mirror of
https://github.com/flarum/core.git
synced 2025-10-12 23:44:27 +02:00
fb51fb4e6d
This was originally introduced in 3612ca7aca, but has not seen usage, since usually when the session needs to be modified, the request is available.
It causes issues with certain queue drivers, as it can't be serialized.
It's also not entirely accurate, as a user can have multiple sessions at once. Therefore, a given session is a property of the request, not of the user.
The reason this causes issues in the Queue is that when a Job has payload that consists User(s), the Queue will try to serialize that. Serializing the User object will require serializing the session too; this causes a Serialization of Closure is not allowed error, see image.
One can circumvent that in many ways, the most obvious one is adding a __sleep and __wakeup implementation in the User class (or the session handler). But as we aren't really using the session on the User model anywhere in core, bundled or most community extensions it is best to simply detach this from the user.
56 lines
1.5 KiB
PHP
56 lines
1.5 KiB
PHP
<?php
|
|
|
|
/*
|
|
* This file is part of Flarum.
|
|
*
|
|
* For detailed copyright and license information, please view the
|
|
* LICENSE file that was distributed with this source code.
|
|
*/
|
|
|
|
namespace Flarum\Http\Middleware;
|
|
|
|
use Flarum\Http\AccessToken;
|
|
use Flarum\Http\RequestUtil;
|
|
use Flarum\User\Guest;
|
|
use Illuminate\Contracts\Session\Session;
|
|
use Psr\Http\Message\ResponseInterface as Response;
|
|
use Psr\Http\Message\ServerRequestInterface as Request;
|
|
use Psr\Http\Server\MiddlewareInterface as Middleware;
|
|
use Psr\Http\Server\RequestHandlerInterface as Handler;
|
|
|
|
class AuthenticateWithSession implements Middleware
|
|
{
|
|
public function process(Request $request, Handler $handler): Response
|
|
{
|
|
$session = $request->getAttribute('session');
|
|
|
|
$actor = $this->getActor($session, $request);
|
|
|
|
$request = RequestUtil::withActor($request, $actor);
|
|
|
|
return $handler->handle($request);
|
|
}
|
|
|
|
private function getActor(Session $session, Request $request)
|
|
{
|
|
if ($session->has('access_token')) {
|
|
$token = AccessToken::findValid($session->get('access_token'));
|
|
|
|
if ($token) {
|
|
$actor = $token->user;
|
|
$actor->updateLastSeen()->save();
|
|
|
|
$token->touch($request);
|
|
|
|
return $actor;
|
|
}
|
|
|
|
// If this session used to have a token which is no longer valid we properly refresh the session
|
|
$session->invalidate();
|
|
$session->regenerateToken();
|
|
}
|
|
|
|
return new Guest;
|
|
}
|
|
}
|