feat: integrated OAuth2 server

config/bundles.php

@@ -15,4 +15,5 @@ return [
     Symfony\WebpackEncoreBundle\WebpackEncoreBundle::class => ['all' => true],
     Knp\Bundle\MenuBundle\KnpMenuBundle::class => ['all' => true],
     League\FlysystemBundle\FlysystemBundle::class => ['all' => true],
+    League\Bundle\OAuth2ServerBundle\LeagueOAuth2ServerBundle::class => ['all' => true],
 ];

config/packages/league_oauth2_server.yaml

@@ -0,0 +1,22 @@
+league_oauth2_server:
+    authorization_server:
+        private_key: '%env(resolve:OAUTH_PRIVATE_KEY)%'
+        private_key_passphrase: null
+        encryption_key: '%env(resolve:OAUTH_ENCRYPTION_KEY)%'
+        enable_client_credentials_grant: true
+        enable_auth_code_grant: true
+        enable_refresh_token_grant: false
+        enable_password_grant: false
+        access_token_ttl: PT10M
+    resource_server:
+        public_key: '%env(resolve:OAUTH_PUBLIC_KEY)%'
+    scopes:
+        available: ['email','profile','api']
+        default: ['email']
+    persistence:
+        doctrine: null
+
+when@test:
+    league_oauth2_server:
+        persistence:
+            in_memory: null

config/packages/nyholm_psr7.yaml

@@ -0,0 +1,11 @@
+services:
+    # Register nyholm/psr7 services for autowiring with PSR-17 (HTTP factories)
+    Psr\Http\Message\RequestFactoryInterface: '@nyholm.psr7.psr17_factory'
+    Psr\Http\Message\ResponseFactoryInterface: '@nyholm.psr7.psr17_factory'
+    Psr\Http\Message\ServerRequestFactoryInterface: '@nyholm.psr7.psr17_factory'
+    Psr\Http\Message\StreamFactoryInterface: '@nyholm.psr7.psr17_factory'
+    Psr\Http\Message\UploadedFileFactoryInterface: '@nyholm.psr7.psr17_factory'
+    Psr\Http\Message\UriFactoryInterface: '@nyholm.psr7.psr17_factory'
+
+    nyholm.psr7.psr17_factory:
+        class: Nyholm\Psr7\Factory\Psr17Factory

config/packages/security.yaml

@@ -12,12 +12,14 @@ security:
         dev:
             pattern: ^/(_(profiler|wdt)|css|images|js)/
             security: false
+        api_token:
+            pattern: ^/token$
+            security: false
         api:
-            lazy: true
-            stateless: true
             pattern: ^/api
-            custom_authenticator:
-                - App\Security\ApiKeyAuthenticator
+            security: true
+            stateless: true
+            oauth2: true
         main:
             lazy: true
             provider: app_user_provider
@@ -30,7 +32,7 @@ security:
     # Easy way to control access for large sections of your site
     # Note: Only the *first* access control that matches will be used
     access_control:
-        - { path: ^/api, roles: ROLE_API }
+        - { path: ^/authorize, roles: IS_AUTHENTICATED_REMEMBERED }
 
 when@test:
     security:

config/routes/league_oauth2_server.yaml

@@ -0,0 +1,3 @@
+league_oauth2_server:
+    resource: '@LeagueOAuth2ServerBundle/config/routes.php'
+    type: php

config/services.yaml

@@ -27,10 +27,6 @@ services:
             - '../src/Entity/'
             - '../src/Kernel.php'
 
-    App\Security\ApiKeyAuthenticator:
-        arguments:
-            $apiKeys: '%env(csv:API_KEYS)%'
-
     App\BusProNet\ApiClient:
         arguments:
             $logger: '@monolog.logger.bpn'