// src/AppBundle/Security/ApiKeyAuthenticator.php
namespace AppBundle\Security;
 
use Symfony\Component\Httpfoundation\Request;
use Symfony\Component\Security\Core\Authentication\Token\PreAuthenticatedToken;
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
use Symfony\Component\Security\Core\Exception\AuthenticationException;
use Symfony\Component\Security\Core\Exception\CustomUserMessageAuthenticationException;
use Symfony\Component\Security\Core\Exception\BadCredentialsException;
use Symfony\Component\Security\Core\User\UserProviderInterface;
use Symfony\Component\Security\Http\Authentication\SimplePreAuthenticatorInterface;
 
class ApiKeyAuthenticator implements SimplePreAuthenticatorInterface
{
    public function createToken(Request $request, $providerKey)
    {
        // look for an apikey query parameter
        // 寻找一个apikey query 参数
        $apiKey = $request->query->get('apikey');
 
        // or if you wAnt to use an "apikey" header, then do something like this:
        // 或者，若你想使用一个 “apikey” 头时：
        // $apiKey = $request->headers->get('apikey');
 
        if (!$apiKey) {
            throw new BadCredentialsException();
 
            // or to just skip api key authentication
            // 或者，直接跳过 api key 的认证
            // return null;
        }
 
        return new PreAuthenticatedToken(
            'anon.',
            $apiKey,
            $providerKey
        );
    }
 
    public function supportsToken(TokenInterface $token, $providerKey)
    {
        return $token instanceof PreAuthenticatedToken && $token->getProviderKey() === $providerKey;
    }
 
    public function authenticateToken(TokenInterface $token, UserProviderInterface $userProvider, $providerKey)
    {
        if (!$userProvider instanceof ApiKeyUserProvider) {
            throw new \InvalidArgumentException(
                sprintf(
                    'The user provider must be an instance of ApiKeyUserProvider (%s was given).',
                    get_class($userProvider)
                )
            );
        }
 
        $apiKey = $token->getCredentials();
        $username = $userProvider->getUsernameForApiKey($apiKey);
 
        if (!$username) {
            // CAUTION: this message will be returned to the client
            // (so don't put any un-trusted messages / error strings here)
            // 注意：此异常信息将被返回至客户端
            // 请不要在这里放置任何敏感信息 / 错误字符串
            throw new CustomUserMessageAuthenticationException(
                sprintf('API Key "%s" does not exist.', $apiKey)
            );
        }
 
        $user = $userProvider->loadUserByUsername($username);
 
        return new PreAuthenticatedToken(
            $user,
            $apiKey,
            $providerKey,
            $user->getRoles()
        );
    }
}

// src/AppBundle/Security/ApiKeyUserProvider.php
namespace AppBundle\Security;
 
use Symfony\Component\Security\Core\User\UserProviderInterface;
use Symfony\Component\Security\Core\User\User;
use Symfony\Component\Security\Core\User\UserInterface;
use Symfony\Component\Security\Core\Exception\UnsupportedUserException;
 
class ApiKeyUserProvider implements UserProviderInterface
{
    public function getUsernameForApiKey($apiKey)
    {
        // Look up the username based on the token in the database, via
        // an API call, or do something entirely different
        // 通过对 API 进行调用，或是某些完全不同的东东，来基于数据库中的token查出用户名
        $username = ...;
 
        return $username;
    }
 
    public function loadUserByUsername($username)
    {
        return new User(
            $username,
            null,
            // the roles for the user - you may choose to determine
            // these dynamically somehow based on the user
            // 用户的roles - 根据用户的不同，你可以选择 “动态地确定” 这些roles
            array('ROLE_API')
        );
    }
 
    public function refreshUser(UserInterface $user)
    {
        // this is used for storing authentication in the session
        // but in this example, the token is sent in each request,
        // so authentication can be stateless. Throwing this exception
        // is proper to make things stateless
        // 此方法用于在session中存储认证信息
        // 但在本例中，token在每一次请求中被发送，
        // 因此认证信息是stateless（无状态）的。
        // 抛出这个异常，对于stateless来说，是最适合的
        throw new UnsupportedUserException();
    }
 
    public function supportsClass($class)
    {
        return 'Symfony\Component\Security\Core\User\User' === $class;
    }
}

// src/AppBundle/Security/ApiKeyAuthenticator.php
namespace AppBundle\Security;
 
use Symfony\Component\Security\Core\Exception\AuthenticationException;
use Symfony\Component\Security\Http\Authentication\AuthenticationFailureHandlerInterface;
use Symfony\Component\Security\Http\Authentication\SimplePreAuthenticatorInterface;
use Symfony\Component\HttpFoundation\Response;
use Symfony\Component\HttpFoundation\Request;
 
class ApiKeyAuthenticator implements SimplePreAuthenticatorInterface, AuthenticationFailureHandlerInterface
{
    // ...
 
    public function onAuthenticationFailure(Request $request, AuthenticationException $exception)
    {
        return new Response(
            // this contains information about *why* authentication failed
            // use it, or return your own message
            // 这里包括了关于 *为何* 认证失败的信息，使用此异常，或返回你自己的信息
            strtr($exception->getMessageKey(), $exception->getMessageData()),
            401
        );
    }
}

// src/AppBundle/Security/ApiKeyAuthenticator.php
 
// ...
class ApiKeyAuthenticator implements SimplePreAuthenticatorInterface
{
    // ...
    public function authenticateToken(TokenInterface $token, UserProviderInterface $userProvider, $providerKey)
    {
        if (!$userProvider instanceof ApiKeyUserProvider) {
            throw new \InvalidArgumentException(
                sprintf(
                    'The user provider must be an instance of ApiKeyUserProvider (%s was given).',
                    get_class($userProvider)
                )
            );
        }
 
        $apiKey = $token->getCredentials();
        $username = $userProvider->getUsernameForApiKey($apiKey);
 
        // User is the Entity which represents your user
        // User 是能够呈现你的用户的 Entity
        $user = $token->getUser();
        if ($user instanceof User) {
            return new PreAuthenticatedToken(
                $user,
                $apiKey,
                $providerKey,
                $user->getRoles()
            );
        }
 
        if (!$username) {
            // this message will be returned to the client
            // 此信息将返回客户端
            throw new CustomUserMessageAuthenticationException(
                sprintf('API Key "%s" does not exist.', $apiKey)
            );
        }
 
        $user = $userProvider->loadUserByUsername($username);
 
        return new PreAuthenticatedToken(
            $user,
            $apiKey,
            $providerKey,
            $user->getRoles()
        );
    }
    // ...
}

// src/AppBundle/Security/ApiKeyUserProvider.php
 
// ...
class ApiKeyUserProvider implements UserProviderInterface
{
    // ...
 
    public function refreshUser(UserInterface $user)
    {
        // $user is the User that you set in the token inside authenticateToken()
        // after it has been deserialized from the session
        // 此处的 $user ，是它从 session 中被反序列化之后，
        // 你在 authenticateToken() 中设置在 token 中的 User 对象
 
 
        // you might use $user to query the database for a fresh user
        // 你可能会使用 $user 来查询数据库，以获取用户的最新内容
        // $id = $user->getId();
        // use $id to make a query / 据此 $id 进行查询
 
        // if you are *not* reading from a database and are just creating
        // a User object (like in this example), you can just return it
        // 如果你  *不* 从数据库中读取用户，
        // 只是创建一个 User 对象（如同本例），则直接返回它
        return $user;
    }
}

// src/AppBundle/Security/ApiKeyAuthenticator.php
 
// ...
use Symfony\Component\Security\Http\HttpUtils;
use Symfony\Component\HttpFoundation\Request;
 
class ApiKeyAuthenticator implements SimplePreAuthenticatorInterface
{
    protected $httpUtils;
 
    public function __construct(HttpUtils $httpUtils)
    {
        $this->httpUtils = $httpUtils;
    }
 
    public function createToken(Request $request, $providerKey)
    {
        // set the only URL where we should look for auth information
        // and only return the token if we're at that URL
        // 在此设置我们应当查找auth信息的唯一URL
        // 然后仅当我们处于该URL时才返回token
        $targetUrl = '/login/check';
        if (!$this->httpUtils->checkRequestPath($request, $targetUrl)) {
            return;
        }
 
        // ...
    }
}