REST Api with QueryParamAuth authenticator - Yii2

Question

I'm trying to create rest api for my application to get the data in my android app. This is my controller

<?php

namespace api\modules\v1\controllers;

use yii\rest\ActiveController;
use yii\filters\auth\QueryParamAuth;

/**
 * Tk103 Controller API
 */
class Tk103Controller extends ActiveController
{
    public $modelClass = 'api\modules\v1\models\Tk103CurrentLocation';  

    public function behaviors()
    {
        $behaviors = parent::behaviors();
        $behaviors['authenticator'] = [
            'class' => QueryParamAuth::className(),
        ];
        return $behaviors;
    }  

}

I added access_token column in my user table, implemented findIdentityByAccessToken() in User Model and calling this URL http://localhost:7872/api/v1/tk103s?access-token=abcd

This is working great and returning data if and only if access_token matches with any single user in the table. I checked QueryParamAuth class and found that QueryParamAuth::authenticate() returns $identity after successful authentication.

Currently this url is returning whole data of my table.

What I want is(after authentication):

1. Get user id/username of the requester.
2. Based on that id/username, the data related to him as per relations of tables in db. (currently whole rows are being returned but I want only few that are matching with the current requester/user)

I tried but didn't getting any clue to catch returned $identity of user after authentication. And I know it is possible too to make this work. Help me out folks to create magic.

Answer 1

1. Get user id/username of the requester.

That user instance you did return within the findIdentityByAccessToken method should be accessible any where inside your app within Yii::$app->user->identity. And should hold all the attributes retreived from DB. here is a quick example of using it to check access within the checkAccess method of the ActiveController class:

public function checkAccess($action, $model = null, $params = [])
{
    // only an image owner can request the related 'delete' or 'update' actions
    if ($action === 'update' or $action === 'delete') {
        if ($model->user_id !== \Yii::$app->user->identity->id)
            throw new \yii\web\ForbiddenHttpException('You can only '.$action.' images that you\'ve added.');
    }
}

Note that the checkAccess is by default an empty method that is manually called inside all the built-in actions in ActiveController. the Idea is to pass the action ID and the model instance to it just after retrieving it from DB and before modifying it so we can do extra checks. If you just need to perform checks by actions ID then yii\filters\AccessControl may be enough but inside checkAccess you are expecting to also get the model instance itself so it is important to note that when building your own actions or overriding existing onces. be sure to manually invoke it the same way it is done in UpdateAction.php or DeleteAction.php.

---

2. whole rows are being returned but I want only few .. matching with .. current requester/user

It depends on how your data is structured. You can override ActiveController's actions to filter results before outputting them, it can be handled in the related SearchModel class if you are using one or it can be handled in model. A quick tip may be by simply overriding the find method inside your model:

public static function find()
{
    return parent::find()->where(['user_id' => Yii::$app->user->getId()]); // or Yii::$app->user->identity->id
}

Note that this works only when using ActiveRecord. Which means when using this:

$images = Image::find()->all();

The find method we just overriden will be filtered by default by always including that where condition before generating the DB query. Also note the default built-in actions in ActiveController are using ActiveRecords but if you are using actions where you are constructing the SQL queries using the Query Builder then you should manually do the filtering.

The same can be done if using ActiveQuery (maybe better explained here) by doing this:

public static function find()
{
    $query = new \app\models\Image(get_called_class());
    return $query->andWhere(['user_id' => Yii::$app->user->getId()]);
}