Handler $request_handler The AI request handler. |
| 47 |
*/ |
| 48 |
public function __construct( Token_Manager $token_manager, Request_Handler $request_handler ) { |
| 49 |
$this->token_manager = $token_manager; |
| 50 |
$this->request_handler = $request_handler; |
| 51 |
$this->logger = new NullLogger(); |
| 52 |
} |
| 53 |
|
| 54 |
// phpcs:disable Squiz.Commenting.FunctionCommentThrowTag.Missing -- Token_Manager and Request_Handler throw a long list of typed exceptions that simply propagate out. |
| 55 |
|
| 56 |
/** |
| 57 |
* Dispatches the request, retrying once with fresh tokens if the first attempt is rejected as stale. |
| 58 |
* |
| 59 |
* @param Request $request The base request. |
| 60 |
* @param WP_User $user The WP user. |
| 61 |
* |
| 62 |
* @return Response The parsed response. |
| 63 |
*/ |
| 64 |
public function send( Request $request, WP_User $user ): Response { |
| 65 |
try { |
| 66 |
return $this->do_send( $request, $user ); |
| 67 |
} catch ( Unauthorized_Exception $exception ) { |
| 68 |
$this->logger->debug( 'Token send: 401 received for user {user_id}; clearing stored JWTs and retrying once.', [ 'user_id' => $user->ID ] ); |
| 69 |
$this->token_manager->clear_tokens( (string) $user->ID ); |
| 70 |
|
| 71 |
return $this->do_send( $request, $user ); |
| 72 |
} |
| 73 |
} |
| 74 |
|
| 75 |
/** |
| 76 |
* Fetches the access token, attaches `Authorization: Bearer <jwt>`, and dispatches via the AI Request_Handler. |
| 77 |
* |
| 78 |
* @param Request $request The base request. |
| 79 |
* @param WP_User $user The WP user. |
| 80 |
* |
| 81 |
* @return Response The parsed response. |
| 82 |
*/ |
| 83 |
private function do_send( Request $request, WP_User $user ): Response { |
| 84 |
$token = $this->token_manager->get_or_request_access_token( $user ); |
| 85 |
$decorated = $request->with_added_headers( [ 'Authorization' => "Bearer $token" ] ); |
| 86 |
|
| 87 |
return $this->request_handler->handle( $decorated ); |
| 88 |
} |
| 89 |
|
| 90 |
// phpcs:enable Squiz.Commenting.FunctionCommentThrowTag.Missing |
| 91 |
} |
| 92 |
|
