public function AuthenticationManager::getAccount in RESTful 7.2

Get the user account for the request.

Parameters

RequestInterface $request: The request.

bool $cache: Boolean indicating if the resolved user should be cached for next calls.

Return value

object The user object.

Throws

UnauthorizedException When bad credentials are provided.

Overrides AuthenticationManagerInterface::getAccount

File

src/Authentication/AuthenticationManager.php, line 102

Contains \Drupal\restful\Authentication\AuthenticationManager

Class

AuthenticationManager

Class AuthenticationManager.

Namespace

Drupal\restful\Authentication

Code

public function getAccount(RequestInterface $request, $cache = TRUE) {
  global $user;

  // Return the previously resolved user, if any.
  if (!empty($this->account)) {
    return $this->account;
  }

  // Resolve the user based on the providers in the manager.
  $account = NULL;
  foreach ($this->plugins as $provider) {

    /* @var \Drupal\restful\Plugin\authentication\AuthenticationInterface $provider */
    if ($provider
      ->applies($request) && ($account = $provider
      ->authenticate($request)) && $account->uid && $account->status) {

      // The account has been loaded, we can stop looking.
      break;
    }
  }
  if (empty($account->uid) || !$account->status) {
    if (RestfulManager::isRestfulPath($request) && $this->plugins
      ->count() && !$this
      ->getIsOptional()) {

      // Allow caching pages for anonymous users.
      drupal_page_is_cacheable(variable_get('restful_page_cache', FALSE));

      // User didn't authenticate against any provider, so we throw an error.
      throw new UnauthorizedException('Bad credentials. Anonymous user resolved for a resource that requires authentication.');
    }

    // If the account could not be authenticated default to the global user.
    // Most of the cases the cookie provider will do this for us.
    $account = drupal_anonymous_user();
    if (!$request
      ->isViaRouter()) {

      // If we are using the API from within Drupal and we have not tried to
      // authenticate using the 'cookie' provider, then we expect to be logged
      // in using the cookie authentication as a last resort.
      $account = $user->uid ? user_load($user->uid) : $account;
    }
  }
  if ($cache) {
    $this
      ->setAccount($account);
  }

  // Disable page caching for security reasons so that an authenticated user
  // response never gets into the page cache for anonymous users.
  // This is necessary because the page cache system only looks at session
  // cookies, but not at HTTP Basic Auth headers.
  drupal_page_is_cacheable(!$account->uid && variable_get('restful_page_cache', FALSE));

  // Record the access time of this request.
  $this
    ->setAccessTime($account);
  return $account;
}