Symfony API密钥认证：在事件订阅器中正确处理响应与请求中断

// 示例代码：不推荐的实践
use Doctrine\ORM\EntityManager;
use Symfony\Component\EventDispatcher\EventSubscriberInterface;
use Symfony\Component\HttpKernel\Event\FilterControllerEvent;
use Symfony\Component\HttpKernel\KernelEvents;
use Symfony\Component\HttpFoundation\Response; // 需要引入Response

class TokenSubscriber implements EventSubscriberInterface
{
    private $em;

    public function __construct(EntityManager $em)
    {
        $this->em = $em;
    }

    public function onKernelController(FilterControllerEvent $event)
    {
        $controller = $event->getController();

        // 假设TokenAuthenticatedController是一个标记接口
        if ($controller[0] instanceof TokenAuthenticatedController) {
            $apiKey = $this->em->getRepository('AppBundle:ApiKey')->findOneBy(['enabled' => true, 'name' => 'apikey'])->getApiKey();
            $token = $event->getRequest()->headers->get('x-auth-token');

            if ($token !== $apiKey) {
                // 在这里直接发送响应并停止请求并不直接有效
                // $response = new Response('Unauthorized', Response::HTTP_UNAUTHORIZED);
                // $event->setResponse($response); // 这会替换控制器，但可能不是最佳实践
            }
        }
    }

    public static function getSubscribedEvents()
    {
        return [
            KernelEvents::CONTROLLER => 'onKernelController',
        ];
    }
}

// src/Security/ApiKeyAuthenticator.php
namespace App\Security;

use App\Entity\ApiKey; // 假设你有一个ApiKey实体
use Doctrine\ORM\EntityManagerInterface;
use Symfony\Component\HttpFoundation\JsonResponse;
use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\HttpFoundation\Response;
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
use Symfony\Component\Security\Core\Exception\AuthenticationException;
use Symfony\Component\Security\Core\User\UserProviderInterface;
use Symfony\Component\Security\Guard\AbstractGuardAuthenticator;

class ApiKeyAuthenticator extends AbstractGuardAuthenticator
{
    private $entityManager;

    public function __construct(EntityManagerInterface $entityManager)
    {
        $this->entityManager = $entityManager;
    }

    /**
     * 判断请求是否需要此认证器进行认证
     */
    public function supports(Request $request)
    {
        // 检查请求头中是否存在 'X-AUTH-TOKEN'
        return $request->headers->has('X-AUTH-TOKEN');
    }

    /**
     * 从请求中获取凭证（API Key）
     */
    public function getCredentials(Request $request)
    {
        return [
            'token' => $request->headers->get('X-AUTH-TOKEN'),
        ];
    }

    /**
     * 根据凭证加载用户
     * 对于API密钥，我们通常不加载实际用户，而是验证密钥本身
     */
    public function getUser($credentials, UserProviderInterface $userProvider)
    {
        $apiToken = $credentials['token'];

        if (null === $apiToken) {
            return null;
        }

        // 在这里，你可以从数据库中查找与此API密钥关联的用户或API密钥实体
        // 假设我们只是验证API密钥本身是否有效
        $apiKeyEntity = $this->entityManager->getRepository(ApiKey::class)->findOneBy(['value' => $apiToken, 'enabled' => true]);

        if (!$apiKeyEntity) {
            throw new AuthenticationException('Invalid API Key.');
        }

        // 如果API密钥有效，可以返回一个匿名用户或一个代表API客户端的特殊用户对象
        // 这里为了简化，我们假设返回一个简单的字符串作为用户标识
        return 'api_client_' . $apiKeyEntity->getId();
    }

    /**
     * 检查凭证是否有效
     * 在本例中，getUser方法已经完成了验证，所以此方法可以返回true
     */
    public function checkCredentials($credentials, $user)
    {
        // 凭证已经在getUser中验证过
        return true;
    }

    /**
     * 认证成功时调用
     */
    public function onAuthenticationSuccess(Request $request, TokenInterface $token, $providerKey)
    {
        // 认证成功，继续处理请求
        return null; // 返回null表示继续正常请求
    }

    /**
     * 认证失败时调用
     */
    public function onAuthenticationFailure(Request $request, AuthenticationException $exception)
    {
        $data = [
            'message' => strtr($exception->getMessageKey(), $exception->getMessageData())
        ];

        return new JsonResponse($data, Response::HTTP_UNAUTHORIZED);
    }

    /**
     * 当需要认证但用户未提供凭证时调用
     */
    public function start(Request $request, AuthenticationException $authException = null)
    {
        $data = [
            'message' => 'Authentication Required'
        ];

        return new JsonResponse($data, Response::HTTP_UNAUTHORIZED);
    }

    /**
     * 是否记住我功能
     */
    public function supportsRememberMe()
    {
        return false;
    }
}

# config/packages/security.yaml
security:
    # ...
    providers:
        # 定义一个简单的提供者，因为API密钥认证通常不涉及传统用户加载
        # 或者你可以定义一个实体提供者，如果你的API密钥与某个用户实体关联
        in_memory: { memory: null } # 简单示例，实际应用中可能需要更复杂的配置

    firewalls:
        dev:
            pattern: ^/(_(profiler|wdt)|css|images|js)/
            security: false

        api:
            pattern: ^/api # 保护所有以 /api 开头的路由
            stateless: true # API通常是无状态的
            provider: in_memory # 或者你自己的用户提供者
            guard:
                authenticators:
                    - App\Security\ApiKeyAuthenticator # 注册你的认证器
            # entry_point: App\Security\ApiKeyAuthenticator # 如果需要自定义入口点
            # access_denied_handler: App\Security\AccessDeniedHandler # 如果需要自定义拒绝访问处理

    access_control:
        # 确保所有 /api 路由都需要认证
        - { path: ^/api, roles: IS_AUTHENTICATED_FULLY }

// src/Controller/ApiController.php
namespace App\Controller;

use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
use Symfony\Component\Routing\Annotation\Route;
use Sensio\Bundle\FrameworkExtraBundle\Configuration\IsGranted; // 引入注解

class ApiController extends AbstractController
{
    /**
     * @Route("/api/data", methods={"GET"})
     * @IsGranted("IS_AUTHENTICATED_FULLY") // 要求完全认证
     */
    public function getData()
    {
        // 只有通过API密钥认证的请求才能访问这里
        return $this->json(['message' => 'Welcome to your API data!']);
    }

    /**
     * @Route("/api/admin", methods={"POST"})
     * @IsGranted("ROLE_ADMIN") // 要求具有ROLE_ADMIN角色
     */
    public function postAdminData()
    {
        // ...
        return $this->json(['message' => 'Admin data posted.']);
    }
}