<commit_before><?php
/**
 * @link http://www.yiiframework.com/
 * @copyright Copyright (c) 2008 Yii Software LLC
 * @license http://www.yiiframework.com/license/
 */


namespace app\controllers;

use Yii;

use \Firebase\JWT\JWT;
use yii\web\ForbiddenHttpException;
use yii\web\UnauthorizedHttpException;


class MyRESTActiveController extends \yii\rest\ActiveController
{

    /**
     * Checks the privilege of the current user.
     *
     * This method should be overridden to check whether the current user has the privilege
     * to run the specified action against the specified data model.
     * If the user does not have access, a [[ForbiddenHttpException]] should be thrown.
     *
     * @param string $action the ID of the action to be executed
     * @param object $model the model to be accessed. If null, it means no specific model is being accessed.
     * @param array $params additional parameters
     * @throws ForbiddenHttpException if the user does not have access
     */
    public function checkAccess($action, $model = null, $params = [])
    {
        // проверить, имеет ли пользователь доступ к $action и $model
        // выбросить ForbiddenHttpException, если доступ следует запретить

        //standard REST methods are disabled
        if (in_array($action, ['update', 'delete', 'view', 'create', 'index','options']))
        {
            throw(new ForbiddenHttpException());
        }

        //JWT check
        $headers= Yii::$app->request->getHeaders();
        //var_dump($headers);
        $jwt = $headers->get('Authorization');
        //$jwt = '<KEY>';
        $key = 'secret';


        try {
            $decoded = JWT::decode($jwt, $key, array('HS256'));
        }
        catch (\Exception $e)
        {
            throw(new UnauthorizedHttpException($e->getMessage(), $e->getCode()));
        }


        if (!empty($decoded->id) && !empty($decoded->admin))
        {
            $userId = $decoded->id;
            $admin = $decoded->admin;
        }
        else
        {
            throw(new ForbiddenHttpException());
        }


        //for regular user allowed only these methods
        if (!$admin && !in_array($action, ['BalaceUser', 'BalaceHistory']))
        {
            throw(new ForbiddenHttpException());
        }

        return ['userId' => $userId, 'admin' => $admin];
    }
}<commit_msg>add admin check for jwt auth<commit_after><?php
/**
 * @link http://www.yiiframework.com/
 * @copyright Copyright (c) 2008 Yii Software LLC
 * @license http://www.yiiframework.com/license/
 */


namespace app\controllers;

use Yii;

use \Firebase\JWT\JWT;
use yii\web\ForbiddenHttpException;
use yii\web\UnauthorizedHttpException;


class MyRESTActiveController extends \yii\rest\ActiveController
{

    /**
     * Checks the privilege of the current user.
     *
     * This method should be overridden to check whether the current user has the privilege
     * to run the specified action against the specified data model.
     * If the user does not have access, a [[ForbiddenHttpException]] should be thrown.
     *
     * @param string $action the ID of the action to be executed
     * @param object $model the model to be accessed. If null, it means no specific model is being accessed.
     * @param array $params additional parameters
     * @throws ForbiddenHttpException if the user does not have access
     */
    public function checkAccess($action, $model = null, $params = [])
    {
        // проверить, имеет ли пользователь доступ к $action и $model
        // выбросить ForbiddenHttpException, если доступ следует запретить

        //standard REST methods are disabled
        if (in_array($action, ['update', 'delete', 'view', 'create', 'index','options']))
        {
            throw(new ForbiddenHttpException());
        }

        //JWT check
        $headers= Yii::$app->request->getHeaders();
        //var_dump($headers);
        $jwt = $headers->get('Authorization');
        //$jwt = '<KEY>';
        $key = 'secret';


        try {
            $decoded = JWT::decode($jwt, $key, array('HS256'));
        }
        catch (\Exception $e)
        {
            throw(new UnauthorizedHttpException($e->getMessage(), $e->getCode()));
        }


        if (!empty($decoded->id) && is_bool($decoded->admin))
        {
            $userId = $decoded->id;
            $admin = (bool) $decoded->admin;

            if ($userId <= 0)
            {
                throw(new ForbiddenHttpException('Invalid user id'));
            }
        }
        else
        {
            throw(new ForbiddenHttpException());
        }


        //for regular user allowed only these methods
        if (!$admin && !in_array($action, ['BalaceUser', 'BalaceHistory']))
        {
            throw(new ForbiddenHttpException());
        }

        return ['userId' => $userId, 'admin' => $admin];
    }
}
{'fraction_non_alphanumeric': 0.12525625256252562, 'fraction_numerical': 0.003075030750307503, 'mean_word_length': 2.3235694822888284, 'pattern_counts': {'":': 0, '<': 8, '<?xml version=': 0, '>': 27, 'https://': 0, 'lorem ipsum': 0, 'www.': 4, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '2962781', 'n_tokens_mistral': 1394, 'n_tokens_neox': 1385, 'n_words': 409}