$app->error($exceptionHandler); // // Catch runtime erros etc. as well // set_exception_handler($exceptionHandler); // Routes which do not need protection by the authentication and the request // nonce enforcement. $authAndNonceRouteWhitelist = array("auth_login", "auth_logout", "auth_session", "auth_clear_session", "auth_nonces", "auth_permissions", "debug_acl_poc"); $app->hook('slim.before.dispatch', function () use($app, $requestNonceProvider, $authAndNonceRouteWhitelist) { /** Skip routes which don't require these protections */ $routeName = $app->router()->getCurrentRoute()->getName(); if (!in_array($routeName, $authAndNonceRouteWhitelist)) { /** Enforce required authentication. */ if (!Auth::loggedIn()) { $app->halt(401, "You must be logged in to access the API."); } /** Enforce required request nonces. */ if (!$requestNonceProvider->requestHasValidNonce()) { if ('development' !== DIRECTUS_ENV) { $app->halt(401, "Invalid request (nonce)."); } } /** Include new request nonces in the response headers */ $response = $app->response(); $newNonces = $requestNonceProvider->getNewNoncesThisRequest(); $nonce_options = $requestNonceProvider->getOptions(); $response[$nonce_options['nonce_response_header']] = implode($newNonces, ","); } }); /** * Bootstrap Providers */ /**
$privilegesTable = new DirectusPrivilegesTableGateway($acl, $ZendDb); $acl->setGroupPrivileges($privilegesTable->getGroupPrivileges($user['group'])); // @TODO: Adding an user should auto set its ID and GROUP $acl->setUserId($user['id']); $acl->setGroupId($user['group']); } /** Enforce required authentication. */ if (!Auth::loggedIn()) { $app->halt(401, __t('you_must_be_logged_in_to_access_the_api')); } /** Enforce required request nonces. */ // NOTE: do no use nonce until it's well implemented // OR in fact if it's actually necessary. // nonce needs to be checked // otherwise an error is thrown if (!$requestNonceProvider->requestHasValidNonce() && !$authToken) { // if('development' !== DIRECTUS_ENV) { // $app->halt(401, __t('invalid_request_nonce')); // } } // User is authenticated // And Directus is about to start $app->emitter->run('directus.start', $app); /** Include new request nonces in the response headers */ $response = $app->response(); $newNonces = $requestNonceProvider->getNewNoncesThisRequest(); $nonce_options = $requestNonceProvider->getOptions(); $response[$nonce_options['nonce_response_header']] = implode($newNonces, ','); } }); $app->hook('slim.after', function () use($app) {