PHP code example of heinhtet / api-authorizer

    
        
<?php
require_once('vendor/autoload.php');

/* Start to develop here. Best regards https://php-download.com/ */

    

heinhtet / api-authorizer example snippets

// config/api-authorizer.php
'clients' => [
    'acme' => env('API_AUTHORIZER_SECRET_ACME'),
],

// routes/api.php
use Illuminate\Support\Facades\Route;

Route::middleware('api.authorizer')->prefix('v1')->group(function () {
    Route::get('/orders', [OrderController::class, 'index']);
    Route::post('/orders', [OrderController::class, 'store']);
});

->withMiddleware(function (Middleware $middleware): void {
    $middleware->api(append: [
        \HeinHtet\ApiAuthorizer\Middleware\VerifyApiSignature::class,
    ]);
})

Route::get('/profile', ProfileController::class)
    ->middleware(\HeinHtet\ApiAuthorizer\Middleware\VerifyApiSignature::class);

$client = $request->attributes->get('api_authorizer');

$client->poweredBy; // "acme"
$client->timestamp; // 1771662781
$client->requestId; // "req-123" or null

use HeinHtet\ApiAuthorizer\Facades\ApiAuthorizer;

$headers = ApiAuthorizer::headers(
    poweredBy: 'acme',
    secret: config('api-authorizer.clients.acme'),
    method: 'GET',
    path: '/api/v1/orders',
    query: 'page=1&status=paid',
);

Http::withHeaders($headers)->get(config('services.orders.url').'/api/v1/orders?page=1&status=paid');

$headers = ApiAuthorizer::forRequest($request, 'acme', $secret);

$timestamp = time();
$canonical = implode('|', [
    'GET',
    '/api/v1/orders',
    'page=1&status=paid', // sorted by key
    $timestamp,
    '',                   // empty for GET
]);

$signature = hash_hmac('sha256', $canonical, $secret);

// config/api-authorizer.php
return [
    'enabled' => env('API_AUTHORIZER_ENABLED', true),

    'headers' => [
        'powered_by' => 'X-POWERED-BY',
        'timestamp' => 'X-TIMESTAMP',
        'signature' => 'X-SIGNATURE',
        'request_id' => 'X-REQUEST-ID',
    ],

    'tolerance' => env('API_AUTHORIZER_TOLERANCE', 300), // seconds

    'algorithm' => 'sha256',
    'encoding' => 'hex', // hex | base64

    'clients' => [
        'acme' => env('API_AUTHORIZER_SECRET_ACME'),
    ],

    'bypass' => [
        'enabled' => env('API_AUTHORIZER_BYPASS_ENABLED', false),
        'header' => 'X-BY-PASS',
        'key' => env('API_AUTHORIZER_BYPASS_KEY'),
    ],

    'logging' => [
        'enabled' => env('API_AUTHORIZER_LOGGING', false),
        'channel' => env('API_AUTHORIZER_LOG_CHANNEL'),
    ],

    'error_codes' => [
        'missing_header' => 1001,
        'invalid_timestamp' => 1002,
        'expired_timestamp' => 1003,
        'unknown_client' => 1004,
        'invalid_signature' => 1005,
    ],
];

use HeinHtet\ApiAuthorizer\Clients\ClientRepositoryInterface;

final class DatabaseClientRepository implements ClientRepositoryInterface
{
    public function getSecret(string $poweredBy): ?string
    {
        return ApiClient::query()
            ->where('powered_by', $poweredBy)
            ->value('secret');
    }
}

$this->app->bind(ClientRepositoryInterface::class, DatabaseClientRepository::class);

use HeinHtet\ApiAuthorizer\Facades\ApiAuthorizer;

$headers = ApiAuthorizer::headers(
    poweredBy: 'acme',
    secret: config('api-authorizer.clients.acme'),
    method: 'GET',
    path: '/api/v1/orders',
    query: 'page=1',
);

$this->getJson('/api/v1/orders?page=1', $headers)->assertOk();

bash
php artisan vendor:publish --tag=api-authorizer-config

bash
curl --location 'https://www.sample.com/api/v1/orders?page=1&status=paid' \
  --header 'X-POWERED-BY: acme' \
  --header 'X-TIMESTAMP: 1771662781' \
  --header 'X-SIGNATURE: ed04e9dd82afa0e411bc3b88299fd7e4eb42c7a4e10a23df4f4cce509798df6b'