custom/plugins/SwagPlatformSecurity/src/Fixes/NEXT19820/CustomerTokenSubscriber.php line 67

Open in your IDE?
  1. <?php
  3. namespace Swag\Security\Fixes\NEXT19820;
  5. use Doctrine\DBAL\Connection;
  6. use Shopware\Core\Checkout\Customer\CustomerEvents;
  7. use Shopware\Core\Framework\DataAbstractionLayer\EntityWriteResult;
  8. use Shopware\Core\Framework\DataAbstractionLayer\Event\EntityDeletedEvent;
  9. use Shopware\Core\Framework\DataAbstractionLayer\Event\EntityWrittenEvent;
  10. use Shopware\Core\PlatformRequest;
  11. use Shopware\Core\System\SalesChannel\Context\SalesChannelContextPersister;
  12. use Shopware\Core\System\SalesChannel\SalesChannelContext;
  13. use Symfony\Component\EventDispatcher\EventSubscriberInterface;
  14. use Symfony\Component\HttpFoundation\RequestStack;
  16. class CustomerTokenSubscriber implements EventSubscriberInterface
  17. {
  18.     /**
  19.      * @var Connection
  20.      */
  21.     protected $connection;
  23.     /**
  24.      * @var RequestStack
  25.      */
  26.     protected $requestStack;
  28.     /**
  29.      * @var SalesChannelContextPersister
  30.      */
  31.     protected $contextPersister;
  33.     public static function getSubscribedEvents(): array
  34.     {
  35.         return [
  36.             CustomerEvents::CUSTOMER_WRITTEN_EVENT => 'onCustomerWritten',
  37.             CustomerEvents::CUSTOMER_DELETED_EVENT => 'onCustomerDeleted',
  38.         ];
  39.     }
  41.     public function __construct(Connection $connection, RequestStack $requestStack, SalesChannelContextPersister $contextPersister)
  42.     {
  43.         $this->connection = $connection;
  44.         $this->requestStack = $requestStack;
  45.         $this->contextPersister = $contextPersister;
  46.     }
  48.     public function onCustomerWritten(EntityWrittenEvent $event): void
  49.     {
  50.         foreach ($event->getWriteResults() as $writeResult) {
  51.             if ($writeResult->getOperation() !== EntityWriteResult::OPERATION_UPDATE) {
  52.                 continue;
  53.             }
  55.             $payload = $writeResult->getPayload();
  56.             if (!$this->customerCredentialsChanged($payload)) {
  57.                 continue;
  58.             }
  60.             $customerId = $payload['id'];
  61.             $newToken = $this->invalidateUsingSession($customerId);
  63.             $this->revokeAllCustomerTokens($customerId, $newToken);
  64.         }
  65.     }
  67.     public function onCustomerDeleted(EntityDeletedEvent $event): void
  68.     {
  69.         foreach ($event->getIds() as $customerId) {
  70.             $this->revokeAllCustomerTokens($customerId);
  71.         }
  72.     }
  74.     private function customerCredentialsChanged(array $payload): bool
  75.     {
  76.         return isset($payload['password']);
  77.     }
  79.     private function invalidateUsingSession(string $customerId): ?string
  80.     {
  81.         $master = $this->requestStack->getMasterRequest();
  83.         if (!$master) {
  84.             return null;
  85.         }
  87.         // Is not a storefront request
  88.         if (!$master->attributes->has(PlatformRequest::ATTRIBUTE_SALES_CHANNEL_CONTEXT_OBJECT)) {
  89.             return null;
  90.         }
  92.         /** @var SalesChannelContext $context */
  93.         $context = $master->attributes->get(PlatformRequest::ATTRIBUTE_SALES_CHANNEL_CONTEXT_OBJECT);
  95.         // Not loggedin skip
  96.         if ($context->getCustomer() === null) {
  97.             return null;
  98.         }
  100.         // The written customer is not the same as logged-in. We don't modify the user session
  101.         if ($context->getCustomer()->getId() !== $customerId) {
  102.             return null;
  103.         }
  105.         $token = $context->getToken();
  107.         $newToken = $this->contextPersister->replace($token, $context);
  109.         $context->assign([
  110.             'token' => $newToken,
  111.         ]);
  113.         if (!$master->hasSession()) {
  114.             return null;
  115.         }
  117.         $session = $master->getSession();
  118.         $session->migrate();
  119.         $session->set('sessionId', $session->getId());
  121.         $session->set(PlatformRequest::HEADER_CONTEXT_TOKEN, $newToken);
  122.         $master->headers->set(PlatformRequest::HEADER_CONTEXT_TOKEN, $newToken);
  124.         return $newToken;
  125.     }
  127.     public function revokeAllCustomerTokens(string $customerId, ?string ...$preserveTokens): void
  128.     {
  129.         $preserveTokens = array_filter($preserveTokens);
  131.         $revokeParams = [
  132.             'customerId' => null,
  133.             'billingAddressId' => null,
  134.             'shippingAddressId' => null,
  135.         ];
  137.         $qb = $this->connection->createQueryBuilder();
  138.         $qb
  139.             ->update('sales_channel_api_context')
  140.             ->set('payload', ':payload')
  141.             ->where('JSON_EXTRACT(payload, :customerPath) = :customerId')
  142.             ->setParameter(':payload', json_encode($revokeParams))
  143.             ->setParameter(':customerPath', '$.customerId')
  144.             ->setParameter(':customerId', $customerId);
  146.         // keep tokens valid, which are given in $preserveTokens
  147.         if ($preserveTokens) {
  148.             $qb
  149.                 ->andWhere($qb->expr()->notIn('token', ':preserveTokens'))
  150.                 ->setParameter(':preserveTokens', $preserveTokens, Connection::PARAM_STR_ARRAY);
  151.         }
  153.         $qb->execute();
  154.     }
  155. }