กำหนด Authentication จำกัดการเข้าถึง API ใน CodeIgniter 4

<?php namespace App\Filters;
 
use CodeIgniter\HTTP\RequestInterface;
use CodeIgniter\HTTP\ResponseInterface;
use CodeIgniter\Filters\FilterInterface;

class AuthApi implements FilterInterface
{
    public function before(RequestInterface $request, $arguments = null)
    {
        echo "test";
    }
 
    //--------------------------------------------------------------------
 
    public function after(RequestInterface $request, ResponseInterface $response, $arguments = null)
    {
        // Do something here
    }
}

public $aliases = [
	'csrf'     => \CodeIgniter\Filters\CSRF::class,
	'toolbar'  => \CodeIgniter\Filters\DebugToolbar::class,
	'honeypot' => \CodeIgniter\Filters\Honeypot::class,
	'authApi' => \App\Filters\AuthApi::class,
];

$routes->resource('api/users',['controller' =>'Api\Users','filter' => 'authApi']);

$response = service('response');

public function before(RequestInterface $request, $arguments = null)
{
	$response = service('response');
	$data = [
		"status" => 401,
		"error" => 401,
		"messages" => [
			"error"  => "Unauthorized"
		]
	];
	return $response->setStatusCode(401)->setJSON($data);					
}

public function before(RequestInterface $request, $arguments = null)
{
	$valid_passwords = [
		"admin" => "test"
	];
	$valid_users = array_keys($valid_passwords);
	$user = $request->getServer('PHP_AUTH_USER');
	$pass = $request->getServer('PHP_AUTH_PW');
	$validated = (in_array($user, $valid_users)) && ($pass == $valid_passwords[$user]);
	if (!$validated) {		
		$response = service('response');
		$data = [
			"status" => 401,
			"error" => 401,
			"messages" => [
				"error"  => "Unauthorized"
			]
		];
		return $response->setStatusCode(401)->setJSON($data);		
	}
}

echo base64_encode("admin:test");
// YWRtaW46dGVzdA==

echo base64_encode("admin@localhost.com:6h4hi3KpMvvFJYPzhUtgMTUQ8qk96fQB");

composer require firebase/php-jwt

<?php
use \Firebase\JWT\JWT;

$key = "secret_key";
$payload =[
    "iss" => "http://example.org",  // ผู้ออก
    "aud" => "http://example.com", // ผู้รับ
    "iat" => 1356999524, // เวลาออก timestamp
    "nbf" => 1357000000 // เวลาห้าม process ก่อน	
];

$jwt = JWT::encode($payload, $key); // ได้ค่า token
?>

$payload =[
    "iss" => "http://example.org",  // ผู้ออก
    "sub" => "user id", // หรือข้อมูล ที่เราอยากใช้งาน
    "iat" => 1356999524, // เวลาออก timestamp
    "exp" => 1356987454 // เวลาหมดอายุ Token
];

<?php
use \Firebase\JWT\JWT;

$key = "secret_key";
$payload =[
    "iss" => "https://www.mysslweb.com",  // ผู้ออก
    "sub" => "admin@mysslweb.com", // ข้อมูล
    "iat" => time(), // เวลาออก timestamp
    "exp" => time()+300 // เวลาหมดอายุ 5 นาที
];
$jwt = JWT::encode($payload, $key); // ได้ค่า token		
echo $jwt; 
?>

Bearer xxx

<?php namespace App\Filters;
 
use CodeIgniter\HTTP\RequestInterface;
use CodeIgniter\HTTP\ResponseInterface;
use CodeIgniter\Filters\FilterInterface;

use \Firebase\JWT\JWT;
use Firebase\JWT\ExpiredException;
use Exception;

class AuthApi implements FilterInterface
{
    public function before(RequestInterface $request, $arguments = null)
    {
		$key = "secret_key";
		list(,$jwt) = explode(" ",$request->getHeaderLine('Authorization'));				
		try {
			$decoded = JWT::decode($jwt, $key, array('HS256'));
		} catch (ExpiredException $e) {
			$response = service('response');
			$data = [
				"status" => 401,
				"error" => 401,
				"messages" => [
					"error"  => "Token expired"
				]
			];
			return $response->setStatusCode(401)->setJSON($data);				
		} catch (Exception $e){
			$response = service('response');
			$data = [
				"status" => 401,
				"error" => 401,
				"messages" => [
					"error"  => "Unauthorized"
				]
			];
			return $response->setStatusCode(401)->setJSON($data);		
		}
    }
 
    //--------------------------------------------------------------------
 
    public function after(RequestInterface $request, ResponseInterface $response, $arguments = null)
    {
        // Do something here
    }
}