maintenance: prepare sf8.0 migration

DependencyInjection/RezzzaSecurityExtension.php

@@ -9,8 +9,8 @@
 use Symfony\Component\Config\FileLocator;
 use Symfony\Component\DependencyInjection\ContainerBuilder;
 use Symfony\Component\DependencyInjection\Definition;
-use Symfony\Component\DependencyInjection\Loader\XmlFileLoader;
-use Symfony\Component\HttpKernel\DependencyInjection\Extension;
+use Symfony\Component\DependencyInjection\Extension\Extension;
+use Symfony\Component\DependencyInjection\Loader\PhpFileLoader;
 
 /**
  * RezzzaSecurityExtension.
@@ -28,14 +28,14 @@ public function load(array $configs, ContainerBuilder $container): void
 
         $config = $processor->processConfiguration($configuration, $configs);
 
-        $loader = new XmlFileLoader($container, new FileLocator(__DIR__.'/../Resources/config/services'));
+        $loader = new PhpFileLoader($container, new FileLocator(__DIR__.'/../Resources/config/services'));
 
-        $loader->load('security.xml');
+        $loader->load('security.php');
 
         $container->setParameter('rezzza.security.request_obfuscator.enabled', $config['request_obfuscator']['enabled']);
 
         if ($container->getParameter('rezzza.security.request_obfuscator.enabled')) {
-            $loader->load('request_obfuscator.xml');
+            $loader->load('request_obfuscator.php');
         }
 
         $firewalls = $config['firewalls'];

Resources/config/services/request_obfuscator.php

@@ -0,0 +1,15 @@
+<?php
+
+declare(strict_types=1);
+
+use Rezzza\SecurityBundle\Request\Obfuscator\RequestObfuscator;
+use Symfony\Component\DependencyInjection\Loader\Configurator\ContainerConfigurator;
+
+return static function (ContainerConfigurator $container): void {
+    $services = $container->services();
+    $parameters = $container->parameters();
+
+    $parameters->set('rezzza.security.request_obfuscator.obfuscator.class', RequestObfuscator::class);
+
+    $services->set('rezzza.security.request_obfuscator.obfuscator', '%rezzza.security.request_obfuscator.obfuscator.class%');
+};

Resources/config/services/security.php

@@ -0,0 +1,60 @@
+<?php
+
+declare(strict_types=1);
+
+use Rezzza\SecurityBundle\DependencyInjection\Security\Factory\RequestSignatureFactory;
+use Rezzza\SecurityBundle\Security\Firewall\ReplayProtection;
+use Rezzza\SecurityBundle\Security\Firewall\RequestSignatureListener;
+use Rezzza\SecurityBundle\Security\Firewall\RequestSignatureProdiver;
+use Rezzza\SecurityBundle\Security\Firewall\SignatureConfig;
+use Rezzza\SecurityBundle\Security\Firewall\SignatureQueryParameters;
+use Rezzza\SecurityBundle\Security\Listener\CorsSecurityListener;
+use Symfony\Component\DependencyInjection\Loader\Configurator\ContainerConfigurator;
+
+use function Symfony\Component\DependencyInjection\Loader\Configurator\service;
+
+return static function (ContainerConfigurator $container): void {
+    $services = $container->services();
+    $parameters = $container->parameters();
+
+    $parameters->set('rezzza.security.request_signature.listener.class', RequestSignatureListener::class);
+    $parameters->set('rezzza.security.request_signature.signature_query_parameters.class', SignatureQueryParameters::class);
+    $parameters->set('rezzza.security.request_signature.signature_config.class', SignatureConfig::class);
+    $parameters->set('rezzza.security.request_signature.replay_protection.class', ReplayProtection::class);
+
+    $services->set('fulll.cors_listener', CorsSecurityListener::class)
+        ->private()
+        ->args([
+            service('logger')->nullOnInvalid(),
+        ])
+        ->tag('kernel.event_listener', [
+            'event' => 'kernel.request',
+            'method' => 'onKernelRequest',
+            'priority' => 200,
+        ]);
+
+    $services->set('fulll.request_signature.provider', RequestSignatureProdiver::class);
+
+    $services->set('rezzza.security.request_signature.listener', '%rezzza.security.request_signature.listener.class%')
+        ->private()
+        ->args([
+            service('security.token_storage'),
+            null, // injected via RequestSignatureFactory
+            null, // injected via RequestSignatureFactory
+            null, // injected via RequestSignatureFactory
+            null, // injected via RequestSignatureFactory
+        ]);
+
+    $services->set('rezzza.security.request_signature.signature_query_parameters', '%rezzza.security.request_signature.signature_query_parameters.class%')
+        ->private();
+
+    $services->set('rezzza.security.request_signature.signature_config', '%rezzza.security.request_signature.signature_config.class%')
+        ->private();
+
+    $services->set('rezzza.security.request_signature.replay_protection', '%rezzza.security.request_signature.replay_protection.class%')
+        ->private();
+
+    // for 2.0
+    $services->set('rezzza.security.request_signature.factory', RequestSignatureFactory::class)
+        ->tag('security.listener.factory');
+};

Security/Firewall/RequestSignatureListener.php

@@ -37,9 +37,11 @@ public function authenticate(Request $request): Passport
             );
         }
 
-        $signature = $request->get($this->signatureQueryParameters->getNonceQueryParameter());
+        $nonceQueryParameter = $this->signatureQueryParameters->getNonceQueryParameter();
 
-        if (null === $signature) {
+        $signature = $request->query->getString($nonceQueryParameter);
+
+        if ('' === $signature) {
             throw new UnauthorizedHttpException('Signature must be filled.');
         }
 

phpstan-baseline.neon

@@ -43,10 +43,10 @@ parameters:
 		-
 			message: "#^Call to an undefined method Symfony\\\\Component\\\\Config\\\\Definition\\\\Builder\\\\NodeDefinition\\:\\:children\\(\\)\\.$#"
 			count: 1
-			path: DependencyInjection/Configuration.php
+			path: DependencyInjection/Security/Factory/RequestSignatureFactory.php
 
 		-
-			message: "#^Call to an undefined method Symfony\\\\Component\\\\Config\\\\Definition\\\\Builder\\\\NodeDefinition\\:\\:children\\(\\)\\.$#"
+			message: "#^Method Rezzza\\\\SecurityBundle\\\\DependencyInjection\\\\Security\\\\Factory\\\\RequestSignatureFactory\\:\\:addConfiguration\\(\\) has parameter \\$node with generic class Symfony\\\\Component\\\\Config\\\\Definition\\\\Builder\\\\NodeDefinition but does not specify its types\\: TParent$#"
 			count: 1
 			path: DependencyInjection/Security/Factory/RequestSignatureFactory.php
 
@@ -170,21 +170,11 @@ parameters:
 			count: 1
 			path: Security/Firewall/RequestSignatureListener.php
 
-		-
-			message: "#^Parameter \\#1 \\$signature of method Rezzza\\\\SecurityBundle\\\\Security\\\\Firewall\\\\SignedRequest\\:\\:authenticateSignature\\(\\) expects string, mixed given\\.$#"
-			count: 1
-			path: Security/Firewall/RequestSignatureListener.php
-
 		-
 			message: "#^Parameter \\#1 \\$user of class Rezzza\\\\SecurityBundle\\\\Security\\\\SignatureValidToken constructor expects Rezzza\\\\SecurityBundle\\\\Security\\\\SignatureValidUser, Symfony\\\\Component\\\\Security\\\\Core\\\\User\\\\UserInterface given\\.$#"
 			count: 1
 			path: Security/Firewall/RequestSignatureListener.php
 
-		-
-			message: "#^Parameter \\#1 \\$userIdentifier of class Symfony\\\\Component\\\\Security\\\\Http\\\\Authenticator\\\\Passport\\\\Badge\\\\UserBadge constructor expects string, mixed given\\.$#"
-			count: 1
-			path: Security/Firewall/RequestSignatureListener.php
-
 		-
 			message: "#^Parameter \\#2 \\$host of class Rezzza\\\\SecurityBundle\\\\Security\\\\Firewall\\\\SignedRequest constructor expects string, mixed given\\.$#"
 			count: 1