Code Coverage
 
Lines
Functions and Methods
Classes and Traits
Total
100.00%
9 / 9
100.00%
2 / 2
 CRAP
100.00%
1 / 1
AdminApiProfileMiddleware
100.00%
8 / 8
100.00%
2 / 2
 3
100.00%
1 / 1
 __construct
100.00%
1 / 1
100.00%
1 / 1
 1
 process
100.00%
7 / 7
100.00%
1 / 1
 2
1<?php
2
3declare(strict_types=1);
4
5/** @license For full copyright and license information, please see the LICENSE.md file. */
6
7namespace App\Core\Api\Middleware;
8
9defined('AMMONLY_APP') || exit('Direct script access is forbidden.');
10
11use App\Shared\Infrastructure\Http\ApiResponseTrait;
12use Psr\Http\Message\ResponseFactoryInterface;
13use Psr\Http\Message\ResponseInterface;
14use Psr\Http\Message\ServerRequestInterface;
15use Psr\Http\Server\MiddlewareInterface;
16use Psr\Http\Server\RequestHandlerInterface;
17
18/**
19 * PSR-15 Middleware restricting administrative API route groups from client profile invocations.
20 *
21 * @package App\Core\Api\Middleware
22 */
23final readonly class AdminApiProfileMiddleware implements MiddlewareInterface
24{
25    use ApiResponseTrait;
26
27    /**
28     * AdminApiProfileMiddleware constructor.
29     *
30     * @param ResponseFactoryInterface $responseFactory PSR-17 response factory.
31     * @param string                   $currentProfile  Active application profile name (e.g. 'admin', 'client').
32     */
33    public function __construct(
34        private ResponseFactoryInterface $responseFactory,
35        private string $currentProfile = 'admin'
36    ) {
37    }
38
39    /**
40     * Rejects request with 403 Forbidden if client profile attempts to access admin route group.
41     *
42     * @param ServerRequestInterface  $request Incoming server request.
43     * @param RequestHandlerInterface $handler Request handler pipeline.
44     * @return ResponseInterface
45     */
46    public function process(ServerRequestInterface $request, RequestHandlerInterface $handler): ResponseInterface
47    {
48        if ($this->currentProfile === 'client') {
49            return $this->jsonError(
50                $this->responseFactory,
51                'This API endpoint is restricted to the administrative application profile.',
52                403
53            );
54        }
55
56        return $handler->handle($request);
57    }
58}