Download the PHP package api-skeletons/laravel-doctrine-apikey without Composer

Laravel Doctrine ApiKey

This repository provides a driver for Doctrine which can be added to an existing entity manager.
The driver provides a set of entities which enable ApiKey authorization through HTTP middleware. Scopes are supported! This was the missing piece of other repositories which catalyzed the creation of this library.

Installation

Run the following to install this library using Composer:

Quick Start

Add Service Provider to app.php

Add the route middleware to Http Kernel

Initialize the ApiKey service for your entity manager in App\Providers\AppServiceProvider

Add an API key through the console

Add the middleware to a protected route

Begin making requests to your ApiKey protected resource using your apikey as a Bearer token in the Authorization header

Schema

Using Scopes

Scopes are permissions for ApiKeys. They are commonly used in OAuth2 and are less common in ApiKeys. Create a scope:

Security with scopes is applied with the same middleware used to authenticate ApiKeys. Replace {scopeName} with your scope's name and the middleware will ensure the passed ApiKey has that scope to continue.

Access to ApiKey through request attributes

The ApiKey entity which authenticates a request is assigned to the request attributes as 'apikey'.

Using foreign keys to ApiKey

Because an ApiKey can be regenerated, there may be no reason to assign multiple API keys to the same entity. For instance, if each Customer has a 1:1 with ApiKey then you can safely disable that key, regenerate it, and so on; never needing to assign a new ApiKey.

To dynamically create a 1:1 relationship between a Customer entity and API key, create an event subscriber:

Event Logging

Admin events are logged when an ApiKey is generated, activated, deactivated, add a scope, and remove a scope.

Access events are logged when the route middleware allows access to a resource.

Commands

Management of API keys is handled through the command line. However, full access to all data-creating functions is available through the Doctrine repositories: ApiKeyRepository and ScopeRepository.

Generate an ApiKey

Generate a Scope

Assign a Scope to an ApiKey

Deactivate an ApiKey

Activate an ApiKey

Unassign a Scope from an ApiKey

Regenerate an ApiKey (assign a new Bearer token)

Delete a Scope

Print ApiKey[s]

Print Scope[s]

Multiple object managers

The metadata included with this repository works fine across multiple object managers.
The commands included in this repository only work on the default ApiKeyService, so you will need an alternative method of maintaining data in the second object manager. In order to use multiple object managers you must do some configuration. Assuming you followed the Quick Start, above, follow these steps for a second object manager:

Create a new singleton of the ApiKeyService with a different name in App\Providers\AppServiceProvider

Initialize the ApiKey service for the second entity manager in App\Providers\AppServiceProvider

Copy the route middleware to a new class and use dependency injection for the ApiKeyService2

Inspired By

The repository https://github.com/ejarnutowski/laravel-api-key was the inispiration for this repository. It seemed a fine project but did not have unit tests or scopes.