welcome back to dyb-tech

2024-05-18 02:28:01 +02:00
parent 9513cdba09
commit 9f30bc98c7
6149 changed files with 668407 additions and 0 deletions
@@ -0,0 +1,158 @@
+<?php
+
+namespace Lexik\Bundle\JWTAuthenticationBundle\Security\Authentication\Provider;
+
+use Lexik\Bundle\JWTAuthenticationBundle\Event\JWTAuthenticatedEvent;
+use Lexik\Bundle\JWTAuthenticationBundle\Events;
+use Lexik\Bundle\JWTAuthenticationBundle\Exception\JWTDecodeFailureException;
+use Lexik\Bundle\JWTAuthenticationBundle\Security\Authentication\Token\JWTUserToken;
+use Lexik\Bundle\JWTAuthenticationBundle\Security\Authenticator\JWTAuthenticator;
+use Lexik\Bundle\JWTAuthenticationBundle\Services\JWTManagerInterface;
+use Symfony\Component\Security\Core\Authentication\Provider\AuthenticationProviderInterface;
+use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
+use Symfony\Component\Security\Core\Exception\AuthenticationException;
+use Symfony\Component\Security\Core\User\UserInterface;
+use Symfony\Component\Security\Core\User\UserProviderInterface;
+use Symfony\Contracts\EventDispatcher\EventDispatcherInterface;
+
+/**
+ * JWTProvider.
+ *
+ * @author Nicolas Cabot <n.cabot@lexik.fr>
+ *
+ * @deprecated since 2.0, will be removed in 3.0. See
+ *             {@link JWTAuthenticator} instead
+ */
+class JWTProvider implements AuthenticationProviderInterface
+{
+    /**
+     * @var UserProviderInterface
+     */
+    protected $userProvider;
+
+    /**
+     * @var JWTManagerInterface
+     */
+    protected $jwtManager;
+
+    /**
+     * @var EventDispatcherInterface
+     */
+    protected $dispatcher;
+
+    /**
+     * @var string
+     */
+    protected $userIdentityField;
+
+    /**
+     * @var string
+     */
+    private $userIdClaim;
+
+    /**
+     * @param string $userIdClaim
+     */
+    public function __construct(
+        UserProviderInterface $userProvider,
+        JWTManagerInterface $jwtManager,
+        EventDispatcherInterface $dispatcher,
+        $userIdClaim
+    ) {
+        @trigger_error(sprintf('The "%s" class is deprecated since version 2.0 and will be removed in 3.0. See "%s" instead.', self::class, JWTTokenAuthenticator::class), E_USER_DEPRECATED);
+
+        $this->userProvider = $userProvider;
+        $this->jwtManager = $jwtManager;
+        $this->dispatcher = $dispatcher;
+        $this->userIdentityField = 'username';
+        $this->userIdClaim = $userIdClaim;
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    public function authenticate(TokenInterface $token)
+    {
+        try {
+            if (!$payload = $this->jwtManager->decode($token)) {
+                throw $this->createAuthenticationException();
+            }
+        } catch (JWTDecodeFailureException $e) {
+            throw $this->createAuthenticationException($e);
+        }
+
+        $user = $this->getUserFromPayload($payload);
+
+        $authToken = new JWTUserToken($user->getRoles());
+        $authToken->setUser($user);
+        $authToken->setRawToken($token->getCredentials());
+
+        $event = new JWTAuthenticatedEvent($payload, $authToken);
+        $this->dispatcher->dispatch($event, Events::JWT_AUTHENTICATED);
+
+        return $authToken;
+    }
+
+    /**
+     * Load user from payload, using username by default.
+     * Override this to load by another property.
+     *
+     * @return UserInterface
+     */
+    protected function getUserFromPayload(array $payload)
+    {
+        if (!isset($payload[$this->userIdClaim])) {
+            throw $this->createAuthenticationException();
+        }
+
+        if (method_exists($this->userProvider, 'loadUserByIdentifier')) {
+            return $this->userProvider->loadUserByIdentifier($payload[$this->userIdClaim]);
+        }
+
+        return $this->userProvider->loadUserByUsername($payload[$this->userIdClaim]);
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    public function supports(TokenInterface $token)
+    {
+        return $token instanceof JWTUserToken;
+    }
+
+    /**
+     * @return string
+     */
+    public function getUserIdentityField()
+    {
+        return $this->userIdentityField;
+    }
+
+    /**
+     * @param string $userIdentityField
+     */
+    public function setUserIdentityField($userIdentityField)
+    {
+        $this->userIdentityField = $userIdentityField;
+    }
+
+    /**
+     * @return string
+     */
+    public function getUserIdClaim()
+    {
+        return $this->userIdClaim;
+    }
+
+    /**
+     * @param JWTDecodeFailureException $previous
+     *
+     * @return AuthenticationException
+     */
+    private function createAuthenticationException(JWTDecodeFailureException $previous = null)
+    {
+        $message = (null === $previous) ? 'Invalid JWT Token' : $previous->getMessage();
+
+        return new AuthenticationException($message, 401, $previous);
+    }
+}
@@ -0,0 +1,97 @@
+<?php
+
+namespace Lexik\Bundle\JWTAuthenticationBundle\Security\Authentication\Token;
+
+use Symfony\Component\Security\Core\Authentication\Token\AbstractToken;
+use Symfony\Component\Security\Core\User\UserInterface;
+use Symfony\Component\Security\Guard\Token\GuardTokenInterface;
+
+if (interface_exists(GuardTokenInterface::class)) {
+    /**
+     * Compatibility layer ensuring the guard token interface is applied when available.
+     *
+     * @internal
+     */
+    abstract class JWTCompatUserToken extends AbstractToken implements GuardTokenInterface
+    {
+    }
+} else {
+    /**
+     * @internal
+     */
+    abstract class JWTCompatUserToken extends AbstractToken
+    {
+    }
+}
+
+/**
+ * JWTUserToken.
+ *
+ * @author Nicolas Cabot <n.cabot@lexik.fr>
+ */
+class JWTUserToken extends JWTCompatUserToken
+{
+    /**
+     * @var string
+     */
+    protected $rawToken;
+
+    /**
+     * @var string
+     */
+    protected $providerKey;
+
+    /**
+     * {@inheritdoc}
+     */
+    public function __construct(array $roles = [], UserInterface $user = null, $rawToken = null, $firewallName = null)
+    {
+        parent::__construct($roles);
+
+        if ($user) {
+            $this->setUser($user);
+        }
+
+        $this->setRawToken($rawToken);
+
+        if (method_exists($this, 'setAuthenticated')) {
+            $this->setAuthenticated(true);
+        }
+
+        $this->providerKey = $firewallName;
+    }
+
+    /**
+     * @param string $rawToken
+     */
+    public function setRawToken($rawToken)
+    {
+        $this->rawToken = $rawToken;
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    public function getCredentials()
+    {
+        return $this->rawToken;
+    }
+
+    /**
+     * @deprecated since 2.10, use getFirewallName() instead
+     */
+    public function getProviderKey()
+    {
+        @trigger_error(sprintf('The "%s" method is deprecated since version 2.10 and will be removed in 3.0. Use "%s::getFirewallName()" instead.', __METHOD__, self::class), E_USER_DEPRECATED);
+
+        return $this->getFirewallName();
+    }
+
+    /**
+     * @return string
+     */
+    public function getFirewallName()
+    {
+        return $this->providerKey;
+    }
+}
@@ -0,0 +1,55 @@
+<?php
+
+namespace Lexik\Bundle\JWTAuthenticationBundle\Security\Authentication\Token;
+
+use Symfony\Component\Security\Guard\Token\PreAuthenticationGuardToken;
+
+/**
+ * PreAuthenticationJWTUserToken.
+ *
+ * @author Robin Chalas <robin.chalas@gmail.com>
+ */
+final class PreAuthenticationJWTUserToken extends PreAuthenticationGuardToken implements PreAuthenticationJWTUserTokenInterface
+{
+    /**
+     * @var string
+     */
+    private $rawToken;
+
+    /**
+     * @var array
+     */
+    private $payload;
+
+    /**
+     * @param string $rawToken
+     */
+    public function __construct($rawToken)
+    {
+        $this->rawToken = $rawToken;
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    public function getCredentials()
+    {
+        return $this->rawToken;
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    public function setPayload(array $payload)
+    {
+        $this->payload = $payload;
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    public function getPayload()
+    {
+        return $this->payload;
+    }
+}
@@ -0,0 +1,18 @@
+<?php
+
+namespace Lexik\Bundle\JWTAuthenticationBundle\Security\Authentication\Token;
+
+use Symfony\Component\Security\Guard\Token\GuardTokenInterface;
+
+interface PreAuthenticationJWTUserTokenInterface extends GuardTokenInterface
+{
+    /**
+     * @return void
+     */
+    public function setPayload(array $payload);
+
+    /**
+     * @return mixed
+     */
+    public function getPayload();
+}
@@ -0,0 +1,43 @@
+<?php
+
+namespace Lexik\Bundle\JWTAuthenticationBundle\Security\Authenticator;
+
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\Security\Http\Authenticator\AuthenticatorInterface;
+use Symfony\Component\Security\Http\Authenticator\Passport\Passport;
+use Symfony\Component\Security\Http\Authenticator\Passport\PassportInterface;
+
+$r = new \ReflectionMethod(AuthenticatorInterface::class, 'authenticate');
+
+if (!trait_exists(ForwardCompatAuthenticatorTrait::class)) {
+    if ($r->hasReturnType() && Passport::class === $r->getReturnType()->getName()) {
+        eval('
+        namespace Lexik\Bundle\JWTAuthenticationBundle\Security\Authenticator;
+        
+        use Symfony\Component\HttpFoundation\Request;
+        use Symfony\Component\Security\Http\Authenticator\Passport\Passport;
+
+        /**
+         * @internal
+         */
+        trait ForwardCompatAuthenticatorTrait
+        {
+            public function authenticate(Request $request): Passport
+            {
+                return $this->doAuthenticate($request);
+            }
+        }
+    ');
+    } else {
+        /**
+         * @internal
+         */
+        trait ForwardCompatAuthenticatorTrait
+        {
+            public function authenticate(Request $request): PassportInterface
+            {
+                return $this->doAuthenticate($request);
+            }
+        }
+    }
+}
@@ -0,0 +1,278 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Lexik\Bundle\JWTAuthenticationBundle\Security\Authenticator;
+
+use Lexik\Bundle\JWTAuthenticationBundle\Event\JWTAuthenticatedEvent;
+use Lexik\Bundle\JWTAuthenticationBundle\Event\JWTExpiredEvent;
+use Lexik\Bundle\JWTAuthenticationBundle\Event\JWTInvalidEvent;
+use Lexik\Bundle\JWTAuthenticationBundle\Event\JWTNotFoundEvent;
+use Lexik\Bundle\JWTAuthenticationBundle\Events;
+use Lexik\Bundle\JWTAuthenticationBundle\Exception\ExpiredTokenException;
+use Lexik\Bundle\JWTAuthenticationBundle\Exception\InvalidPayloadException;
+use Lexik\Bundle\JWTAuthenticationBundle\Exception\InvalidTokenException;
+use Lexik\Bundle\JWTAuthenticationBundle\Exception\JWTDecodeFailureException;
+use Lexik\Bundle\JWTAuthenticationBundle\Exception\MissingTokenException;
+use Lexik\Bundle\JWTAuthenticationBundle\Response\JWTAuthenticationFailureResponse;
+use Lexik\Bundle\JWTAuthenticationBundle\Security\Authenticator\Token\JWTPostAuthenticationToken;
+use Lexik\Bundle\JWTAuthenticationBundle\Security\User\PayloadAwareUserProviderInterface;
+use Lexik\Bundle\JWTAuthenticationBundle\Services\JWTTokenManagerInterface;
+use Lexik\Bundle\JWTAuthenticationBundle\TokenExtractor\TokenExtractorInterface;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
+use Symfony\Component\Security\Core\Exception\AuthenticationException;
+use Symfony\Component\Security\Core\Exception\UsernameNotFoundException;
+use Symfony\Component\Security\Core\Exception\UserNotFoundException;
+use Symfony\Component\Security\Core\User\ChainUserProvider;
+use Symfony\Component\Security\Core\User\UserInterface;
+use Symfony\Component\Security\Core\User\UserProviderInterface;
+use Symfony\Component\Security\Http\Authenticator\AbstractAuthenticator;
+use Symfony\Component\Security\Http\Authenticator\Passport\Badge\UserBadge;
+use Symfony\Component\Security\Http\Authenticator\Passport\Passport;
+use Symfony\Component\Security\Http\Authenticator\Passport\PassportInterface;
+use Symfony\Component\Security\Http\Authenticator\Passport\SelfValidatingPassport;
+use Symfony\Component\Security\Http\EntryPoint\AuthenticationEntryPointInterface;
+use Symfony\Contracts\EventDispatcher\EventDispatcherInterface;
+use Symfony\Contracts\Translation\TranslatorInterface;
+
+class JWTAuthenticator extends AbstractAuthenticator implements AuthenticationEntryPointInterface
+{
+    use ForwardCompatAuthenticatorTrait;
+
+    /**
+     * @var TokenExtractorInterface
+     */
+    private $tokenExtractor;
+
+    /**
+     * @var JWTTokenManagerInterface
+     */
+    private $jwtManager;
+
+    /**
+     * @var EventDispatcherInterface
+     */
+    private $eventDispatcher;
+
+    /**
+     * @var UserProviderInterface
+     */
+    private $userProvider;
+
+    /**
+     * @var TranslatorInterface|null
+     */
+    private $translator;
+
+    public function __construct(
+        JWTTokenManagerInterface $jwtManager,
+        EventDispatcherInterface $eventDispatcher,
+        TokenExtractorInterface $tokenExtractor,
+        UserProviderInterface $userProvider,
+        TranslatorInterface $translator = null
+    ) {
+        $this->tokenExtractor = $tokenExtractor;
+        $this->jwtManager = $jwtManager;
+        $this->eventDispatcher = $eventDispatcher;
+        $this->userProvider = $userProvider;
+        $this->translator = $translator;
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    public function start(Request $request, AuthenticationException $authException = null): Response
+    {
+        $exception = new MissingTokenException('JWT Token not found', 0, $authException);
+        $event = new JWTNotFoundEvent($exception, new JWTAuthenticationFailureResponse($exception->getMessageKey()), $request);
+
+        $this->eventDispatcher->dispatch($event, Events::JWT_NOT_FOUND);
+
+        return $event->getResponse();
+    }
+
+    public function supports(Request $request): ?bool
+    {
+        return false !== $this->getTokenExtractor()->extract($request);
+    }
+
+    /**
+     * @return Passport
+     */
+    public function doAuthenticate(Request $request) /*: Passport */
+    {
+        $token = $this->getTokenExtractor()->extract($request);
+        if ($token === false) {
+            throw new \LogicException('Unable to extract a JWT token from the request. Also, make sure to call `supports()` before `authenticate()` to get a proper client error.');
+        }
+
+        try {
+            if (!$payload = $this->jwtManager->parse($token)) {
+                throw new InvalidTokenException('Invalid JWT Token');
+            }
+        } catch (JWTDecodeFailureException $e) {
+            if (JWTDecodeFailureException::EXPIRED_TOKEN === $e->getReason()) {
+                throw new ExpiredTokenException();
+            }
+
+            throw new InvalidTokenException('Invalid JWT Token', 0, $e);
+        }
+
+        $idClaim = $this->jwtManager->getUserIdClaim();
+        if (!isset($payload[$idClaim])) {
+            throw new InvalidPayloadException($idClaim);
+        }
+
+        $passport = new SelfValidatingPassport(
+            new UserBadge(
+                (string)$payload[$idClaim],
+                function ($userIdentifier) use ($payload) {
+                    return $this->loadUser($payload, $userIdentifier);
+                }
+            )
+        );
+
+        $passport->setAttribute('payload', $payload);
+        $passport->setAttribute('token', $token);
+
+        return $passport;
+    }
+
+    public function onAuthenticationSuccess(Request $request, TokenInterface $token, string $firewallName): ?Response
+    {
+        return null;
+    }
+
+    public function onAuthenticationFailure(Request $request, AuthenticationException $exception): ?Response
+    {
+        $errorMessage = strtr($exception->getMessageKey(), $exception->getMessageData());
+        if (null !== $this->translator) {
+            $errorMessage = $this->translator->trans($exception->getMessageKey(), $exception->getMessageData(), 'security');
+        }
+        $response = new JWTAuthenticationFailureResponse($errorMessage);
+
+        if ($exception instanceof ExpiredTokenException) {
+            $event = new JWTExpiredEvent($exception, $response, $request);
+            $eventName = Events::JWT_EXPIRED;
+        } else {
+            $event = new JWTInvalidEvent($exception, $response, $request);
+            $eventName = Events::JWT_INVALID;
+        }
+
+        $this->eventDispatcher->dispatch($event, $eventName);
+
+        return $event->getResponse();
+    }
+
+    /**
+     * Gets the token extractor to be used for retrieving a JWT token in the
+     * current request.
+     *
+     * Override this method for adding/removing extractors to the chain one or
+     * returning a different {@link TokenExtractorInterface} implementation.
+     */
+    protected function getTokenExtractor(): TokenExtractorInterface
+    {
+        return $this->tokenExtractor;
+    }
+
+    /**
+     * Gets the jwt manager.
+     */
+    protected function getJwtManager(): JWTTokenManagerInterface
+    {
+        return $this->jwtManager;
+    }
+
+    /**
+     * Gets the event dispatcher.
+     */
+    protected function getEventDispatcher(): EventDispatcherInterface
+    {
+        return $this->eventDispatcher;
+    }
+
+    /**
+     * Gets the user provider.
+     */
+    protected function getUserProvider(): UserProviderInterface
+    {
+        return $this->userProvider;
+    }
+
+    /**
+     * Loads the user to authenticate.
+     *
+     * @param array                 $payload      The token payload
+     * @param string                $identity     The key from which to retrieve the user "identifier"
+     */
+    protected function loadUser(array $payload, string $identity): UserInterface
+    {
+        if ($this->userProvider instanceof PayloadAwareUserProviderInterface) {
+            if (method_exists($this->userProvider, 'loadUserByIdentifierAndPayload')) {
+                return $this->userProvider->loadUserByIdentifierAndPayload($identity, $payload);
+            } else {
+                return $this->userProvider->loadUserByUsernameAndPayload($identity, $payload);
+            }
+        }
+
+        if ($this->userProvider instanceof ChainUserProvider) {
+            foreach ($this->userProvider->getProviders() as $provider) {
+                try {
+                    if ($provider instanceof PayloadAwareUserProviderInterface) {
+                        if (method_exists(PayloadAwareUserProviderInterface::class, 'loadUserByIdentifierAndPayload')) {
+                            return $provider->loadUserByIdentifierAndPayload($identity, $payload);
+                        } else {
+                            return $provider->loadUserByUsernameAndPayload($identity, $payload);
+                        }
+                    }
+
+                    return $provider->loadUserByIdentifier($identity);
+                    // More generic call to catch both UsernameNotFoundException for SF<5.3 and new UserNotFoundException
+                } catch (AuthenticationException $e) {
+                    // try next one
+                }
+            }
+
+            if (!class_exists(UserNotFoundException::class)) {
+                $ex = new UsernameNotFoundException(sprintf('There is no user with username "%s".', $identity));
+                $ex->setUsername($identity);
+            } else {
+                $ex = new UserNotFoundException(sprintf('There is no user with identifier "%s".', $identity));
+                $ex->setUserIdentifier($identity);
+            }
+
+            throw $ex;
+        }
+
+        if (method_exists($this->userProvider, 'loadUserByIdentifier')) {
+            return $this->userProvider->loadUserByIdentifier($identity);
+        } else {
+            return $this->userProvider->loadUserByUsername($identity);
+        }
+    }
+
+    public function createAuthenticatedToken(PassportInterface $passport, string $firewallName): TokenInterface
+    {
+        if (!$passport instanceof Passport) {
+            throw new \LogicException(sprintf('Expected "%s" but got "%s".', Passport::class, get_debug_type($passport)));
+        }
+
+        $token = new JWTPostAuthenticationToken($passport->getUser(), $firewallName, $passport->getUser()->getRoles(), $passport->getAttribute('token'));
+
+        $this->eventDispatcher->dispatch(new JWTAuthenticatedEvent($passport->getAttribute('payload'), $token), Events::JWT_AUTHENTICATED);
+
+        return $token;
+    }
+
+    public function createToken(Passport $passport, string $firewallName): TokenInterface
+    {
+        $token = new JWTPostAuthenticationToken($passport->getUser(), $firewallName, $passport->getUser()->getRoles(), $passport->getAttribute('token'));
+
+        $this->eventDispatcher->dispatch(new JWTAuthenticatedEvent($passport->getAttribute('payload'), $token), Events::JWT_AUTHENTICATED);
+
+        return $token;
+    }
+}
@@ -0,0 +1,26 @@
+<?php
+
+namespace Lexik\Bundle\JWTAuthenticationBundle\Security\Authenticator\Token;
+
+use Symfony\Component\Security\Core\User\UserInterface;
+use Symfony\Component\Security\Http\Authenticator\Token\PostAuthenticationToken;
+
+class JWTPostAuthenticationToken extends PostAuthenticationToken
+{
+    private $token;
+
+    public function __construct(UserInterface $user, string $firewallName, array $roles, string $token)
+    {
+        parent::__construct($user, $firewallName, $roles);
+
+        $this->token = $token;
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    public function getCredentials(): string
+    {
+        return $this->token;
+    }
+}
@@ -0,0 +1,127 @@
+<?php
+
+namespace Lexik\Bundle\JWTAuthenticationBundle\Security\Firewall;
+
+use Lexik\Bundle\JWTAuthenticationBundle\Event\JWTInvalidEvent;
+use Lexik\Bundle\JWTAuthenticationBundle\Event\JWTNotFoundEvent;
+use Lexik\Bundle\JWTAuthenticationBundle\Events;
+use Lexik\Bundle\JWTAuthenticationBundle\Response\JWTAuthenticationFailureResponse;
+use Lexik\Bundle\JWTAuthenticationBundle\Security\Authentication\Token\JWTUserToken;
+use Lexik\Bundle\JWTAuthenticationBundle\Security\Authenticator\JWTAuthenticator;
+use Lexik\Bundle\JWTAuthenticationBundle\TokenExtractor\TokenExtractorInterface;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpKernel\Event\RequestEvent;
+use Symfony\Component\Security\Core\Authentication\AuthenticationManagerInterface;
+use Symfony\Component\Security\Core\Authentication\Token\Storage\TokenStorageInterface;
+use Symfony\Component\Security\Core\Exception\AuthenticationException;
+use Symfony\Contracts\EventDispatcher\EventDispatcherInterface;
+
+/**
+ * JWTListener.
+ *
+ * @author Nicolas Cabot <n.cabot@lexik.fr>
+ * @author Robin Chalas  <robin.chalas@gmail.com>
+ *
+ * @deprecated since 2.0, will be removed in 3.0. See
+ *             {@link JWTAuthenticator} instead
+ */
+class JWTListener
+{
+    /**
+     * @var TokenStorageInterface
+     */
+    protected $tokenStorage;
+
+    /**
+     * @var AuthenticationManagerInterface
+     */
+    protected $authenticationManager;
+
+    /**
+     * @var EventDispatcherInterface
+     */
+    protected $dispatcher;
+
+    /**
+     * @var array
+     */
+    protected $config;
+
+    /**
+     * @var array
+     */
+    protected $tokenExtractors;
+
+    public function __construct(
+        TokenStorageInterface $tokenStorage,
+        AuthenticationManagerInterface $authenticationManager,
+        array $config = []
+    ) {
+        @trigger_error(sprintf('The "%s" class is deprecated since version 2.0 and will be removed in 3.0. See "%s" instead.', self::class, JWTAuthenticator::class), E_USER_DEPRECATED);
+
+        $this->tokenStorage = $tokenStorage;
+        $this->authenticationManager = $authenticationManager;
+        $this->config = array_merge(['throw_exceptions' => false], $config);
+        $this->tokenExtractors = [];
+    }
+
+    public function __invoke(RequestEvent $event)
+    {
+        $requestToken = $this->getRequestToken($event->getRequest());
+
+        if (null === $requestToken) {
+            $jwtNotFoundEvent = new JWTNotFoundEvent();
+            $this->dispatcher->dispatch($jwtNotFoundEvent, Events::JWT_NOT_FOUND);
+
+            if ($response = $jwtNotFoundEvent->getResponse()) {
+                $event->setResponse($response);
+            }
+
+            return;
+        }
+
+        try {
+            $token = new JWTUserToken();
+            $token->setRawToken($requestToken);
+
+            $authToken = $this->authenticationManager->authenticate($token);
+            $this->tokenStorage->setToken($authToken);
+
+            return;
+        } catch (AuthenticationException $failed) {
+            if ($this->config['throw_exceptions']) {
+                throw $failed;
+            }
+
+            $response = new JWTAuthenticationFailureResponse($failed->getMessage());
+
+            $jwtInvalidEvent = new JWTInvalidEvent($failed, $response, $event->getRequest());
+            $this->dispatcher->dispatch($jwtInvalidEvent, Events::JWT_INVALID);
+
+            $event->setResponse($jwtInvalidEvent->getResponse());
+        }
+    }
+
+    public function addTokenExtractor(TokenExtractorInterface $extractor)
+    {
+        $this->tokenExtractors[] = $extractor;
+    }
+
+    public function setDispatcher(EventDispatcherInterface $dispatcher)
+    {
+        $this->dispatcher = $dispatcher;
+    }
+
+    /**
+     * @return string
+     */
+    protected function getRequestToken(Request $request)
+    {
+        /** @var TokenExtractorInterface $tokenExtractor */
+        foreach ($this->tokenExtractors as $tokenExtractor) {
+            if (($token = $tokenExtractor->extract($request))) {
+                return $token;
+            }
+        }
+    }
+}
@@ -0,0 +1,326 @@
+<?php
+
+namespace Lexik\Bundle\JWTAuthenticationBundle\Security\Guard;
+
+use Lexik\Bundle\JWTAuthenticationBundle\Event\JWTAuthenticatedEvent;
+use Lexik\Bundle\JWTAuthenticationBundle\Event\JWTExpiredEvent;
+use Lexik\Bundle\JWTAuthenticationBundle\Event\JWTInvalidEvent;
+use Lexik\Bundle\JWTAuthenticationBundle\Event\JWTNotFoundEvent;
+use Lexik\Bundle\JWTAuthenticationBundle\Events;
+use Lexik\Bundle\JWTAuthenticationBundle\Exception\ExpiredTokenException;
+use Lexik\Bundle\JWTAuthenticationBundle\Exception\InvalidPayloadException;
+use Lexik\Bundle\JWTAuthenticationBundle\Exception\InvalidTokenException;
+use Lexik\Bundle\JWTAuthenticationBundle\Exception\JWTDecodeFailureException;
+use Lexik\Bundle\JWTAuthenticationBundle\Exception\MissingTokenException;
+use Lexik\Bundle\JWTAuthenticationBundle\Exception\UserNotFoundException;
+use Lexik\Bundle\JWTAuthenticationBundle\Response\JWTAuthenticationFailureResponse;
+use Lexik\Bundle\JWTAuthenticationBundle\Security\Authentication\Token\JWTUserToken;
+use Lexik\Bundle\JWTAuthenticationBundle\Security\Authentication\Token\PreAuthenticationJWTUserToken;
+use Lexik\Bundle\JWTAuthenticationBundle\Security\Authentication\Token\PreAuthenticationJWTUserTokenInterface;
+use Lexik\Bundle\JWTAuthenticationBundle\Security\User\PayloadAwareUserProviderInterface;
+use Lexik\Bundle\JWTAuthenticationBundle\Services\JWTTokenManagerInterface;
+use Lexik\Bundle\JWTAuthenticationBundle\TokenExtractor\TokenExtractorInterface;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\Security\Core\Authentication\Token\Storage\TokenStorageInterface;
+use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
+use Symfony\Component\Security\Core\Exception\AuthenticationException;
+use Symfony\Component\Security\Core\Exception\UsernameNotFoundException;
+use Symfony\Component\Security\Core\Exception\UserNotFoundException as SecurityUserNotFoundException;
+use Symfony\Component\Security\Core\User\ChainUserProvider;
+use Symfony\Component\Security\Core\User\UserInterface;
+use Symfony\Component\Security\Core\User\UserProviderInterface;
+use Symfony\Component\Security\Guard\AuthenticatorInterface;
+use Symfony\Contracts\EventDispatcher\EventDispatcherInterface;
+use Symfony\Contracts\Translation\TranslatorInterface;
+
+/**
+ * JWTTokenAuthenticator (Guard implementation).
+ *
+ * @see http://knpuniversity.com/screencast/symfony-rest4/jwt-guard-authenticator
+ *
+ * @author Nicolas Cabot <n.cabot@lexik.fr>
+ * @author Robin Chalas <robin.chalas@gmail.com>
+ */
+class JWTTokenAuthenticator implements AuthenticatorInterface
+{
+    /**
+     * @var JWTTokenManagerInterface
+     */
+    private $jwtManager;
+
+    /**
+     * @var EventDispatcherInterface
+     */
+    private $dispatcher;
+
+    /**
+     * @var TokenExtractorInterface
+     */
+    private $tokenExtractor;
+
+    /**
+     * @var TokenStorageInterface
+     */
+    private $preAuthenticationTokenStorage;
+
+    /**
+     * @var TranslatorInterface
+     */
+    private $translator;
+
+    public function __construct(
+        JWTTokenManagerInterface $jwtManager,
+        EventDispatcherInterface $dispatcher,
+        TokenExtractorInterface $tokenExtractor,
+        TokenStorageInterface $preAuthenticationTokenStorage,
+        TranslatorInterface $translator = null
+    ) {
+        $this->jwtManager = $jwtManager;
+        $this->dispatcher = $dispatcher;
+        $this->tokenExtractor = $tokenExtractor;
+        $this->preAuthenticationTokenStorage = $preAuthenticationTokenStorage;
+        $this->translator = $translator;
+    }
+
+    public function supports(Request $request)
+    {
+        return false !== $this->getTokenExtractor()->extract($request);
+    }
+
+    /**
+     * Returns a decoded JWT token extracted from a request.
+     *
+     * {@inheritdoc}
+     *
+     * @return PreAuthenticationJWTUserTokenInterface
+     *
+     * @throws InvalidTokenException If an error occur while decoding the token
+     * @throws ExpiredTokenException If the request token is expired
+     */
+    public function getCredentials(Request $request)
+    {
+        $tokenExtractor = $this->getTokenExtractor();
+
+        if (!$tokenExtractor instanceof TokenExtractorInterface) {
+            throw new \RuntimeException(sprintf('Method "%s::getTokenExtractor()" must return an instance of "%s".', self::class, TokenExtractorInterface::class));
+        }
+
+        if (false === ($jsonWebToken = $tokenExtractor->extract($request))) {
+            return;
+        }
+
+        $preAuthToken = new PreAuthenticationJWTUserToken($jsonWebToken);
+
+        try {
+            if (!$payload = $this->jwtManager->decode($preAuthToken)) {
+                throw new InvalidTokenException('Invalid JWT Token');
+            }
+
+            $preAuthToken->setPayload($payload);
+        } catch (JWTDecodeFailureException $e) {
+            if (JWTDecodeFailureException::EXPIRED_TOKEN === $e->getReason()) {
+                $expiredTokenException = new ExpiredTokenException();
+                $expiredTokenException->setToken($preAuthToken);
+                throw $expiredTokenException;
+            }
+
+            throw new InvalidTokenException('Invalid JWT Token', 0, $e);
+        }
+
+        return $preAuthToken;
+    }
+
+    /**
+     * Returns an user object loaded from a JWT token.
+     *
+     * {@inheritdoc}
+     *
+     * @param PreAuthenticationJWTUserTokenInterface $preAuthToken Implementation of the (Security) TokenInterface
+     *
+     * @throws \InvalidArgumentException If preAuthToken is not of the good type
+     * @throws InvalidPayloadException   If the user identity field is not a key of the payload
+     * @throws UserNotFoundException     If no user can be loaded from the given token
+     */
+    public function getUser($preAuthToken, UserProviderInterface $userProvider)
+    {
+        if (!$preAuthToken instanceof PreAuthenticationJWTUserTokenInterface) {
+            throw new \InvalidArgumentException(sprintf('The first argument of the "%s()" method must be an instance of "%s".', __METHOD__, PreAuthenticationJWTUserTokenInterface::class));
+        }
+
+        $payload = $preAuthToken->getPayload();
+        $idClaim = $this->jwtManager->getUserIdClaim();
+
+        if (!isset($payload[$idClaim])) {
+            throw new InvalidPayloadException($idClaim);
+        }
+
+        $user = $this->loadUser($userProvider, $payload, $payload[$idClaim]);
+
+        $this->preAuthenticationTokenStorage->setToken($preAuthToken);
+
+        return $user;
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    public function onAuthenticationFailure(Request $request, AuthenticationException $authException)
+    {
+        $errorMessage = strtr($authException->getMessageKey(), $authException->getMessageData());
+        if (null !== $this->translator) {
+            $errorMessage = $this->translator->trans($authException->getMessageKey(), $authException->getMessageData(), 'security');
+        }
+        $response = new JWTAuthenticationFailureResponse($errorMessage);
+
+        if ($authException instanceof ExpiredTokenException) {
+            $event = new JWTExpiredEvent($authException, $response, $request);
+            $eventName = Events::JWT_EXPIRED;
+        } else {
+            $event = new JWTInvalidEvent($authException, $response, $request);
+            $eventName = Events::JWT_INVALID;
+        }
+
+        $this->dispatcher->dispatch($event, $eventName);
+
+        return $event->getResponse();
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    public function onAuthenticationSuccess(Request $request, TokenInterface $token, $providerKey)
+    {
+        return;
+    }
+
+    /**
+     * {@inheritdoc}
+     *
+     * @return JWTAuthenticationFailureResponse
+     */
+    public function start(Request $request, AuthenticationException $authException = null)
+    {
+        $exception = new MissingTokenException('JWT Token not found', 0, $authException);
+        $event = new JWTNotFoundEvent($exception, new JWTAuthenticationFailureResponse($exception->getMessageKey()), $request);
+
+        $this->dispatcher->dispatch($event, Events::JWT_NOT_FOUND);
+
+        return $event->getResponse();
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    public function checkCredentials($credentials, UserInterface $user)
+    {
+        return true;
+    }
+
+    /**
+     * {@inheritdoc}
+     *
+     * @throws \RuntimeException If there is no pre-authenticated token previously stored
+     */
+    public function createAuthenticatedToken(UserInterface $user, $providerKey)
+    {
+        $preAuthToken = $this->preAuthenticationTokenStorage->getToken();
+
+        if (null === $preAuthToken) {
+            throw new \RuntimeException('Unable to return an authenticated token since there is no pre authentication token.');
+        }
+
+        $authToken = new JWTUserToken($user->getRoles(), $user, $preAuthToken->getCredentials(), $providerKey);
+
+        $this->dispatcher->dispatch(new JWTAuthenticatedEvent($preAuthToken->getPayload(), $authToken), Events::JWT_AUTHENTICATED);
+
+        $this->preAuthenticationTokenStorage->setToken(null);
+
+        return $authToken;
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    public function supportsRememberMe()
+    {
+        return false;
+    }
+
+    /**
+     * Gets the token extractor to be used for retrieving a JWT token in the
+     * current request.
+     *
+     * Override this method for adding/removing extractors to the chain one or
+     * returning a different {@link TokenExtractorInterface} implementation.
+     *
+     * @return TokenExtractorInterface
+     */
+    protected function getTokenExtractor()
+    {
+        return $this->tokenExtractor;
+    }
+
+    /**
+     * @return JWTTokenManagerInterface
+     */
+    protected function getJwtManager()
+    {
+        return $this->jwtManager;
+    }
+
+    /**
+     * @return EventDispatcherInterface
+     */
+    protected function getDispatcher()
+    {
+        return $this->dispatcher;
+    }
+
+    /**
+     * @return TokenStorageInterface
+     */
+    protected function getPreAuthenticationTokenStorage()
+    {
+        return $this->preAuthenticationTokenStorage;
+    }
+
+    /**
+     * Loads the user to authenticate.
+     *
+     * @param UserProviderInterface $userProvider An user provider
+     * @param array                 $payload      The token payload
+     * @param string                $identity     The key from which to retrieve the user "username"
+     *
+     * @return UserInterface
+     */
+    protected function loadUser(UserProviderInterface $userProvider, array $payload, $identity)
+    {
+        $providers = $userProvider instanceof ChainUserProvider ? $userProvider->getProviders() : [$userProvider];
+
+        foreach ($providers as $provider) {
+            try {
+                if ($provider instanceof PayloadAwareUserProviderInterface) {
+                    return $provider->loadUserByUsernameAndPayload($identity, $payload);
+                }
+
+                if (method_exists($provider, 'loadUserByIdentifier')) {
+                    return $provider->loadUserByIdentifier($identity);
+                }
+
+                return $provider->loadUserByUsername($identity);
+            } catch (SecurityUserNotFoundException | UsernameNotFoundException $e) {
+                // try next one
+            }
+        }
+
+        if (class_exists(SecurityUserNotFoundException::class)) {
+            $ex = new SecurityUserNotFoundException(sprintf('There is no user with name "%s".', $identity));
+            $ex->setUserIdentifier($identity);
+        } else {
+            $ex = new UsernameNotFoundException(sprintf('There is no user with name "%s".', $identity));
+            $ex->setUsername($identity);
+        }
+
+        throw $ex;
+    }
+}
@@ -0,0 +1,73 @@
+<?php
+
+namespace Lexik\Bundle\JWTAuthenticationBundle\Security\Http\Authentication;
+
+use Lexik\Bundle\JWTAuthenticationBundle\Event\AuthenticationFailureEvent;
+use Lexik\Bundle\JWTAuthenticationBundle\Events;
+use Lexik\Bundle\JWTAuthenticationBundle\Response\JWTAuthenticationFailureResponse;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\Security\Core\Exception\AuthenticationException;
+use Symfony\Component\Security\Http\Authentication\AuthenticationFailureHandlerInterface;
+use Symfony\Contracts\EventDispatcher\EventDispatcherInterface;
+use Symfony\Contracts\Translation\TranslatorInterface;
+
+/**
+ * AuthenticationFailureHandler.
+ *
+ * @author Dev Lexik <dev@lexik.fr>
+ */
+class AuthenticationFailureHandler implements AuthenticationFailureHandlerInterface
+{
+    /**
+     * @var EventDispatcherInterface
+     */
+    protected $dispatcher;
+
+    /**
+     * @var TranslatorInterface|null
+     */
+    private $translator;
+
+    public function __construct(EventDispatcherInterface $dispatcher, TranslatorInterface $translator = null)
+    {
+        $this->dispatcher = $dispatcher;
+        $this->translator = $translator;
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    public function onAuthenticationFailure(Request $request, AuthenticationException $exception): Response
+    {
+        $errorMessage = strtr($exception->getMessageKey(), $exception->getMessageData());
+        $statusCode = self::mapExceptionCodeToStatusCode($exception->getCode());
+        if ($this->translator) {
+            $errorMessage = $this->translator->trans($exception->getMessageKey(), $exception->getMessageData(), 'security');
+        }
+
+        $event = new AuthenticationFailureEvent(
+            $exception,
+            new JWTAuthenticationFailureResponse($errorMessage, $statusCode),
+            $request
+        );
+
+        $this->dispatcher->dispatch($event, Events::AUTHENTICATION_FAILURE);
+
+        return $event->getResponse();
+    }
+
+    /**
+     * @param string|int $exceptionCode
+     */
+    private static function mapExceptionCodeToStatusCode($exceptionCode): int
+    {
+        $canMapToStatusCode = is_int($exceptionCode)
+            && $exceptionCode >= 400
+            && $exceptionCode < 500;
+
+        return $canMapToStatusCode
+            ? $exceptionCode
+            : Response::HTTP_UNAUTHORIZED;
+    }
+}
@@ -0,0 +1,84 @@
+<?php
+
+namespace Lexik\Bundle\JWTAuthenticationBundle\Security\Http\Authentication;
+
+use Lexik\Bundle\JWTAuthenticationBundle\Event\AuthenticationSuccessEvent;
+use Lexik\Bundle\JWTAuthenticationBundle\Events;
+use Lexik\Bundle\JWTAuthenticationBundle\Response\JWTAuthenticationSuccessResponse;
+use Lexik\Bundle\JWTAuthenticationBundle\Security\Http\Cookie\JWTCookieProvider;
+use Lexik\Bundle\JWTAuthenticationBundle\Services\JWTTokenManagerInterface;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
+use Symfony\Component\Security\Core\User\UserInterface;
+use Symfony\Component\Security\Http\Authentication\AuthenticationSuccessHandlerInterface;
+use Symfony\Contracts\EventDispatcher\EventDispatcherInterface;
+
+/**
+ * AuthenticationSuccessHandler.
+ *
+ * @author Dev Lexik <dev@lexik.fr>
+ * @author Robin Chalas <robin.chalas@gmail.com>
+ *
+ * @final
+ */
+class AuthenticationSuccessHandler implements AuthenticationSuccessHandlerInterface
+{
+    private $cookieProviders;
+
+    protected $jwtManager;
+    protected $dispatcher;
+    protected $removeTokenFromBodyWhenCookiesUsed;
+
+    /**
+     * @param iterable|JWTCookieProvider[] $cookieProviders
+     */
+    public function __construct(JWTTokenManagerInterface $jwtManager, EventDispatcherInterface $dispatcher, $cookieProviders = [], bool $removeTokenFromBodyWhenCookiesUsed = true)
+    {
+        $this->jwtManager = $jwtManager;
+        $this->dispatcher = $dispatcher;
+        $this->cookieProviders = $cookieProviders;
+        $this->removeTokenFromBodyWhenCookiesUsed = $removeTokenFromBodyWhenCookiesUsed;
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    public function onAuthenticationSuccess(Request $request, TokenInterface $token): Response
+    {
+        return $this->handleAuthenticationSuccess($token->getUser());
+    }
+
+    /**
+     * @return Response
+     */
+    public function handleAuthenticationSuccess(UserInterface $user, $jwt = null)
+    {
+        if (null === $jwt) {
+            $jwt = $this->jwtManager->create($user);
+        }
+
+        $jwtCookies = [];
+        foreach ($this->cookieProviders as $cookieProvider) {
+            $jwtCookies[] = $cookieProvider->createCookie($jwt);
+        }
+
+        $response = new JWTAuthenticationSuccessResponse($jwt, [], $jwtCookies);
+        $event = new AuthenticationSuccessEvent(['token' => $jwt], $user, $response);
+
+        $this->dispatcher->dispatch($event, Events::AUTHENTICATION_SUCCESS);
+        $responseData = $event->getData();
+
+        if ($jwtCookies && $this->removeTokenFromBodyWhenCookiesUsed) {
+            unset($responseData['token']);
+        }
+
+        if ($responseData) {
+            $response->setData($responseData);
+        } else {
+            $response->setStatusCode(JWTAuthenticationSuccessResponse::HTTP_NO_CONTENT);
+        }
+
+        return $response;
+    }
+}
@@ -0,0 +1,81 @@
+<?php
+
+namespace Lexik\Bundle\JWTAuthenticationBundle\Security\Http\Cookie;
+
+use Lexik\Bundle\JWTAuthenticationBundle\Helper\JWTSplitter;
+use Symfony\Component\HttpFoundation\Cookie;
+use Symfony\Component\HttpKernel\Kernel;
+
+/**
+ * Creates secure JWT cookies.
+ */
+final class JWTCookieProvider
+{
+    private $defaultName;
+    private $defaultLifetime;
+    private $defaultSameSite;
+    private $defaultPath;
+    private $defaultDomain;
+    private $defaultSecure;
+    private $defaultHttpOnly;
+    private $defaultSplit;
+    private $defaultPartitioned;
+
+    public function __construct(?string $defaultName = null, ?int $defaultLifetime = 0, ?string $defaultSameSite = Cookie::SAMESITE_LAX, ?string $defaultPath = '/', ?string $defaultDomain = null, bool $defaultSecure = true, bool $defaultHttpOnly = true, array $defaultSplit = [], bool $defaultPartitioned = false)
+    {
+        $this->defaultName = $defaultName;
+        $this->defaultLifetime = $defaultLifetime;
+        $this->defaultSameSite = $defaultSameSite;
+        $this->defaultPath = $defaultPath;
+        $this->defaultDomain = $defaultDomain;
+        $this->defaultSecure = $defaultSecure;
+        $this->defaultHttpOnly = $defaultHttpOnly;
+        $this->defaultSplit = $defaultSplit;
+        $this->defaultPartitioned = $defaultPartitioned;
+
+        if ($defaultPartitioned && Kernel::VERSION < '6.4') {
+            throw new \LogicException(sprintf('The `partitioned` option for cookies is only available for Symfony 6.4 and above. You are currently on version %s', Kernel::VERSION));
+        }
+    }
+
+    /**
+     * Creates a secure cookie containing the passed JWT.
+     *
+     * For each argument (all args except $jwt), if omitted or set to null then the
+     * default value defined via the constructor will be used.
+     */
+    public function createCookie(string $jwt, ?string $name = null, $expiresAt = null, ?string $sameSite = null, ?string $path = null, ?string $domain = null, ?bool $secure = null, ?bool $httpOnly = null, array $split = [], ?bool $partitioned = null): Cookie
+    {
+        if (!$name && !$this->defaultName) {
+            throw new \LogicException(sprintf('The cookie name must be provided, either pass it as 2nd argument of %s or set a default name via the constructor.', __METHOD__));
+        }
+
+        if (!$expiresAt && null === $this->defaultLifetime) {
+            throw new \LogicException(sprintf('The cookie expiration time must be provided, either pass it as 3rd argument of %s or set a default lifetime via the constructor.', __METHOD__));
+        }
+
+        if ($partitioned && Kernel::VERSION < '6.4') {
+            throw new \LogicException(sprintf('The `partitioned` option for cookies is only available for Symfony 6.4 and above. You are currently on version %s', Kernel::VERSION));
+        }
+
+        $jwtParts = new JWTSplitter($jwt);
+        $jwt = $jwtParts->getParts($split ?: $this->defaultSplit);
+
+        if (null === $expiresAt) {
+            $expiresAt = 0 === $this->defaultLifetime ? 0 : (time() + $this->defaultLifetime);
+        }
+
+        return Cookie::create(
+            $name ?: $this->defaultName,
+            $jwt,
+            $expiresAt,
+            $path ?: $this->defaultPath,
+            $domain ?: $this->defaultDomain,
+            $secure ?: $this->defaultSecure,
+            $httpOnly ?: $this->defaultHttpOnly,
+            false,
+            $sameSite ?: $this->defaultSameSite,
+            $partitioned ?: $this->defaultPartitioned
+        );
+    }
+}
@@ -0,0 +1,36 @@
+<?php
+
+namespace Lexik\Bundle\JWTAuthenticationBundle\Security\Http\EntryPoint;
+
+use Lexik\Bundle\JWTAuthenticationBundle\Response\JWTAuthenticationFailureResponse;
+use Lexik\Bundle\JWTAuthenticationBundle\Security\Authenticator\JWTAuthenticator;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\Security\Core\Exception\AuthenticationException;
+use Symfony\Component\Security\Http\EntryPoint\AuthenticationEntryPointInterface;
+
+/**
+ * JWTEntryPoint starts throw a 401 when not authenticated.
+ *
+ * @author Jérémie Augustin <jeremie.augustin@pixel-cookers.com>
+ *
+ * @deprecated since 2.0, will be removed in 3.0. Use
+ *             {@link JWTAuthenticator} instead
+ */
+class JWTEntryPoint implements AuthenticationEntryPointInterface
+{
+    public function __construct()
+    {
+        @trigger_error(sprintf('The "%s" class is deprecated since version 2.0 and will be removed in 3.0. Use "%s" instead.', self::class, JWTAuthenticator::class), E_USER_DEPRECATED);
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    public function start(Request $request, AuthenticationException $authException = null): Response
+    {
+        $response = new JWTAuthenticationFailureResponse();
+
+        return $response;
+    }
+}
@@ -0,0 +1,78 @@
+<?php
+
+namespace Lexik\Bundle\JWTAuthenticationBundle\Security\User;
+
+/**
+ * User class for which to create instances from JWT tokens.
+ *
+ * Note: This is only useful when using the JWTUserProvider (database-less).
+ *
+ * @author Robin Chalas <robin.chalas@gmail.com>
+ */
+class JWTUser implements JWTUserInterface
+{
+    private $userIdentifier;
+    private $roles;
+
+    public function __construct(string $userIdentifier, array $roles = [])
+    {
+        $this->userIdentifier = $userIdentifier;
+        $this->roles = $roles;
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    public static function createFromPayload($username, array $payload)
+    {
+        if (isset($payload['roles'])) {
+            return new static($username, (array) $payload['roles']);
+        }
+
+        return new static($username);
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    public function getUsername(): string
+    {
+        return $this->getUserIdentifier();
+    }
+
+    public function getUserIdentifier(): string
+    {
+        return $this->userIdentifier;
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    public function getRoles(): array
+    {
+        return $this->roles;
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    public function getPassword(): ?string
+    {
+        return null;
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    public function getSalt(): ?string
+    {
+        return null;
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    public function eraseCredentials(): void
+    {
+    }
+}
@@ -0,0 +1,17 @@
+<?php
+
+namespace Lexik\Bundle\JWTAuthenticationBundle\Security\User;
+
+use Symfony\Component\Security\Core\User\UserInterface;
+
+interface JWTUserInterface extends UserInterface
+{
+    /**
+     * Creates a new instance from a given JWT payload.
+     *
+     * @param string $username
+     *
+     * @return JWTUserInterface
+     */
+    public static function createFromPayload($username, array $payload);
+}
@@ -0,0 +1,85 @@
+<?php
+
+namespace Lexik\Bundle\JWTAuthenticationBundle\Security\User;
+
+use Symfony\Component\Security\Core\User\UserInterface;
+
+/**
+ * JWT User provider.
+ *
+ * @author Robin Chalas <robin.chalas@gmail.com>
+ */
+final class JWTUserProvider implements PayloadAwareUserProviderInterface
+{
+    private $class;
+
+    private $cache = [];
+
+    /**
+     * @param string $class The {@link JWTUserInterface} implementation FQCN for which to provide instances
+     */
+    public function __construct($class)
+    {
+        $this->class = $class;
+    }
+
+    /**
+     * {@inheritdoc}
+     *
+     * @param array $payload The JWT payload from which to create an instance
+     *
+     * @return UserInterface
+     */
+    public function loadUserByUsername($username, array $payload = [])
+    {
+        return $this->loadUserByUsernameAndPayload($username, $payload);
+    }
+
+    /**
+     * {@inheritdoc}
+     *
+     * @param array $payload The JWT payload from which to create an instance
+     */
+    public function loadUserByIdentifier(string $identifier, array $payload = []): UserInterface
+    {
+        return $this->loadUserByIdentifierAndPayload($identifier, $payload);
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    public function loadUserByUsernameAndPayload(string $username, array $payload): UserInterface
+    {
+        if (isset($this->cache[$username])) {
+            return $this->cache[$username];
+        }
+
+        $class = $this->class;
+
+        return $this->cache[$username] = $class::createFromPayload($username, $payload);
+    }
+
+    public function loadUserByIdentifierAndPayload(string $userIdentifier, array $payload): UserInterface
+    {
+        if (isset($this->cache[$userIdentifier])) {
+            return $this->cache[$userIdentifier];
+        }
+
+        $class = $this->class;
+
+        return $this->cache[$userIdentifier] = $class::createFromPayload($userIdentifier, $payload);
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    public function supportsClass($class): bool
+    {
+        return $class === $this->class || (new \ReflectionClass($class))->implementsInterface(JWTUserInterface::class);
+    }
+
+    public function refreshUser(UserInterface $user): UserInterface
+    {
+        return $user; // noop
+    }
+}
@@ -0,0 +1,23 @@
+<?php
+
+namespace Lexik\Bundle\JWTAuthenticationBundle\Security\User;
+
+use Lexik\Bundle\JWTAuthenticationBundle\Exception\UserNotFoundException;
+use Symfony\Component\Security\Core\Exception\UsernameNotFoundException;
+use Symfony\Component\Security\Core\User\UserInterface;
+use Symfony\Component\Security\Core\User\UserProviderInterface;
+
+/**
+ * @method UserInterface loadUserByIdentifierAndPayload(string $identifier, array $payload) Loads a user from an identifier and JWT token payload.
+ */
+interface PayloadAwareUserProviderInterface extends UserProviderInterface
+{
+    /**
+     * Load a user by its username, including the JWT token payload.
+     *
+     * @throws UsernameNotFoundException|UserNotFoundException if the user is not found
+     *
+     * @deprecated since 2.12, implement loadUserByIdentifierAndPayload() instead.
+     */
+    public function loadUserByUsernameAndPayload(string $username, array $payload)/*: UserInterface*/;
+}