@amazeelabs/silverback-preview-link 1.6.15

package/drupal/silverback_preview_link/src/Authentication/Provider/PreviewToken.php

@@ -0,0 +1,118 @@
+<?php
+
+namespace Drupal\silverback_preview_link\Authentication\Provider;
+
+use Drupal\Core\Authentication\AuthenticationProviderInterface;
+use Drupal\Core\PageCache\ResponsePolicy\KillSwitch;
+use Drupal\Core\Session\AccountInterface;
+use Drupal\silverback_preview_link\PreviewLinkExpiry;
+use Drupal\silverback_preview_link\PreviewLinkStorageInterface;
+use Symfony\Component\HttpFoundation\Request;
+
+/**
+ * Authentication provider based on a token from a preview link.
+ */
+class PreviewToken implements AuthenticationProviderInterface {
+
+  /**
+   * The preview link storage service.
+   *
+   * @var \Drupal\silverback_preview_link\PreviewLinkStorageInterface
+   */
+  protected PreviewLinkStorageInterface $previewLinkStorage;
+
+  /**
+   * The page cache kill switch service.
+   *
+   * @var \Drupal\Core\PageCache\ResponsePolicy\KillSwitch
+   */
+  protected KillSwitch $killSwitch;
+
+  /**
+   * The preview link expiry service.
+   * @var PreviewLinkExpiry
+   */
+  protected PreviewLinkExpiry $previewLinkExpiry;
+
+  /**
+   * Constructs a new token authentication provider.
+   */
+  public function __construct() {
+    // If we inject the entity entity type manager service, we get a circular
+    // dependency error, that is why we access the entity type manager service
+    // from here.
+    /** @var \Drupal\silverback_preview_link\PreviewLinkStorageInterface $storage */
+    $storage = \Drupal::entityTypeManager()->getStorage('silverback_preview_link');
+    $this->previewLinkStorage = $storage;
+    $this->killSwitch = \Drupal::service('page_cache_kill_switch');
+    $this->previewLinkExpiry = \Drupal::service('silverback_preview_link.link_expiry');
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function applies(Request $request) {
+    $previewToken = $this->getPreviewTokenFromRequest($request);
+    return !empty($previewToken);
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function authenticate(Request $request) {
+    // If we authenticate the user with a token, we do not want to cache the
+    // page.
+    $this->killSwitch->trigger();
+    $previewToken = $this->getPreviewTokenFromRequest($request);
+    return $this->getUserFromPreviewToken($previewToken);
+  }
+
+  /**
+   * Returns a preview token from the request (the preview_access_token query
+   * parameter).
+   *
+   * @param \Symfony\Component\HttpFoundation\Request $request
+   * @return bool|float|int|string|null
+   */
+  protected function getPreviewTokenFromRequest(Request $request) {
+    return $request->query->get('preview_access_token');
+  }
+
+  /**
+   * Returns the User object for a given preview token.
+   *
+   * The preview link entity which corresponds to the token will be loaded and
+   * if there is a user associated with that token it will be returned.
+   *
+   * @param string $previewToken
+   *   The preview token.
+   *
+   * @return \Drupal\Core\Session\AccountInterface|null
+   *   The User object for the current user, or NULL for anonymous.
+   */
+  protected function getUserFromPreviewToken(string $previewToken): AccountInterface|null {
+    $previewLink = $this->previewLinkStorage->loadByProperties(['token' => $previewToken]);
+    if (empty($previewLink)) {
+      return NULL;
+    }
+    // The loadByProperties() method returns the result as an array, so just
+    // take the first element.
+    $previewLink = reset($previewLink);
+    $referencedEntities = $previewLink->get('entities')->referencedEntities();
+    if (empty($referencedEntities)) {
+      return NULL;
+    }
+    $referencedUser = array_reduce($referencedEntities, function ($carry, $entity) {
+      if ($entity->getEntityTypeId() === 'user' && $entity->isActive()) {
+        $carry = $entity;
+      }
+      return $carry;
+    }, NULL);
+    // No active user entity reference found for the preview link, just return
+    // NULL.
+    if (empty($referencedUser)) {
+      return NULL;
+    }
+    return $referencedUser;
+  }
+}

package/drupal/silverback_preview_link/src/Controller/PreviewController.php

@@ -0,0 +1,83 @@
+<?php
+
+namespace Drupal\silverback_preview_link\Controller;
+
+use Drupal\Core\Cache\CacheableResponse;
+use Drupal\Core\Controller\ControllerBase;
+use Drupal\silverback_preview_link\QRCodeWithLogo;
+use Drupal\user\Entity\User;
+use Symfony\Component\HttpFoundation\JsonResponse;
+
+class PreviewController extends ControllerBase {
+
+  /**
+   * Checks if the current user has access to the Preview app.
+   */
+  public function hasAccess() {
+    /** @var \Drupal\Core\Session\AccountProxyInterface $userAccount */
+    $userAccount = $this->currentUser();
+    // Verify permission against User entity.
+    $userEntity = User::load($userAccount->id());
+    if ($userEntity->hasPermission('use external preview')) {
+      return new JsonResponse([
+        'access' => TRUE,
+      ], 200);
+    }
+    else {
+      return new JsonResponse([
+        'access' => FALSE,
+      ], 403);
+    }
+  }
+
+  /**
+   * Skip Drupal authentication if there is a valid preview token.
+   *
+   * @todo: previously, this method used to also check if the preview access
+   * token has been attached to an entity (the entity type and entity ids were
+   * sent as parameters). This approach will change in the future (as part of a
+   * bigger refactoring) where preview links won't be attached to content
+   * entities anymore, so this method might change again.
+   */
+  public function hasLinkAccess() {
+    $requestContent = \Drupal::request()->getContent();
+    $body = json_decode($requestContent, TRUE);
+    if (!empty($body['preview_access_token'])) {
+      try {
+        $storage = \Drupal::entityTypeManager()->getStorage('silverback_preview_link');
+        $previewLink = $storage->loadByProperties(['token' => $body['preview_access_token']]);
+        if (empty($previewLink)) {
+          return new JsonResponse([
+            'access' => FALSE,
+          ], 403);
+        }
+
+        // @todo: optionally, we could also check if the link has expired.
+        // Expired links should be, however, deleted by the cron job. As this
+        // part of the code will probably suffer modifications during the next
+        // bigger refactoring (see the todo in the method's description), we
+        // will just check for now if the link simply exists.
+        return new JsonResponse([
+          'access' => TRUE,
+        ], 200);
+      }
+      catch (\Exception $e) {
+        $this->getLogger('silverback_preview_link')->error($e->getMessage());
+      }
+    }
+    return new JsonResponse([
+      'access' => FALSE,
+    ], 403);
+  }
+
+  /**
+   * Returns the QR SVG file.
+   */
+  public function getQRCode(string $base64_url): CacheableResponse {
+    $decodedUrl = base64_decode(str_replace(['_'], ['/'], $base64_url));
+    $qrCode = new QRCodeWithLogo();
+    $result = $qrCode->getQRCode($decodedUrl);
+    return new CacheableResponse($result, 200, ['Content-Type' => 'image/svg+xml']);
+  }
+
+}

package/drupal/silverback_preview_link/src/Entity/SilverbackPreviewLink.php

@@ -0,0 +1,224 @@
+<?php
+
+declare(strict_types = 1);
+
+namespace Drupal\silverback_preview_link\Entity;
+
+use Drupal\Component\Assertion\Inspector;
+use Drupal\Core\Entity\ContentEntityBase;
+use Drupal\Core\Entity\EntityInterface;
+use Drupal\Core\Entity\EntityStorageInterface;
+use Drupal\Core\Entity\EntityTypeInterface;
+use Drupal\Core\Field\BaseFieldDefinition;
+use Drupal\Core\Field\FieldStorageDefinitionInterface;
+use Drupal\Core\Url;
+use Drupal\user\Entity\User;
+
+/**
+ * Defines the Silverback preview link entity class.
+ *
+ * @ContentEntityType(
+ *   id = "silverback_preview_link",
+ *   label = @Translation("Preview Link"),
+ *   base_table = "silverback_preview_link",
+ *   handlers = {
+ *     "views_data" = "Drupal\views\EntityViewsData",
+ *     "storage" = "Drupal\silverback_preview_link\PreviewLinkStorage",
+ *     "view_builder" = "Drupal\Core\Entity\EntityViewBuilder",
+ *     "form" = {
+ *       "silverback_preview_link" = "Drupal\silverback_preview_link\Form\PreviewLinkForm",
+ *       "delete" = "Drupal\Core\Entity\ContentEntityDeleteForm",
+ *     },
+ *    "route_provider" = {
+ *       "html" = "Drupal\Core\Entity\Routing\AdminHtmlRouteProvider",
+ *     },
+ *   },
+ *   links = {
+ *     "canonical" = "/admin/content/preview-link/{silverback_preview_link}",
+ *     "delete-form" = "/admin/content/preview-link/{silverback_preview_link}/delete",
+ *   },
+ *   admin_permission = "administer site configuration",
+ *   entity_keys = {
+ *     "id" = "id"
+ *   }
+ * )
+ *
+ * @property \Drupal\dynamic_entity_reference\Plugin\Field\FieldType\DynamicEntityReferenceFieldItemList $entities
+ */
+class SilverbackPreviewLink extends ContentEntityBase implements SilverbackPreviewLinkInterface {
+
+  /**
+   * Keep track on whether we need a new token upon save.
+   *
+   * @var bool
+   */
+  protected $needsNewToken = FALSE;
+  /**
+   * {@inheritDoc}
+   */
+  public function postCreate(EntityStorageInterface $storage) {
+    parent::postCreate($storage);
+    // If there is a default preview user set, then we add that user to the list
+    // of entities attached to the link.
+    $state = \Drupal::state();
+    $default_preview_user = $state->get('silverback_preview_link.default_preview_user');
+    if ($default_preview_user) {
+      $this->addEntity(User::load($default_preview_user));
+    }
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function getUrl(EntityInterface $entity): Url {
+    return Url::fromRoute(sprintf('entity.%s.silverback_preview_link', $entity->getEntityTypeId()), [
+      $entity->getEntityTypeId() => $entity->id(),
+      'preview_token' => $this->getToken(),
+    ]);
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function getToken(): string {
+    return $this->get('token')->value;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function setToken($token) {
+    $this->set('token', $token);
+    // Add a second so our testing always works.
+    $this->set('generated_timestamp', time() + 1);
+    return $this;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function regenerateToken($needs_new_token = FALSE): bool {
+    $current_value = $this->needsNewToken;
+    $this->needsNewToken = $needs_new_token;
+    return $current_value;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function getGeneratedTimestamp(): int {
+    return (int) $this->get('generated_timestamp')->value;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function getEntities(): array {
+    return $this->entities->referencedEntities();
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function setEntities(array $entities) {
+    assert(Inspector::assertAllObjects($entities, EntityInterface::class));
+    return $this->set('entities', $entities);
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function addEntity(EntityInterface $entity) {
+    $this->entities->appendItem($entity);
+    return $this;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function getExpiry(): ?\DateTimeImmutable {
+    $value = $this->expiry->value ?? NULL;
+    if (!is_numeric($value)) {
+      return NULL;
+    }
+
+    return new \DateTimeImmutable('@' . $value);
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function setExpiry(\DateTimeInterface $expiry) {
+    return $this->set('expiry', $expiry->getTimestamp());
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public static function baseFieldDefinitions(EntityTypeInterface $entity_type) {
+    $fields = parent::baseFieldDefinitions($entity_type);
+    $fields['token'] = BaseFieldDefinition::create('string')
+      ->setLabel(t('Preview Token'))
+      ->setDescription(t('A token that allows any user to view a preview of this entity.'))
+      ->setRequired(TRUE);
+
+    $fields['entities'] = BaseFieldDefinition::create('dynamic_entity_reference')
+      ->setLabel(t('Entities'))
+      ->setDescription(t('The associated entities this preview link unlocks.'))
+      ->setRequired(TRUE)
+      ->setCardinality(FieldStorageDefinitionInterface::CARDINALITY_UNLIMITED)
+      ->addConstraint('SilverbackPreviewLinkEntitiesUniqueConstraint', [])
+      ->setSettings(static::entitiesDefaultFieldSettings())
+      ->setDisplayOptions('form', [
+        'type' => 'silverback_preview_link_entities_widget',
+        'weight' => 10,
+      ]);
+
+    $fields['generated_timestamp'] = BaseFieldDefinition::create('timestamp')
+      ->setLabel(t('Generated Timestamp'))
+      ->setDescription(t('The time the link was generated'))
+      ->setRequired(TRUE);
+
+    $fields['expiry'] = BaseFieldDefinition::create('timestamp')
+      ->setLabel(t('Time this Preview Link expires.'))
+      ->setDescription(t('The time after which the preview link is no longer valid.'))
+      ->setDefaultValueCallback(static::class . '::expiryDefaultValue')
+      ->setRequired(TRUE);
+
+    return $fields;
+  }
+
+  /**
+   * Rewrites settings for 'entities' dynamic_entity_reference field.
+   *
+   * DynamicEntityReferenceItem::defaultFieldSettings doesn't receive any context,
+   * so we need to change the default handlers manually.
+   */
+  public static function entitiesDefaultFieldSettings(): array {
+    $labels = \Drupal::service('entity_type.repository')->getEntityTypeLabels(TRUE);
+    $options = $labels[(string) t('Content', [], ['context' => 'Entity type group'])];
+    $settings = [
+      'exclude_entity_types' => TRUE,
+      'entity_type_ids' => [],
+    ];
+    $settings += array_fill_keys(array_keys($options), [
+      'handler' => 'silverback_preview_link',
+      'handler_settings' => [],
+    ]);
+    return $settings;
+  }
+
+  /**
+   * Get default value for 'expiry' field.
+   *
+   * @return int<0, max>
+   *   A timestamp.
+   */
+  public static function expiryDefaultValue(): int {
+    $time = \Drupal::time();
+    /** @var \Drupal\silverback_preview_link\PreviewLinkExpiry $linkExpiry */
+    $linkExpiry = \Drupal::service('silverback_preview_link.link_expiry');
+    return max(0, $time->getRequestTime() + $linkExpiry->getLifetime());
+  }
+
+}

package/drupal/silverback_preview_link/src/Entity/SilverbackPreviewLinkInterface.php

@@ -0,0 +1,110 @@
+<?php
+
+declare(strict_types = 1);
+
+namespace Drupal\silverback_preview_link\Entity;
+
+use Drupal\Core\Entity\ContentEntityInterface;
+use Drupal\Core\Entity\EntityInterface;
+use Drupal\Core\Url;
+
+/**
+ * Interface for the preview link entity.
+ */
+interface SilverbackPreviewLinkInterface extends ContentEntityInterface {
+
+  /**
+   * The URL for this preview link for an entity.
+   *
+   * @param \Drupal\Core\Entity\EntityInterface $entity
+   *   A host entity.
+   *
+   * @return \Drupal\Core\Url
+   *   The url object.
+   */
+  public function getUrl(EntityInterface $entity): Url;
+
+  /**
+   * Gets thew new token.
+   *
+   * @return string
+   *   The token.
+   */
+  public function getToken(): string;
+
+  /**
+   * Set the new token.
+   *
+   * @param string $token
+   *   The new token.
+   *
+   * @return $this
+   *   Return this for chaining.
+   */
+  public function setToken(string $token);
+
+  /**
+   * Mark the entity needing a new token. Only updated upon save.
+   *
+   * @param bool $needs_new_token
+   *   Tell this entity to generate a new token.
+   *
+   * @return bool
+   *   TRUE if it was currently marked to generate otherwise FALSE.
+   */
+  public function regenerateToken($needs_new_token = FALSE): bool;
+
+  /**
+   * Gets the timestamp stamp of when the token was generated.
+   *
+   * @return int
+   *   The timestamp.
+   */
+  public function getGeneratedTimestamp(): int;
+
+  /**
+   * Get entities this preview link unlocks.
+   *
+   * Ideally preview link access is determined via PreviewLinkHost service.
+   *
+   * @return \Drupal\Core\Entity\EntityInterface[]
+   *   Associated entities.
+   */
+  public function getEntities(): array;
+
+  /**
+   * Set the entity this preview link unlocks.
+   *
+   * @return $this
+   *   Return this for chaining.
+   */
+  public function setEntities(array $entities);
+
+  /**
+   * Add an entity for this preview link to unlock.
+   *
+   * @return $this
+   *   Return this for chaining.
+   */
+  public function addEntity(EntityInterface $entity);
+
+  /**
+   * Get expiration date.
+   *
+   * @return \DateTimeImmutable|null
+   *   The expiration date, or NULL if not set.
+   */
+  public function getExpiry(): ?\DateTimeImmutable;
+
+  /**
+   * Set the expiration date.
+   *
+   * @param \DateTimeInterface $expiry
+   *   The expiration date.
+   *
+   * @return $this
+   *   Return this for chaining.
+   */
+  public function setExpiry(\DateTimeInterface $expiry);
+
+}